FTC Consent Order Targets General Motors’ Connected-Vehicle Data Practices

Federal Trade Commission (FTC) regulators have finalized a sweeping consent order addressing how General Motors and its OnStar subsidiary handled connected-vehicle data. The finalized order bars GM for five years from sharing geolocation and driving behavior data with consumer reporting agencies.

The FTC concluded that location and driving information were collected and monetized without adequate consumer authorization, as Sergiu Gatlan writes for BleepingComputer.

The order reshapes GM’s data governance obligations and places significant limits on future sharing of sensitive telematics information. It reflects growing federal attention to data practices in the automotive sector as well as international regulatory developments on data.

GM integrates connectivity services into multiple major vehicle brands through its subsidiary OnStar, which provides navigation, emergency assistance, diagnostics, and related features.

The enforcement action centered on a discontinued feature called “Smart Driver” marketed as a driving self-assessment tool. It collected granular geolocation and driving behavior data at frequent intervals from millions of vehicles.

The FTC determined that consumers were not given meaningful notice or an opportunity to consent, and that the data was transferred to third parties, including consumer reporting agencies.

According to the commission, downstream use of the information affected insurance underwriting, including pricing and coverage decisions.

As part of the order, GM must obtain express consumer consent before collecting, using, or disclosing connected-vehicle data for a period of 20 years, subject to limited exceptions for emergency services.

The order also requires consumer access and deletion rights, opt-out mechanisms, and controls allowing drivers to disable precise location tracking. The settlement does not include a monetary penalty.

The matter demonstrates the regulatory risks associated with monetizing connected-device data without clear, affirmative consent. It also shows how vehicle telemetry can be treated as sensitive information with consumer reporting implications.

Counsel advising automotive, technology, and data-driven clients should closely review consent design, data-sharing arrangements, and retention practices in light of evolving federal privacy enforcement expectations.