FTC finalizes 20-year GM, OnStar data collection order

The Federal Trade Commission (FTC) has finalized a 20-year order with General Motors and OnStar to settle allegations that they collected, used, and sold geolocation data and driving behavior data from millions of vehicles without consumer consent and notification.

Under the order, General Motors LLC, General Motors Holdings LLC, and OnStar, LLC, collectively GM, are prohibited from sharing certain consumer data with consumer reporting agencies and required to take steps to provide greater transparency and choice to consumers over the collection, use, and disclosure of their connected vehicle data.

The FTC filed a complaint last year alleging that GM used a misleading enrollment process to get consumers to sign up for its OnStar connected vehicle service and the OnStar Smart Driver feature, then failed to clearly disclose that it collected geolocation and driving behavior data and sold it to third parties without consumers’ consent.

The final order bans GM from disclosing consumers’ geolocation and driver behavior data to consumer reporting agencies for five years.

“This fencing-in relief is appropriate given GM’s egregious betrayal of consumers’ trust,” states an FTC press release.

The FTC voted 2-0 to approve the final order and complaint as well as provide responses to commenters.

For the life of the order, GM will be required to:

• • Obtain affirmative express consent from consumers before collecting, using, or sharing connected vehicle data (including sharing data with consumer reporting agencies), with some exceptions, such as for providing location data to emergency first responders;
  • Create a way for all U.S. consumers to request a copy of their data and seek its deletion;
  • Give consumers the ability to disable the collection of precise geolocation data from their vehicles if their vehicle has the necessary technology; and
  • Provide a way for consumers to opt out of the collection of geolocation and driver behavior data, with some limited exceptions.

When the FTC complaint was announced, former Chair Lina M. Khan said GM monitored and sold consumers’ geolocation and driver behavior data, sometimes as often as every 3 seconds.

“With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance,” she said.

According to a GM news release, the company ended its Smart Driver program in 2024 due to customer feedback. Customers were unenrolled, and GM ended its relationships with LexisNexis and Verisk, the release says.

The company also said at the time that it consolidated its many U.S. privacy statements into a single, simpler statement to raise the bar on privacy.

Lawsuits have been filed by attorneys general in Arkansas, Nebraska, and Texas against GM, as well as by a Florida consumer over the same alleged activity.

Images

Featured image credit: XH4D/iStock