The U.S. Federal Trade Commission (FTC) has announced a settlement with General Motors (GM) and its subsidiary, OnStar, requiring the automaker to cease sharing customers’ geolocation data with third parties, including data brokers, for five years.
Under the agreement, GM must also stop misleading consumers about the collection, use, and transfer of their data, and is obligated to obtain explicit consent before gathering any information.
The FTC has mandated that GM provide consumers with clear and transparent choices regarding data usage. The investigation revealed that flawed consent mechanisms often coerced customers into agreeing to data sharing without fully understanding the consequences. GM reportedly transmitted detailed information on driver locations and behaviors, which was used to determine insurance premiums.
The complaint alleges that GM collected geolocation data with pinpoint accuracy—down to 11.5 centimeters every three seconds—and shared route information for nine million individuals. This data included timestamps, speed, direction of travel, and trip identifiers, enabling the tracking of specific vehicle routes.
Since 2016, GM has sold data to brokers, including Verisk Analytics and LexisNexis Risk Solutions, which used the information to compile consumer reports. These reports featured details on sudden braking, speeding, seatbelt usage, and other driving behaviors.
Some customers only became aware of the data collection after canceling their insurance policies or experiencing unexpected premium increases. The FTC criticized GM’s privacy policies for lacking transparency, noting that updates made in 2024 following a series of media reports still failed to disclose the full extent of data usage.
The FTC also highlighted that opting out of data sharing with GM led to the deactivation of critical services, such as automatic emergency response systems. This forced many consumers to agree to the terms of the OnStar Smart Driver program, even if they were unwilling participants.
As part of the proposed settlement, GM must provide customers with the ability to delete their data, access copies of the information collected, and restrict geolocation tracking. The company is required to develop mechanisms allowing customers to disable precise location tracking and opt out of behavior monitoring. Experts suggest this resolution will serve as a wake-up call for the automotive industry to adhere strictly to privacy standards.
In May, the FTC warned automakers that it was closely monitoring the collection and sale of consumer data. The commission emphasized potential enforcement actions against manufacturers that share sensitive information with advertisers, particularly focusing on the sale of geolocation data and the covert disclosure of private information.
Additionally, Texas Attorney General Ken Paxton filed a lawsuit against GM in August 2024, accusing the company of violating state privacy laws. According to Paxton, GM deliberately misrepresented its data collection practices, persuading drivers to subscribe to services that covertly gathered and sold their personal data to third parties. The lawsuit was filed weeks after Paxton announced an investigation into several automakers, including GM, regarding their handling of vast amounts of data collected from connected vehicles.
