TL;DR
The Federal Trade Commission has finalized an order that prohibits General Motors and its OnStar service from sharing certain connected-vehicle data with consumer reporting agencies and requires clearer disclosures and explicit consumer consent. The move follows a New York Times exposé and a year-old proposed settlement; GM says it has already changed programs and privacy notices to comply.
What happened
The FTC on Wednesday formalized an agreement that restricts General Motors and its OnStar telematics unit from providing specified consumer data to consumer reporting agencies and third-party buyers. The finalized order follows a proposed settlement reached a year ago and comes nearly two years after reporting that GM’s Smart Driver program collected precise location and driving-behavior data and routed it to data brokers such as LexisNexis and Verisk. The agency alleged GM used a confusing enrollment process and did not make clear that collected data could be sold. Under the order, GM must obtain explicit consent before collecting, using, or sharing connected-vehicle data, a step that the company implements when a vehicle is linked to a VIN at the dealership. There are limited exceptions for emergency responders and internal research. The automaker was required to provide mechanisms for consumers to access and delete their data and to disable precise geolocation collection; GM says it has carried out these measures and consolidated its privacy statements.
Why it matters
- Strengthens consumer privacy protections around connected-vehicle data and telematics.
- Limits the flow of precise geolocation and driving-behavior data to data brokers and potential downstream buyers such as insurers.
- Establishes precedent for regulatory scrutiny of how automakers obtain consent and disclose data practices.
- Requires automakers to offer data access, deletion, and opt-out controls, changing how vehicle connectivity is managed at purchase.
Key facts
- The FTC finalized the order after a proposed settlement with GM was announced a year earlier.
- The agency alleged GM and OnStar used a misleading enrollment process and failed to disclose third-party data sales.
- A New York Times report nearly two years earlier found that GM’s Smart Driver program collected precise geolocation and driving behavior and shared it with data brokers including LexisNexis and Verisk.
- GM discontinued the Smart Driver program in April 2024 and said it unenrolled customers and ended those third-party telematics relationships.
- The order requires GM to obtain explicit consent before collecting, using, or sharing connected-vehicle data; GM links OnStar to a vehicle VIN at the dealership and obtains consent then.
- Exceptions permit sharing location data with emergency first responders and use for internal research.
- GM confirmed it sometimes shares de-identified data with partners to support projects like urban planning (the University of Michigan is cited as an example).
- The company must provide a way for U.S. consumers to request copies of their data, seek deletion, and disable precise geolocation collection; GM says it has implemented these capabilities.
- GM said it has simplified and consolidated its U.S. privacy statements and expanded a privacy program for customer access and deletion.
What to watch next
- Whether the FTC will monitor GM’s ongoing compliance and how that oversight will be conducted: not confirmed in the source.
- If this order prompts similar enforcement actions or settlements with other automakers and telematics providers: not confirmed in the source.
- How insurers, data brokers, and downstream buyers adapt their models if access to precise telematics and location feeds is limited: not confirmed in the source.
Quick glossary
- Telematics: Technology that collects and transmits data from vehicles, including location, speed, and engine diagnostics.
- Geolocation data: Information that indicates the physical location of a device or vehicle, often precise enough to track movements.
- Data broker: A company that buys, aggregates, and sells consumer data to third parties such as insurers, marketers, or analytics firms.
- De-identified data: Data that has had identifying details removed so records cannot be directly linked to a specific person or vehicle.
- Consumer reporting agency: An organization that compiles and provides consumer information, often used in contexts like credit or insurance risk assessment.
Reader FAQ
What does the FTC order require GM to stop doing?
It bars GM and OnStar from sharing certain consumer-connected-vehicle data with consumer reporting agencies and requires explicit consent and clearer disclosures before collecting or sharing data.
Is the Smart Driver program still active?
No. GM discontinued the Smart Driver program across its brands in April 2024 and said it unenrolled customers and ended related third-party telematics relationships.
Can GM still share any location data?
Yes — the order allows sharing for emergency responders and for internal research; GM also said it sometimes shares de-identified data with select partners.
Will insurers still be able to use GM data to set rates?
Not confirmed in the source.
The Federal Trade Commission said Wednesday it has finalized an order that bans General Motors and its OnStar telematics service from sharing certain consumer data with consumer reporting agencies. The…
Sources
- The FTC’s data-sharing order against GM is finally settled
- FTC Takes Action Against General Motors for Sharing …
- In a First, FTC to Ban GM from Sharing Connected Vehicle …
- GM reaches settlement agreement with FTC on Smart Driver
Related posts
- US Sees First Negative Net Migration in 50 Years in 2025, Brookings Reports
- Tech Employees Criticize ICE While Silicon Valley Executives Largely Stay Silent
- When you hit an age gate: navigating verification choices and privacy risks