FTC’s data sharing order against GM finally settled

The Federal Trade Commission announced Wednesday that it has finalized an order prohibiting General Motors and its OnStar telematics service from sharing certain consumer data with consumer reporting agencies. The final order comes a year after the agency reached a settlement with GM that requires the automaker to be more transparent with consumers and get clear consent for data collection.

The final order comes nearly two years after a New York Times report showed how GM and OnStar collected, used, and sold drivers’ precise geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. This data was collected through GM’s Smart Driver program. The program is a free feature included in connected car apps that tracks and evaluates driving behavior and seat belt usage. Data brokers sell this information to insurance companies, which can affect customers’ rates, the NYT reported at the time.

GM discontinued its smart driver program across all brands in April 2024 due to customer feedback. GM said at the time that it had deregistered all customers and ended its third-party telematics relationships with LexisNexis and Verisk.

The FTC alleged that GM and OnStar used a misleading registration process to get consumers to enroll in their OnStar connected car services and OnStar smart driver features. The FTC also alleged that automakers did not clearly disclose that the data would be collected and sold to third parties.

The order, finalized Wednesday, requires GM to obtain explicit consent from consumers before collecting, using or sharing connected car data. This process takes place at the dealership when a consumer purchases a car from the GM brand. At that point, the OnStar system will be tied to a specific vehicle’s VIN number and the new owner will be asked if they consent to data collection, GM said.

However, there are some exceptions to the data collection ban. According to the FTC, GM is allowed to share location data with emergency responders and for internal investigations. GM acknowledged this, noting that it collects data for internal research and development and may share de-identified or anonymized data (not tied to a specific driver or vehicle) with certain partners to strengthen city infrastructure and improve road safety. For example, data was shared with the University of Michigan and used for city planning.

GM must also establish a way for all U.S. consumers to request a copy of their data and have it deleted, and provide the ability to disable the collection of precise geolocation data from their vehicles. GM says it has already complied with these obligations.

GM said it has begun a complete review of its data collection and privacy policies and programs in 2024. For example, the automaker said it has consolidated many of its U.S. privacy statements into a single, simpler statement and expanded its privacy program to allow customers to access and delete their personal information.

“The Federal Trade Commission has formally approved the agreement reached with General Motors last year to address concerns,” an emailed statement from GM said. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust and ensuring customers clearly understand our practices.”