FTC Settles with GM Over Sale of Driver Location Data

General Motors and its OnStar service have settled with the US Federal Trade Commission over claims they collected and sold drivers' exact location and driving data without proper notice or consent. The deal, finalized this week, puts a five-year ban on sharing that data with groups like data brokers and insurers. It also sets rules for the next 20 years on how GM handles data from connected cars.

Background

The trouble started a couple of years back when reports showed GM tracking where drivers went and how they drove. Through the OnStar Smart Driver program, cars gathered details on trips, speed, braking, and seatbelt use. This came from millions of vehicles with connected features. GM shared the data with companies like LexisNexis and Verisk, who passed it to insurance firms. Those firms used it to set rates for customers, sometimes raising them based on driving habits.

A New York Times story in early 2024 brought this to light. It explained how the Smart Driver feature, part of free apps in GM cars, pulled in this information without drivers knowing the full picture. Many signed up thinking it was just for safety scores or perks. GM ended the program in April 2024 after complaints. They unenrolled everyone and cut ties with those data brokers.

The FTC stepped in with a complaint in January 2025. They said GM's sign-up process tricked people into joining OnStar services. Fine print hid that data would go to outsiders. Drivers did not get a clear yes-or-no choice. The agency saw this as a breach of trust, especially since location data reveals home addresses, work spots, and daily routines.

GM owns brands like Chevrolet, Buick, GMC, and Cadillac. OnStar links to vehicles via VIN numbers at purchase. New owners face prompts at dealerships about data use. But past practices lacked that clarity. The FTC pushed for changes to protect privacy in an era where cars send constant data streams.

Key Details

The finalized order covers General Motors LLC, General Motors Holdings LLC, OnStar LLC, and their parent company. It bans sharing geolocation and driving behavior data with consumer reporting agencies for five years. These agencies include data brokers that profile people for insurers and others.

For 20 years, GM must get clear, upfront consent before collecting, using, or sharing connected car data. This happens when buying a car or activating services. Exceptions allow sharing location with emergency responders, like in crashes. GM can use data for its own research and share anonymized versions with partners for things like road safety or city planning. For example, they worked with the University of Michigan on urban projects.

Consumer Rights and Tools

GM now offers US drivers ways to see their data, delete it, and turn off precise location tracking if the car allows. Opt-out options cover geolocation and behavior data, with few limits. These tools were already in place by the time of the settlement. GM simplified its privacy notices into one clear statement. They expanded a program letting customers manage personal info.

The FTC voted 2-0 to approve the order and address public comments. No fines were part of the deal. GM started fixing its data practices in 2024, before the final ruling.

“The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns,” a GM statement said. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”

What This Means

Car buyers from GM now face straightforward choices on data at purchase. Dealerships explain options tied to the vehicle's ID. This aims to avoid surprises down the road. Drivers can pull back data collection mid-ownership, cutting what GM knows about their habits.

The five-year sales ban hits data brokers and insurers hardest. They lose a source of detailed driving profiles, which could even out insurance pricing. Over 20 years, the consent rule forces GM to check with owners often. Changes in cars or apps trigger fresh asks.

This sets a model for other car makers. Vehicles grow smarter, with cameras, sensors, and constant internet links. Data on location, speed, and more flows out. The FTC order signals tighter watch on auto data sales. Companies may need similar consents to stay clear of probes.

GM says it gathers data for improvements like better navigation or safety features. Anonymized shares help public goals, such as fixing traffic or potholes. But personal details stay locked unless approved. Customers gain power to wipe histories, easing worries over long-term tracking.

Insurers adapt without GM data. They turn to other sources or focus on basics like mileage. Drivers benefit from less hidden profiling. The shift started with one program but now covers all connected data.

Broader effects touch privacy laws. States push their own rules on location tracking. The FTC action bolsters federal pressure without new statutes. It shows enforcement through settlements, not just fines. GM's size—leader in US sales—makes this a benchmark. Smaller firms watch closely.

Connected cars number in hundreds of millions worldwide. US rules here influence global norms. GM operates in North America, international markets, and finance. Privacy now weaves into all segments. The order runs two decades, matching vehicle lifespans.