The Federal Trade Commission (FTC) announced on Wednesday that it has finalized an order barring General Motors (GM) and its OnStar telematics service from sharing specific consumer data with consumer reporting agencies. The decision follows a proposed settlement reached a year ago, and it also mandates greater transparency from the automaker regarding data collection practices. GM must now obtain explicit consent from consumers before collecting certain data through its connected vehicle systems.
Background On Data Collection Concerns
The finalized order comes nearly two years after a New York Times report revealed that GM and OnStar had collected and sold drivers’ geolocation data and driving behaviors to third parties, including data brokers LexisNexis and Verisk. This data was gathered through GM’s Smart Driver program, a free service that tracked and rated driving behaviors, including seatbelt use, through its connected car apps. This information was then sold to insurance companies, potentially influencing customers’ insurance rates.
In response to consumer feedback, GM discontinued the Smart Driver program in April 2024 across all its brands and ended its relationships with the data brokers. However, the FTC’s investigation found that GM and OnStar had used a misleading enrollment process for the OnStar service and Smart Driver feature, failing to clearly disclose how consumer data would be collected and sold to third parties.
New Requirements For Data Collection and Consent
Under the new order, GM is required to obtain explicit consumer consent before collecting, using, or sharing connected vehicle data. This consent process will take place at the dealership when a consumer buys a GM vehicle. At that time, the owner will be asked whether they agree to data collection via the OnStar system, which is linked to their vehicle’s VIN number.
The FTC’s order does allow some exceptions, such as sharing location data with emergency responders and for internal research purposes. GM confirmed that it collects and uses data for internal development and occasionally shares anonymized data with partners like the University of Michigan for urban planning and road safety improvements.
Access and Deletion of Data
The finalized order also requires GM to establish a process allowing U.S. consumers to request access to their data and delete it if desired. Consumers must also be able to opt out of the collection of precise geolocation data. GM stated it has already complied with these requirements and has revamped its data collection and privacy policies since 2024. The company has simplified its privacy statements and expanded its privacy program to give customers more control over their personal information.
GM’s Commitment To Consumer Privacy
In an emailed statement, GM emphasized its commitment to consumer privacy, stating, “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”
The FTC’s decision represents a significant move to hold companies accountable for the collection and sale of personal data, particularly as connected vehicle technologies become more widespread.
Featured image credits: ShareVault
For more stories like it, click the +Follow button at the top of this page to follow us.