The Federal Trade Commission (FTC) announced a settlement with General Motors (GM) on Thursday, banning the automaker from selling drivers’ geolocation and behavior data to consumer reporting agencies for five years.
The investigation revealed that GM had been sharing sensitive driving information with data brokers without adequately notifying or obtaining consent from consumers, leading to privacy violations.
The FTC’s investigation, spurred by a report from The New York Times, found that GM’s OnStar Smart Driver program collected detailed data on driving habits, such as speeding, hard braking, and nighttime driving. This data was sold to brokers like LexisNexis and Verisk, which compiled risk profiles for insurance companies. Some drivers reported higher insurance rates as a direct result of these profiles.
FTC Chair Lina M. Khan criticized GM’s practices, stating:
“With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”
Drivers often unknowingly enrolled in the Smart Driver program, as the FTC deemed the signup process confusing. The collected data was shared without explicit consent, contravening consumer protection laws.
In response to public criticism and regulatory pressure, GM ended the Smart Driver program in April 2024. The company also ceased partnerships with LexisNexis and Verisk, the data brokers involved in the controversy. GM has since consolidated its privacy policies and created tools for customers to access, delete, or limit the use of their driving data.
As part of the settlement, GM agreed to:
- Obtain affirmative consent before collecting connected vehicle data.
- Enable drivers to disable location tracking and opt out of data collection, with exceptions for emergencies.
- Ensure customers can view and delete their collected data via GM’s website.
The settlement also includes a broader 20-year agreement requiring GM to adhere to these privacy safeguards and practices.
This case highlights growing concerns over consumer data privacy in an era of connected vehicles. Automobiles equipped with advanced technology are increasingly viewed as data-collection tools, raising both privacy and national security concerns.
Advocates for stronger privacy regulations applauded the FTC’s actions.
“Secretly collecting and sharing driver location data is a terrible practice that can cause real harm to unsuspecting consumers,” said Justin Brookman, Director of Technology Policy at Consumer Reports.
The settlement has also reignited calls for comprehensive federal privacy legislation to prevent similar abuses in the future.
While the five-year ban restricts GM from sharing individual driver data with consumer reporting agencies, the company can still share anonymous data with third parties, such as researchers.
The New York Times, the Register, and Reuters contributed to this report.
