The Federal Trade Commission (FTC) has reached a proposed settlement with General Motors (GM), prohibiting the automaker from sharing customer geolocation and driving behavior data with consumer reporting agencies for five years. This marks the FTC’s first action addressing connected vehicle data.
The FTC alleged that GM, through its OnStar technology and the now-discontinued Smart Driver program, collected and sold precise location and driver behavior data from millions of vehicles without adequately informing or obtaining consumer consent.
Under the proposed settlement, which GM says will remain effective for 20 years, the automaker must:
- Obtain affirmative consumer consent before collecting connected vehicle data, except in cases such as first responder needs.
- Allow consumers to disable precise geolocation tracking.
- Provide options to opt out of geolocation and driver behavior data collection.
- Enable consumers to access and delete their collected data.
GM customers can now submit privacy requests online or call 866-MYPRIVACY (866-697-7482) to access or delete their data.
In response, GM emphasized its commitment to privacy, noting the Smart Driver program was discontinued last year due to customer feedback. The automaker also ended its third-party data-sharing relationships with LexisNexis and Verisk and streamlined its U.S. privacy policies.
Therefore, the automaker noted that the agency’s consent order introduces new measures that go beyond existing regulations and reflects the steps they have already implemented to offer customers options for data collection and transparency about using their information.
Smart Driver, advertised as a tool to enhance driving habits, collected detailed data on behaviors such as hard braking, speeding, and late-night driving patterns. The FTC alleged that GM’s enrollment process for the program was confusing and misleading, and some consumers were unaware they had enrolled. Then, the collected data was sold to consumer reporting agencies, which could impact insurance rates or coverage decisions.
Nevertheless, the Federal Register will publish a description of the consent agreement, which will initiate a 30-day public comment period before the FTC finalizes the settlement.
