FTC Finalizes Order Restricting GM’s Data Sharing Practices
The Federal Trade Commission (FTC) has finalized an order prohibiting General Motors (GM) and its OnStar telematics service from sharing specific consumer data with consumer reporting agencies. This decision, announced on January 14, 2026, follows a proposed settlement reached a year prior and mandates that GM enhance transparency with consumers and secure explicit consent for any data collection activities.
Background and Allegations
The FTC’s action stems from a 2024 investigation revealing that GM and OnStar collected and sold drivers’ precise geolocation data and driving behaviors to third parties, including data brokers like LexisNexis and Verisk. This data, gathered through GM’s Smart Driver program—a complimentary feature within its connected car apps—monitored driving habits and seatbelt usage. Subsequently, data brokers sold this information to insurance providers, potentially influencing customers’ insurance rates.
In April 2024, GM discontinued the Smart Driver program across all its brands, citing customer feedback. The company unenrolled all participants and terminated its third-party telematics relationships with LexisNexis and Verisk.
The FTC alleged that GM and OnStar employed a misleading enrollment process to encourage consumers to sign up for OnStar services and the Smart Driver feature. The agency also claimed that GM failed to clearly disclose that collected data would be sold to third parties.
Key Provisions of the Finalized Order
Under the finalized order, GM is required to:
1. Obtain Explicit Consumer Consent: Before collecting, using, or sharing connected vehicle data, GM must secure clear consent from consumers. This process occurs at the dealership when a consumer purchases a GM vehicle. At that point, the OnStar system is linked to the vehicle’s VIN, and the new owner is asked to agree or disagree with data collection.
2. Establish Consumer Data Access and Deletion Mechanisms: GM must provide a method for all U.S. consumers to request copies of their data and seek its deletion. Additionally, consumers should have the ability to disable the collection of precise geolocation data from their vehicles. GM reports that it has already complied with these mandates.
3. Limit Data Sharing Exceptions: While the order restricts data sharing, GM is permitted to share location data with emergency first responders and for internal research purposes. The company collects data for research and development and sometimes shares de-identified, anonymized data with select partners to enhance city infrastructure and improve road safety. For example, data has been shared with the University of Michigan for urban planning initiatives.
GM’s Response and Policy Overhaul
In response to the FTC’s order, GM has overhauled its data collection and privacy policies. The company consolidated its U.S. privacy statements into a single, simplified document and expanded its privacy program, allowing customers to access and delete their personal information.
A GM spokesperson stated, The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns. As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.
Broader Implications and Industry Context
The FTC’s action against GM is part of a broader effort to regulate data-sharing practices in the automotive and technology industries. In recent years, the agency has taken similar actions against other companies for deceptive data practices.
For instance, in January 2024, the FTC banned data broker X-Mode Social from sharing or selling users’ sensitive location data and ordered the company to delete previously collected data. Similarly, in January 2024, the FTC prohibited data aggregation company InMarket from selling consumers’ precise location data, citing failures to obtain user consent and misleading data collection practices.
These actions underscore the FTC’s commitment to enforcing consumer privacy protections and ensuring that companies are transparent about their data collection and sharing practices.
Conclusion
The finalization of the FTC’s order against GM marks a significant step in regulating data-sharing practices within the automotive industry. By requiring explicit consumer consent and enhancing transparency, the order aims to protect consumer privacy and set a precedent for how companies handle sensitive data. As vehicle connectivity continues to evolve, such regulatory measures will be crucial in maintaining consumer trust and safeguarding personal information.
