We regularly hear stories about companies selling your sensitive personal information — including your location data — to the highest bidder. The latest culprit appears to be General Motors.
The Federal Trade Commission alleges that GM and Onstar – GM’s assisted vehicle safety and security system – collected, used and sold precise geolocation data and driver driving behavior information from millions of vehicles without adequately notifying consumers and obtaining their consent.
On Thursday the agency issued a motion for injunction prohibit the company from selling such data to consumer reporting agencies for five years.
In its complaint, the FTC alleged that GM used a “deceptive enrollment process” to get consumers to sign up for Onstar. Some users reported that they were unaware they were enrolled in Onstar’s Smart Driver feature, which promises to use driving data to help drivers improve their vehicle’s performance and encourage safer driving.
“GM tracked and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,” FTC Chairwoman Lina M. Khan said in a statement.
This is the latest issue that has plagued the auto giant in recent weeks. Last month, GM pulled the plug on funding for its autonomous vehicle unit Cruise, a company in which GM has invested more than $10 billion.
Thursday’s settlement with the FTC follows one investigation by Kashmir Hill of the New York Timeswho discovered that GM was collecting details about its customers’ driving habits — including all instances of hard braking, late-night driving and speeding — and selling the records to insurance companies and third-party data brokers. The result was that drivers started seeing higher premiums but couldn’t figure out why.
The potential misuse of customer data goes beyond increased insurance premiums. A person’s geolocation data can reveal the most intimate details of a person’s life, including where they live and work and whether they have visited a medical facility or place of worship. In the wrong hands, location data poses a serious risk, for example, to abortion seekers across the country.
As part of the FTC’s proposed order — if approved by a court — GM and Onstar would be prohibited from disclosing data to consumer reporting agencies and would also have to obtain positive express consent from consumers before collecting vehicle data in the future. The car industry should also allow customers to receive and delete their data, as well as limit the collection of data from their vehicles.
Since it is still a proposed order, the agreement will be subject to a 30-day public comment period before a final decision goes into effect.
TechCrunch has reached out to GM and the FTC for additional information and will update if we hear back.
