The FTC’s data-sharing order against GM is finally settled

The Federal Trade Commission (FTC) announced on Wednesday that it has formally concluded an order prohibiting General Motors (GM) and its OnStar telematics service from sharing specific consumer data with reporting agencies. This order comes a year after the FTC proposed a settlement with GM, enhancing transparency and mandating that the automaker secure explicit consumer consent regarding any data collection. This finalized directive arrives nearly two years following a New York Times report that detailed how GM and OnStar collected, utilized, and sold drivers' exact geolocation data and driving habits to third parties, including data brokers like LexisNexis and Verisk. The information was gathered through GM’s Smart Driver program, a no-cost feature integrated into its connected car applications that monitored and evaluated driving behaviors and seatbelt usage. Insurance providers had access to this data, which could influence customers' insurance premiums, as reported by the NYT at the time. In response to consumer feedback, GM discontinued the Smart Driver program across all its brands in April 2024, stating that it had unenrolled all customers and terminated its partnerships with the data brokers involved. Allegations from the FTC claimed that GM and OnStar employed a deceptive enrollment process that misled consumers into subscribing to the OnStar connected vehicle service and the Smart Driver feature, without adequately disclosing that their data would be collected and sold. Under the new order, GM is now required to obtain explicit consent from consumers before gathering, using, or sharing connected vehicle data. This consent process is initiated at the dealership when a customer buys a vehicle from a GM brand. At this time, the OnStar system is linked to the vehicle's VIN, and customers are asked to agree or decline data collection. There are specific exceptions to the data sharing ban; GM is permitted to share location data with emergency responders and for internal research, as stated by the FTC. GM has confirmed that it gathers data for internal R&D and occasionally shares anonymized data—data not tied to individual drivers or vehicles—with selected partners to improve city infrastructure and enhance road safety. For example, the University of Michigan utilized some of this data for urban planning initiatives. Furthermore, GM must implement a system enabling U.S. consumers to request copies of their data, seek its deletion, and disable the collection of precise geolocation data from their vehicles. The automaker asserts that it has already made strides to comply with these requirements. Since 2024, GM has been revamping its data collection and privacy policies, consolidating various privacy statements into a more user-friendly format and expanding its privacy program to empower customers to manage their personal information. In an official statement, GM expressed its commitment to customer privacy, stating, "The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns. As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices."