GM Data Sharing: FTC Order Settled – What You Need to Know

The Federal Trade Commission (FTC) has finalized an order against General Motors (GM) and its OnStar telematics service, effectively banning the sharing of certain consumer data with consumer reporting agencies. This landmark decision, reached a year after a proposed settlement, underscores a growing trend of regulatory scrutiny over data privacy in the connected car industry. The order mandates increased transparency from GM and requires explicit consumer consent for any data collection practices. This article delves into the details of the FTC order, its implications for GM customers, and the broader context of data privacy in the automotive sector.

The Genesis of the FTC Investigation: A New York Times Exposé

The FTC’s action stems from a 2022 investigative report by the New York Times, which revealed that GM and OnStar were collecting, utilizing, and selling drivers’ precise geolocation data and driving behavior to third parties. These third parties included data brokers like LexisNexis and Verisk. The data was primarily gathered through GM’s Smart Driver program, a seemingly innocuous free feature within its connected car apps. This program tracked and rated driving behaviors, including speed, braking, and seatbelt use.

The New York Times report highlighted a concerning practice: data brokers subsequently sold this information to insurance providers. This allowed insurers to potentially adjust customer premiums based on driving habits, often without the driver’s explicit knowledge or consent. The practice raised significant privacy concerns and fueled the FTC’s investigation.

Discontinuation of Smart Driver and Initial Response

In April 2024, GM announced the discontinuation of the Smart Driver program across all its brands, citing customer feedback. The automaker stated it had unenrolled all customers and terminated its data-sharing relationships with LexisNexis and Verisk. While this move was presented as a response to customer concerns, it occurred concurrently with the escalating FTC investigation, suggesting a proactive attempt to mitigate potential penalties.

FTC Allegations: Misleading Enrollment and Lack of Disclosure

The FTC alleged that GM and OnStar employed a misleading enrollment process to encourage consumers to sign up for the OnStar connected vehicle service and the Smart Driver feature. Crucially, the FTC argued that GM failed to adequately disclose that collected data would be shared with third parties. This lack of transparency violated consumer protection laws and eroded trust in the automaker.

Key Provisions of the FTC Order

The finalized FTC order imposes several key requirements on GM:

• Explicit Consent: GM must obtain explicit, affirmative consent from consumers *before* collecting, using, or sharing connected vehicle data. This consent process now occurs at the dealership level during vehicle purchase.
• Data Access and Deletion: GM is required to establish a mechanism for U.S. consumers to request a copy of their data, seek its deletion, and disable the collection of precise geolocation data. GM claims to have already implemented these features.
• Limited Data Sharing: While a complete ban on data sharing isn’t in place, the order restricts the sharing of data to specific circumstances.

Exceptions to the Data Sharing Ban

The FTC order acknowledges certain legitimate uses of data sharing. GM is permitted to share location data with emergency first responders in critical situations. Furthermore, the company can utilize data for internal research and development purposes. Importantly, GM is allowed to share de-identified, or anonymized, data – data not linked to specific drivers or vehicles – with select partners for initiatives like urban planning and road safety improvements. For example, GM has collaborated with the University of Michigan, providing anonymized data for urban planning projects.

GM’s Response and Commitment to Privacy

GM has publicly stated its commitment to complying with the FTC order. The company initiated a comprehensive overhaul of its data collection and privacy policies in 2024. This included consolidating numerous U.S. privacy statements into a single, more accessible document and expanding its GM privacy program, empowering customers to access and delete their personal information.

In an official statement, GM affirmed its dedication to protecting customer privacy, maintaining trust, and ensuring clear communication regarding its data practices. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices,” the statement read.

The Broader Implications for the Connected Car Industry

The GM-FTC settlement sets a significant precedent for the connected car industry. It signals a growing regulatory focus on data privacy and the need for automakers to prioritize transparency and consumer control. Here’s a breakdown of the key takeaways:

• Increased Scrutiny: Expect increased scrutiny from regulatory bodies like the FTC regarding data collection and sharing practices in the automotive sector.
• Shift Towards Consent-Based Data Collection: The industry is likely to move towards a more consent-based model for data collection, requiring explicit permission from consumers before gathering and utilizing their data.
• Demand for Transparency: Consumers are demanding greater transparency regarding how their data is collected, used, and shared. Automakers must respond by providing clear and concise privacy policies.
• Competitive Advantage: Companies that prioritize data privacy and build trust with consumers may gain a competitive advantage in the long run.

The Rise of Data Brokers and the Automotive Data Market

The GM case highlights the growing influence of data brokers in the automotive industry. These companies aggregate and sell data from various sources, including connected vehicles, to a wide range of clients, including insurance companies, marketing firms, and even law enforcement agencies. The automotive data market is estimated to be worth $20 billion by 2027 (Source: Statista), demonstrating the significant economic value of this information.

Future Trends in Automotive Data Privacy

Several emerging trends are shaping the future of automotive data privacy:

• Edge Computing: Processing data locally within the vehicle (edge computing) can reduce the need to transmit sensitive data to the cloud, enhancing privacy.
• Federated Learning: This technique allows machine learning models to be trained on decentralized data sources without directly accessing the raw data, preserving privacy.
• Blockchain Technology: Blockchain can be used to create secure and transparent data sharing systems, giving consumers greater control over their data.
• Privacy-Enhancing Technologies (PETs): A range of PETs, such as differential privacy and homomorphic encryption, are being developed to protect data privacy while still enabling data analysis.

What GM Customers Need to Do

GM customers should take the following steps to protect their data privacy:

• Review Privacy Settings: Familiarize yourself with the privacy settings in your GM vehicle and connected car apps.
• Disable Data Collection: If you are uncomfortable with data collection, disable the relevant features in your vehicle’s settings.
• Request Data Access: Utilize GM’s privacy program to request a copy of your data and verify its accuracy.
• Stay Informed: Stay informed about data privacy issues and regulatory developments in the automotive industry.

GearTech Disrupt 2026: A Focus on Innovation and Security

Events like the upcoming GearTech Disrupt 2026 (San Francisco, October 13-15, 2026) are crucial for discussing the latest advancements in automotive technology, including data security and privacy. These conferences bring together industry leaders, startups, and experts to explore innovative solutions and address emerging challenges. Join the waitlist now to be among the first to access Early Bird tickets and participate in this vital event.

The GM-FTC settlement is a wake-up call for the automotive industry. Prioritizing data privacy, transparency, and consumer control is no longer optional – it’s a necessity for building trust and ensuring the long-term success of connected vehicle technology.