FTC settlement bans General Motors from sharing driver location data and behavior for five years

What just happened? General Motors and the FTC have reached a settlement over allegations that the automaker shared details about driver locations and behavior to third parties without consent. GM is now banned from carrying out these actions for five years.

In March 2024, a New York Times report uncovered how connected cars with built-in telematics share driver statistics and data with insurers, often without the owners even realizing it.

One of these companies was GM, which collected location and driving data through its OnStar connected vehicle service – a GM subsidiary that provides subscription-based communications, security, emergency services, navigation, and remote diagnostics – as well as its OnStar Smart Drive feature. According to the FTC, GM did not clearly disclose these practices, and the data was subsequently sold to third parties, such as consumer reporting agencies.

A few users said GM vehicles tracked them even when they didn’t activate the OnStar Smart Driver feature, which claimed to help users become better drivers by gamifying the experience. They may have been enrolled by the dealership, but even for those who opted in, the enrollment process didn’t make it clear that third parties would receive the driving data.

GM confirmed to the NYT that it shared “select insights” about hard braking, hard accelerating, speeding over 80 mph, and drive time of Smart Driver enrollees with global data brokers LexisNexis and Verisk.

It’s claimed the information was offered to insurance companies, which used it to increase the rates of customers they deemed to be bad drivers based on the data.

In the wake of the report, senators urged the FTC to investigate carmakers selling consumer data. The agency filed a formal legal complaint against GM

GM said that it discontinued the Smart Driver program across all its vehicles last April, unenrolled all customers, and ended its third-party telematics relationships with LexisNexis and Verisk.

“Respecting our customers’ privacy and earning their trust is deeply important to us,” GM said in a statement. “Although Smart Driver was created to promote safer driving behavior, we ended that program due to customer feedback.”

In addition to GM being banned from sharing geolocation and driver behavior data to consumer reporting agencies for five years, the settlement has other conditions. The 20-year agreement states that GM and OnStar must attain affirmative express consent from consumers prior to collecting connected vehicle data, allow consumers to obtain and delete their data, and allow consumers to limit data collection from their vehicles, including geolocation data.

“GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,” said Lina M. Khan, the chair of the FTC. “With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”

The proposed settlement is open to public comment for 30 days, after which the FTC will make its final decision.