FTC bans GM from selling driver data without explicit consent
The Federal Trade Commission finalized an order on Wednesday banning General Motors and its OnStar telematics service from sharing certain consumer data with consumer reporting agencies, requiring explicit consent for connected-vehicle data collection following allegations of misleading practices.
The order stems from a proposed settlement reached a year earlier. It mandates greater transparency in GM’s data handling. This development follows a 2022 New York Times report detailing how GM and OnStar gathered precise geolocation data and driving behavior information from drivers, then sold it to third-party data brokers including LexisNexis and Verisk Boden.
The data collection occurred through GM’s Smart Driver program, offered as a free feature within its connected-car applications. This program tracked and rated various driving behaviors, such as acceleration, braking, speed, and seatbelt usage. Participants received scores based on these metrics. Data brokers subsequently sold the information to insurance providers, which used it to potentially adjust customers’ insurance rates.
In response to customer feedback, GM discontinued the Smart Driver program in April 2024 across all its brands. The company unenrolled all participating customers and terminated its third-party telematics partnerships with LexisNexis and Verisk at that time.
The FTC’s allegations centered on GM and OnStar’s enrollment process for the OnStar connected vehicle service and the OnStar Smart Driver feature. Regulators claimed this process misled consumers into signing up. Additionally, GM failed to clearly disclose that the collected data would be shared and sold to third parties.
Under the finalized order, GM must obtain explicit consent from consumers before collecting, using, or sharing any connected-vehicle data. This consent process takes place at the dealership during the purchase of a GM-brand vehicle. There, the OnStar system links to the specific vehicle’s VIN number, and the new owner receives a prompt asking whether they agree to data collection.
Certain exceptions apply to the data-sharing restrictions. GM may share location data with emergency first responders. The company can also use data for internal research. Furthermore, GM shares de-identified data, which is anonymized and not linked to specific drivers or vehicles, with select partners. These partners use the data to improve city infrastructure and road safety. For example, GM has provided such data to the University of Michigan for urban planning initiatives.
The order requires GM to establish mechanisms for all U.S. consumers to request copies of their personal data, seek its deletion, and disable the collection of precise geolocation data from their vehicles. GM states it has already implemented these requirements.
GM initiated significant changes to its data collection and privacy policies in 2024. The automaker consolidated multiple U.S. privacy statements into a single, simpler document. It also expanded its privacy program, enabling customers to more easily access and delete their personal information.