The FTC’s data sharing order against GM has finally been settled

The Federal Trade Commission said Wednesday it has finalized an order barring General Motors and OnStar telematics service from sharing certain consumer data with consumer reporting agencies. The order is completed, which comes the year after the agency reaches a proposed settlement with GM, it also requires automakers to be more transparent with consumers and obtain clear consent regarding data collection.

At the order is complete came almost two years after a The New York Times reports shows how GM and OnStar collect, use and sell driver geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data is collected through GM’s Smart Driver program, a free feature included in the connected car app that tracks and rates driving behavior and seat belt usage. Data brokers sell that information to insurance providers, which can affect customers’ rates, the NYT reported at the time.

GM quit Smart Driver program in April 2024 on all brands, according to customer feedback. GM said at the time it unenrolled all customers and terminated third-party telematics relationships with LexisNexis and Verisk.

The FTC alleges that GM and OnStar used a misleading enrollment process to get consumers to sign up for OnStar’s connected vehicle service and OnStar’s Smart Driver feature. The FTC also said the automaker failed to clearly disclose that the data would be collected and sold to third parties.

Under the order finalized Wednesday, GM must also obtain express consent from consumers before collecting, using, or sharing connected vehicle data. This process takes place at the dealership when a consumer buys a car from the GM brand. At that point, the OnStar system is linked to a specific vehicle’s VIN number and the new owner is asked whether or not they consent to data collection, according to GM.

However, there are some exceptions to the data collection ban. GM is allowed to share location data with emergency first responders and for internal research, the FTC said. GM confirmed this, noting that it collects data for internal research and development and sometimes shares de-identified, or anonymous data (not related to drivers or specific vehicles) with selected partners to improve urban infrastructure and improve road safety. For example, data has been shared with the University of Michigan, which is used for urban planning.

GM must also create a way for all US consumers to request a copy of their data and seek deletion and provide the ability to disable the collection of precise geolocation data from their vehicles. GM said it had complied with the order.

GM said it will begin reviewing policies and programs on data collection and privacy in 2024. For example, the automaker said it has consolidated many US privacy statements into one, simple statement and expanded a GM privacy program that allows customers to access and delete personal information.

“The Federal Trade Commission has formally approved an agreement reached last year with General Motors to resolve the issue,” an emailed statement from GM read. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”