The FTC’s data-sharing order against GM is finally settled

The Federal Trade Commission said Wednesday it has finalized an order that bans General Motors and its OnStar telematics service from sharing certain consumer data with consumer reporting agencies. The finalized order, which comes a year after the agency reached a proposed settlement with GM, also requires the automaker to be more transparent with its consumers and obtain their explicit consent on any data collection.

The finalized order comes nearly two years after a New York Times report showed how GM and OnStar collected, used, and sold drivers’ precise geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data was collected through GM’s Smart Driver program, a free feature contained within its connected car apps that tracked and rated driving behaviors and seatbelt use. Data brokers sold this information to insurance providers, which could affect customers’ rates, the NYT reported at the time.

GM discontinued the Smart Driver program in April 2024 across all of its brands, citing customer feedback. GM said at the time it unenrolled all customers and ended its third-party telematics relationships with LexisNexis and Verisk.

The FTC alleged that GM and OnStar used a misleading enrollment process to get consumers to sign up for its OnStar connected vehicle service and OnStar Smart Driver feature. The FTC also alleged the automaker failed to clearly disclose that the data would be collected and sold to third parties.

Under the order finalized Wednesday, GM is also required to obtain explicit consent from consumers prior to collecting, using, or sharing connected vehicle data. This process occurs at the dealership when a consumer buys a car from a GM brand. At that point, the OnStar system is linked to that particular vehicle VIN number and the new owner is asked whether they agree or not with data collection, according to GM.

There are some exceptions to the data collection ban, however. GM is allowed to share location data with emergency first responders and for internal research, the FTC said. GM confirmed this, noting it collects data for internal research and development and sometimes shares de-identified, or anonymized data (not associated with specific drivers or vehicles) with select partners to enhance city infrastructure and improve road safety. For instance, data has been shared with the University of Michigan, which used it for urban planning.

GM must also establish a way for all U.S. consumers to request a copy of their data and seek its deletion and give them the ability to disable the collection of precise geolocation data from their vehicles. GM says it has already complied with these mandates.

GM says it began overhauling its policies and programs on data collection and privacy in 2024. For instance, the automaker said it has consolidated many of its U.S. privacy statements into a single, simpler statement and expanded its a GM privacy program that allows customers to access and delete their personal information.

“The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns,” an emailed statement from GM reads. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”