The FTC’s data-sharing order against GM is finally settled | TechCrunch

The Federal Trade Commission said Wednesday it has finalized an order banning General Motors and its OnStar telematics service from sharing certain consumer data with consumer reporting agencies. The final order, which comes a year after the agency reached a proposed settlement with GM, also requires the automaker to be more transparent with its consumers and obtain their explicit consent for any data collection.

The completed order comes almost two years after a New York Times report showed how GM and OnStar collected, used and sold drivers’ precise geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data was collected through GM’s Smart Driver program, a free feature in its connected car apps that tracks and rates driving behavior and seat belt use. Data brokers sold this information to insurance companies, which could affect customers’ rates, the NYT reported at the time.

GM discontinued the Smart Driver program in April 2024 for all its brands, citing customer feedback. GM said at the time that it had unenrolled all customers and terminated third-party telematics relationships with LexisNexis and Verisk.

The FTC alleged that GM and OnStar used a deceptive enrollment process to entice consumers to sign up for the OnStar connected vehicle service and the OnStar Smart Driver feature. The FTC also alleged that the automaker failed to clearly disclose that the data would be collected and sold to third parties.

Under the decision finalized Wednesday, GM is also required to obtain explicit consent from consumers before collecting, using or sharing connected vehicle data. This process takes place at the dealership when a consumer purchases a GM branded vehicle. At that point, the OnStar system is linked to that specific vehicle’s VIN number and asks the new owner whether or not he or she agrees to the data collection, GM said.

However, there are some exceptions to the ban on data collection. GM may share location data with first responders and for internal investigations, the FTC said. GM confirmed this, noting that it collects data for internal research and development and sometimes shares anonymized or de-identified data (not tied to specific drivers or vehicles) with select partners to improve city infrastructure and improve road safety. For example, data has been shared with the University of Michigan, which used it for this purpose urban planning.

GM should also create a way for all U.S. consumers to request a copy of their data and demand its deletion, and give them the ability to opt-out of the collection of precise geolocation data from their vehicles. GM says it has already met these mandates.

GM says it began reviewing its data collection and privacy policies and programs in 2024. For example, the automaker said it has consolidated many of its U.S. privacy statements into a single, simpler statement and expanded a GM privacy program that allows customers to access and delete their personal data.

“The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns,” read an emailed statement from GM. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust and ensuring customers have a clear understanding of our practices.”