FTC finalises five-year GM data-sharing ban

The Federal Trade Commission (FTC) has finalised a settlement effectively banning General Motors from sharing consumer data including geolocation and driver behaviour to reporting agencies for five years. The order, made on 14 January, concludes an enforcement action against the automaker over allegations that it collected and sold information from millions of vehicles without adequately notifying customers or obtaining clear and affirmative consent.

The technology at the core of the development is GM’s OnStar Smart Driver programme, which tracked driving habits including location data sometimes as frequently as every three seconds. The free feature would embed itself within connected car applications, monitoring and rating behaviours such as acceleration patterns and seatbelt usage. The data would subsequently be sold to data brokers LexisNexis and Verisk. 

These brokers in turn provided the data to insurance companies, potentially affecting customers’ premium rates without their knowledge. In this sense the selling of the data was not an abstract concern for consumers, but something that could materially impact their day-to-day lives.

The Commission approved the final order by a 2-0 vote, imposing a 20-year compliance period requiring GM to obtain explicit consent before collecting or sharing connected vehicle data, with limited exceptions for emergency first responders and internal research. The automaker must establish mechanisms allowing US consumers to request copies of their data, seek deletion, and disable precise geolocation collection where technology permits.

GM discontinued the Smart Driver service and terminated its relationships with LexisNexis and Virsk back in April 2024 following an investigation by the New York Times that exposed the data-sharing practises. and terminated relationships with LexisNexis and Verisk following a New York Times investigation exposing the data-sharing practices. Chief Executive Mary Barra addressed the matter to Detroit Free Press in May 2024, stating: “We take our customers’ data security and privacy very, very seriously […] We’re going to work hard to be very transparent and be very privacy-focused with our consumers, and [we] learned a lot of lessons in this, and we’ll get better.”

The allegations centred on what regulators characterised as a misleading enrollment process for OnStar services that failed to clearly disclose data collection and third-party sales. Lina Khan, who served as chair of the FTC during the Biden administration, stated in January 2025 that “GM monitored and sold people’s precise geolocation data and driver behavior information” while describing the regulatory action as “safeguarding Americans’ privacy and protecting people from unchecked surveillance”. 

To improve customer transparency, GM confirmed it has consolidated multiple US privacy statements into a single document and expanded programmes allowing customers to access and delete their personal information. The automaker confirmed it collects anonymised data for internal research and development—in-keeping with the FTC’s ruling—while occasionally sharing de-identified information with partners including the University of Michigan for urban planning purposes.  It also acknowledged that consumer privacy is of growing importance as vehicle connectivity becomes “increasingly integral to the driving experience”.