The Federal Trade Commission has banned General Motors and subsidiary OnStar from sharing drivers’ precise location and behavior data with consumer reporting agencies for five years under a 20-year consent order finalized January 14.
According to the order [PDF], GM turned connected cars into surveillance devices by collecting and selling driver data without clearly informing customers. The settlement prohibits location and driving data sharing with consumer reporting agencies and requires explicit permission for future connected car data collection.
The finalized settlement follows a proposed deal reached a year ago, and comes almost two years after a New York Times probe revealed how GM and OnStar collected, used, and sold drivers’ detailed telematics data through a feature known as Smart Driver. That reporting showed the data – including precise location, hard braking, acceleration, speed, and even seatbelt use – ended up with data brokers such as LexisNexis and Verisk, which in turn sold it to insurance companies that could use it to influence customers’ premiums.
Smart Driver was pitched as a free add-on inside GM’s connected car apps, framed as a way to encourage safer driving. The FTC’s complaint, first unveiled in January 2025, paints a murkier picture, accusing GM of steering drivers into OnStar and Smart Driver while downplaying how much location and driving data was being collected – and who it would ultimately be sold to.
GM shut down Smart Driver across all of its brands in April 2024, citing customer backlash. The company said it unenrolled users at the same time and severed the third-party telematics deals that fed data to LexisNexis and Verisk.
Under the terms of the FTC’s order, GM must obtain consent from drivers before collecting or sharing covered data. The order also requires GM to give consumers a straightforward way to request a copy of their data, ask for its deletion, and disable the collection of precise geolocation data entirely.
The FTC says GM may still share location data with emergency responders and use it internally for research and development. GM confirmed it also sometimes shares anonymized data with select partners to support projects including traffic analysis and road safety.
In a statement, GM said: “General Motors has reached a settlement agreement with the Federal Trade Commission to address privacy concerns about our now-discontinued Smart Driver program. Respecting our customers’ privacy and earning their trust is deeply important to us. Although Smart Driver was created to promote safer driving behavior, we ended that program due to customer feedback.”
It has also folded its sprawling US privacy notices into a single document. The company argued that the FTC order goes “above and beyond existing law,” largely codifies changes GM says it has already made, and will remain in effect for 20 years.
For regulators, this looks less like a one-off and more like a warning shot. Carmakers eager to squeeze value out of connected cars will need to be clearer with drivers about what’s collected and sold, or risk finding a regulator in the road ahead. ®
