The Article Tells The Story of:
- FTC targets General Motor and OnStar for selling driver behavior and location data.
- Sensitive data shared without proper consent, violating customer privacy.
- Ban lasts five years, impacting GM’s data-sharing practices with insurers.
- New transparency measures promise greater control for users.
Table of Contents
FTC Prohibits GM From Sharing Driver Data for Five Years
The Federal Trade Commission (FTC) has imposed a five-year ban on General Motors (GM) and its subsidiary OnStar from sharing consumer data with third parties. The decision follows a report by The New York Times revealing that GM sold sensitive driver information to platforms used by insurance companies.
This is not simply a dispute over the fine print in a connected-car service. Modern vehicles can produce a detailed record of how, when, and where people drive. That data can be useful to a manufacturer when it is being used to operate a vehicle service or respond to a driver’s request. The privacy stakes change sharply when the same information is passed into systems used by insurers, where it can shape how a person is assessed without that person fully understanding the path their data took.
The FTC’s action puts that distinction at the center of the case. The issue is not merely that GM collected driving information. It is that consumers were said to lack clear, meaningful consent for collection and sharing that could have consequences beyond the vehicle itself. When a company asks customers to join a connected service, the burden is on the company to make the terms understandable rather than treating participation as a blank check for downstream data use.
Related reading: FTC Report Exposes Alarming Social Media Surveillance — How Big Tech is Monetizing Your Data!. Published on September 20, 2024 SquaredTech
How the OnStar Smart Driver Program Became a Privacy Flashpoint
The investigation uncovered that GM’s OnStar Smart Driver program collected data without explicit user consent. The program monitored driving habits including hard braking, speeding, and night driving. GM allegedly shared this data with LexisNexis Risk Solutions and Verisk, which then sold it to insurance companies.
Those categories of behavior may sound ordinary in isolation. A hard-braking event can be a reaction to traffic. Night driving can reflect a work schedule, family obligation, or a long trip. Speeding data may lack the context needed to explain what happened on a particular road. But once such information is packaged as a driver profile and moved into insurance-related systems, the individual events can become part of a much larger judgment about a customer.
That is why consent cannot be an afterthought. A driver may reasonably expect a vehicle service to collect enough information to provide the service they selected. They may make a different choice if they understand that their location and behavior information could be shared with consumer reporting agencies or used by platforms connected to insurance companies. The meaningful choice is not simply whether a box was checked. It depends on whether a customer could understand what they were agreeing to, who would receive the information, and what practical effect that disclosure could have.
Customers Said They Did Not Fully Understand the Choice
The controversy began when customers realized their driving data was being monitored without their full understanding. Many participants in the OnStar Smart Driver program were unaware they had opted into it. This raised questions about transparency and consent in GM’s data collection practices.
That detail cuts to a persistent problem in consumer technology. Enrollment flows are often designed around getting people through a setup process quickly. The privacy consequences of enabling a feature may be buried among account prompts, service terms, and routine vehicle screens. A customer who does not recognize that they have enrolled cannot realistically be expected to manage the data choices that follow.
FTC Chair Lina M. Khan stated that GM monitored drivers’ precise locations and behaviors, sometimes as often as every three seconds. She emphasized that this settlement protects consumer privacy and guards against unchecked surveillance.
Precise location data deserves particular scrutiny because it can reveal patterns that are difficult to separate from private life. A driving record is not just a technical feed from a car. Over time, it can reflect routines, destinations, and behavior. The frequency described by Khan makes the concern more immediate: data gathered as often as every three seconds can create a highly granular picture rather than a broad summary of vehicle use.
The automotive industry has spent years turning vehicles into connected devices, and that shift has made privacy a core product question rather than a legal footnote. Drivers should not have to become data-policy experts to know whether a feature designed around their car may also send information into an insurance-related ecosystem. The FTC’s intervention signals that regulators are unlikely to accept ambiguity as an adequate substitute for consent when sensitive information is involved.
What the Settlement Requires
Under the settlement, General Motor and OnStar are prohibited from disclosing driver geolocation and behavior data to consumer reporting agencies for the next five years. They are also required to improve transparency in their data collection policies.
The requirements include seeking affirmative customer consent and offering users access to their personal data with the option to delete it. Those measures matter because they address the practical imbalance that often exists between a company holding a large set of information and the customer whose life generated it. Access gives users a chance to see what exists. Deletion gives them a way to limit what remains. Affirmative consent sets a higher bar than relying on customer confusion, passive acceptance, or an unclear enrollment process.
The five-year ban is also a direct constraint on a particular form of data sharing. It does not treat connected-vehicle data as inherently improper. Instead, it draws a line around the disclosure of driver geolocation and behavior data to consumer reporting agencies. That focus reflects the heightened sensitivity of information once it enters systems that can be used to evaluate consumers.
GM responded by confirming the termination of the Smart Driver program in 2022 due to customer feedback. The company stated that it had ended its agreements with third-party platforms and pledged to enhance user control over connected vehicle data.
Ending the program and agreements with third-party platforms addresses part of the immediate concern, but the broader test will be whether user control is clear in practice. “Control” can become a vague promise if choices are hard to find or explanations are hard to parse. For GM and OnStar, the settlement places the emphasis where it belongs: drivers should know what information is collected, what happens to it, and how to say no.
A Warning for the Connected-Car Business
This case highlights the growing concerns surrounding data privacy in the automotive industry. It also offers a warning to companies that may view vehicle data as just another commercial asset. Information about a person’s movements and driving behavior carries a different weight from ordinary product analytics, particularly when it is connected to insurance-related decisions.
The FTC’s actions reinforce the importance of clear communication and consent when collecting and sharing customer information. For GM, this serves as a lesson in prioritizing user trust and transparency. For the rest of the industry, the message is equally plain: connected features should not require consumers to surrender visibility into how their personal data is used.
Stay Updated: Tech News
