FTC bans GM from selling driver data amid privacy violations

The order addresses allegations that GM sold sensitive driver information without adequately informing consumers or obtaining consent.

On the Dash:

• The FTC banned GM and OnStar from sharing geolocation and driving behavior data with consumer reporting agencies for five years.
• The automaker must obtain affirmative consent and give drivers greater control over how their vehicle data is collected and used for the next 20 years.
• The case underscores growing regulatory scrutiny of data practices tied to connected and software-driven vehicles.

The Federal Trade Commission finalized a sweeping order against General Motors and its OnStar telematics unit, imposing new limits on how the automaker collects, uses and shares consumer vehicle data. The action resolves allegations that the automaker gathered and sold sensitive driver information without properly informing consumers or securing their affirmative consent.

Under the order, GM and its subscription-based OnStar service are prohibited for five years from disclosing consumers’ geolocation and driving behavior data to consumer reporting agencies. The FTC said the restriction is intended to prevent misuse of connected vehicle data that could affect consumers’ financial and insurance outcomes.

Sign up for CBT News’ daily newsletter and get the latest industry stories delivered straight to your inbox.

The enforcement action stems from allegations first announced in January 2025. Regulators said GM collected precise location data and detailed driving behavior from millions of vehicles, often without transparent disclosure. The FTC also alleged that the carmaker relied on a misleading enrollment process to sign drivers up for OnStar services and the now-discontinued OnStar Smart Driver program.

In addition to the five-year data-sharing ban, the final order imposes long-term compliance requirements that will remain in effect for 20 years. GM must obtain affirmative express consent before collecting, using or sharing covered consumer data. The company is also required to give consumers access to their data, including the ability to request copies and seek deletion.

The order further requires the company to provide drivers with meaningful control over data collection. Consumers must be able to disable the collection of precise geolocation data if their vehicle supports that capability. GM must also offer a clear option for customers to opt out of the collection of geolocation and driving behavior data, subject to limited exceptions.

The FTC said the case reflects heightened scrutiny of data practices tied to increasingly connected vehicles. Regulators pointed to the frequency of GM’s data collection, noting that driving and location information was sometimes gathered as often as every few seconds. The agency characterized the conduct as a serious breach of consumer trust.

GM said the finalized order formalizes an agreement reached with regulators last year and said it remains committed to protecting customer privacy and improving transparency as vehicle connectivity becomes a core part of the driving experience.

The company discontinued its OnStar Smart Driver service in April 2024 after public reporting revealed that driver data was being sold to third parties, including data brokers that supplied information to insurers. GM said at the time that it ended the program based on customer feedback and unenrolled all participants.

The case is expected to serve as a benchmark for how regulators approach privacy enforcement in the auto industry as software-driven vehicles generate growing volumes of consumer data.