The U.S. Federal Trade Commission (FTC) has finalized an order banning General Motors and its subsidiary OnStar from selling drivers’ geolocation and driving behavior data for five years, following findings that the company collected and shared sensitive information without user consent.
According to the FTC, GM collected precise geolocation data and detailed driving behavior information from millions of vehicles via OnStar. Data was gathered every few seconds through the Smart Driver feature, which was marketed as a driving self-assessment tool rather than a data collection mechanism.
The collected information was sold to third parties, including consumer reporting agencies, which then shared it with insurance companies. This practice reportedly resulted in higher insurance premiums or denial of coverage for drivers, often without their knowledge or approval.
Under the finalized order, GM is prohibited from sharing geolocation and driver behavior data with consumer reporting agencies for five years. Additionally, for a period of 20 years, the company must obtain explicit consumer consent before collecting, using, or sharing connected vehicle data, except for emergency-related services.
The order also requires GM to allow U.S. consumers to access copies of their data, request deletion, disable precise geolocation tracking, and opt out of driving behavior data collection.
The FTC described GM’s actions as an “egregious betrayal of consumer trust.” In response, GM stated that it has expanded its privacy program nationwide and increased transparency and user control over personal data.
The case follows broader legal scrutiny in the U.S. automotive and insurance sectors. In early 2025, Texas Attorney General Ken Paxton filed a lawsuit against Allstate over the alleged unlawful collection and sale of driving data via mobile apps and embedded SDKs.
The FTC’s ruling against General Motors sends a strong message to the automotive industry: connected vehicles are no longer exempt from strict data protection standards. The decision marks a shift toward greater accountability and reinforces consumer rights over vehicle-generated data.
