On the Dash:
- The FTC banned GM and OnStar from sharing geolocation and driving behavior data with consumer reporting agencies for five years.
- The automaker must obtain affirmative consent and give drivers greater control over how their vehicle data is collected and used for the next 20 years.
- The case underscores growing regulatory scrutiny of data practices tied to connected and software-driven vehicles.
The Federal Trade Commission finalized a sweeping order against General Motors and its OnStar telematics unit, imposing new limits on how the automaker collects, uses and shares consumer vehicle data. The action resolves allegations that the automaker gathered and sold sensitive driver information without properly informing consumers or securing their affirmative consent.
Under the order, GM and its subscription-based OnStar service are prohibited for five years from disclosing consumers’ geolocation and driving behavior data to consumer reporting agencies. The FTC said the restriction is intended to prevent misuse of connected vehicle data that could affect consumers’ financial and insurance outcomes.
The enforcement action stems from allegations first announced in January 2025. Regulators said GM collected precise location data and detailed driving behavior from millions of vehicles, often without transparent disclosure. The FTC also alleged that the carmaker relied on a misleading enrollment process to sign drivers up for OnStar services and the now-discontinued OnStar Smart Driver program.
In addition to the five-year data-sharing ban, the final order imposes long-term compliance requirements that will remain in effect for 20 years. GM must obtain affirmative express consent before collecting, using or sharing covered consumer data. The company is also required to give consumers access to their data, including the ability to request copies and seek deletion.
The order further requires the company to provide drivers with meaningful control over data collection. Consumers must be able to disable the collection of precise geolocation data if their vehicle supports that capability. GM must also offer a clear option for customers to opt out of the collection of geolocation and driving behavior data, subject to limited exceptions.
The FTC said the case reflects heightened scrutiny of data practices tied to increasingly connected vehicles. Regulators pointed to the frequency of GM’s data collection, noting that driving and location information was sometimes gathered as often as every few seconds. The agency characterized the conduct as a serious breach of consumer trust.
In a statement, a GM spokesperson said, “The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns. As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.” The final order does not include a monetary penalty, instead imposing long-term restrictions on how GM collects, uses, and shares vehicle data.
The company discontinued its OnStar Smart Driver service in April 2024 after public reporting revealed that driver data was being sold to third parties, including data brokers that supplied information to insurers. GM said at the time that it ended the program based on customer feedback and unenrolled all participants.
The case is expected to serve as a benchmark for how regulators approach privacy enforcement in the auto industry as software-driven vehicles generate growing volumes of consumer data.
Correction: An earlier version of this article did not reflect that the settlement includes no monetary penalty. The seventh paragraph has been updated to add that detail.
