At a Glance
- The FTC has finalized an order banning GM and OnStar from sharing consumer data with credit-reporting agencies
- GM must obtain explicit consent before collecting connected-vehicle data
- Drivers can now request, delete, and disable precise location tracking
- Why it matters: Car owners gain new privacy rights after years of hidden data sales to insurers
The Federal Trade Commission on Wednesday finalized a sweeping order that bars General Motors and its OnStar telematics unit from sharing certain consumer data with credit-reporting agencies. The move caps a year-long process that began when the agency first proposed the settlement and follows nearly two years of scrutiny over how the automaker quietly monetized driver behavior.
Secret Data Sales Exposed
A 2022 New York Times investigation revealed that GM and OnStar had been harvesting precise geolocation and driving-behavior data through the free Smart Driver feature embedded in connected-car apps. The system scored seat-belt use, braking habits, and acceleration, then funneled those insights to data brokers LexisNexis and Verisk. Insurance carriers, in turn, purchased the information-sometimes adjusting premiums without drivers’ knowledge.
The FTC alleged that GM’s enrollment process for OnStar and Smart Driver was misleading. Consumers were never clearly told their data would be collected, packaged, and sold to third parties, the commission said.
Program Killed, Relationships Cut
Facing public backlash, GM discontinued Smart Driver in April 2024 across all brands and unenrolled every customer. The automaker also terminated its telematics contracts with LexisNexis and Verisk, according to a company statement cited by News Of Philadelphia.
Consent Now Required at Purchase
Under the finalized order, GM must secure explicit consent before collecting, using, or sharing any connected-vehicle data. The consent checkpoint happens at dealerships when a buyer takes delivery. The OnStar module, already tied to the vehicle identification number, prompts the new owner to accept or reject data collection.
Exceptions to the Ban
| Permitted Sharing | Purpose |
|---|---|
| Emergency responders | Location data for crash or medical aid |
| Internal R&D | De-identified data for product development |
| Urban-planning partners | Anonymized traffic patterns for infrastructure projects |
GM confirmed it still shares de-identified data with select academic partners, such as the University of Michigan, to improve road safety and city planning.
New Consumer Rights
The order requires GM to create a simple, nationwide process for U.S. customers to:
- Request a copy of their personal data
- Demand deletion of that data
- Disable precise geolocation tracking from their vehicles
GM told News Of Philadelphia it has already built and launched these tools.
Privacy Overhaul Under Way
The automaker says it began overhauling privacy practices in 2024, consolidating multiple U.S. privacy statements into a single, plain-language document and expanding its program that lets customers access and delete personal information.
“The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns,” the company said in an emailed statement. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”
Key Takeaways
- GM’s data-sharing practices with credit agencies are now flatly prohibited
- Drivers gain opt-in control rather than buried opt-out clauses
- The case sets a precedent for connected-car privacy enforcement nationwide
