FTC finalizes data-sharing order against General Motors

The Federal Trade Commission (the U.S. consumer protection regulator) has finalized an order banning General Motors and its OnStar telematics service from sharing certain consumer data with consumer reporting agencies. Under the finalized order, the automaker is required to obtain explicit consent from consumers prior to collecting, using, or sharing certain connected vehicle data. This consent process is designed to occur at the dealership when a consumer purchases a vehicle, at which point the OnStar system is linked to the vehicle’s identification number (VIN) and the owner is asked to agree or disagree with the data collection.

The regulatory action comes nearly two years after reports surfaced regarding the automaker’s data practices. The FTC alleged that GM and OnStar “used a misleading enrollment process to get consumers to sign up for its OnStar connected vehicle service and OnStar Smart Driver feature.” The regulator also alleged that the automaker “failed to clearly disclose that the data would be collected and sold to third parties,” which included data brokers LexisNexis and Verisk.

While the order mandates that GM establish a way for all U.S. consumers to request a copy of their data and seek its deletion, it does contain specific exceptions. The automaker is allowed to share location data with emergency first responders and for internal research. This includes sharing de-identified data with select partners, such as the University of Michigan, which has used the data for urban planning. Additionally, GM must provide consumers with the ability to disable the collection of precise geolocation data from their vehicles.

GM, which discontinued its Smart Driver program in April 2024, began overhauling its data collection and privacy policies in 2024. As part of these changes, the automaker consolidated many of its U.S. privacy statements into a single statement and expanded its privacy program. “The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns,” the automaker said in an emailed statement. “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”

Why it matters

This settlement sets a significant precedent for how automakers must handle connected vehicle data, shifting the burden of transparency onto manufacturers as vehicle connectivity becomes an integral part of the driving experience.