The FTC’s data-sharing order against GM was finally settled

The Federal Trade Commission announced Wednesday that it has finalized an order barring General Motors and telematics service OnStar from sharing certain consumer data with consumer reporting agencies. The finalized order, which comes a year after the company reached a proposed settlement with GM, also requires the automaker to be more transparent with its consumers and obtain their express consent for any data collection.

THE finalized order it comes almost two years after one New York Times report showed how GM and OnStar collected, used and sold drivers’ precise geolocation and driving behavior data to third parties, including data proxies LexisNexis and Verisk. The data was collected through GM’s Smart Driver program, a free feature included in its connected car apps that monitored and evaluated driving behaviors and seat belt usage. Data brokers sold that information to insurance providers, which could affect customers’ rates, the NYT reported at the time.

GM was discontinued the Smart Driver program in April 2024 across all its brands, citing customer feedback. GM said at the time that it unsubscribed all customers and ended third-party telematics relationships with LexisNexis and Verisk.

The FTC alleged that GM and OnStar used a deceptive registration process to get consumers to sign up for the OnStar connected vehicle service and the OnStar Smart Driver feature. The FTC also alleged that the automaker did not clearly disclose that the data would be collected and sold to third parties.

Under the order finalized Wednesday, GM must also obtain express consent from consumers before collecting, using or sharing connected vehicle data. This process happens at the dealership when a consumer buys a car from a GM brand. At that point, the OnStar system is linked to the vehicle’s specific VIN number and the new owner is asked whether or not they agree to the data collection, according to GM.

However, there are some exceptions to the data collection ban. GM is allowed to share location data with emergency first responders and for internal investigation, the FTC said. GM confirmed this, noting that it collects data for internal research and development and sometimes shares de-identified or anonymized data (not associated with specific drivers or vehicles) with select partners to improve city infrastructure and improve road safety. For example, the data was shared with the University of Michigan, which used it urban planning.

GM must also create a way for all US consumers to request a copy of their data and seek to have it deleted, and give them the ability to disable the collection of precise geolocation data from their vehicles. GM says it has already complied with those orders.

GM says it began reviewing its data collection and privacy policies and programs in 2024. For example, the automaker said it has consolidated many of its U.S. privacy statements into a single, simpler statement and expanded its privacy program that allows customers to access and delete their personal information.

“The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address the concerns,” GM said in an emailed statement. “As vehicle connectivity becomes an increasingly integral part of the driving experience, GM remains committed to protecting customer privacy, maintaining trust and ensuring customers have a clear understanding of our practices.”