The FTC’s data-sharing order against General Motors has finally been settled

The Federal Trade Commission said Wednesday it has finalized an order prohibiting General Motors and its OnStar service from sharing certain consumer data with consumer reporting agencies. The final order, which comes a year after the agency reached Proposed settlement With GM, it also requires the automaker to be more transparent with its customers and obtain their explicit consent for any data collection.

the Final order It comes nearly two years after A.J New York Times report It showed how GM and OnStar collected, used and sold precise geolocation data of drivers and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data was collected through GM’s Smart Driver program, a free feature within its connected car apps that tracks and evaluates driving behaviors and seatbelt use. Data brokers sold this information to insurance providers, which could affect customer rates, the New York Times reported at the time.

GM to stop Smart Driver program in April 2024 across all its brands, citing customer feedback. GM said at the time that it had deregistered all customers and terminated its third-party IT relationships with LexisNexis and Verisk.

The FTC alleged that GM and OnStar used a misleading registration process to induce consumers to sign up for the OnStar connected vehicle service and the OnStar Smart Driver feature. The FTC also alleged that the automaker failed to clearly disclose that the data would be collected and sold to third parties.

Under the order finalized Wednesday, GM must also obtain explicit consent from consumers before collecting, using or sharing connected vehicle data. This process occurs at the dealership when a consumer purchases a vehicle from one of General Motors’ brands. At that point, the OnStar system is linked to the vehicle’s VIN number and the new owner is asked whether or not they consent to the data being collected, according to GM.

However, there are some exceptions to the data collection prohibition. The FTC said GM is permitted to share location data with emergency first responders and for internal research. GM confirmed this, noting that it collects data for internal research and development, and sometimes shares anonymous or anonymized data (not linked to specific drivers or vehicles) with selected partners to enhance city infrastructure and improve road safety. For example, the data was shared with the University of Michigan, which used it for Urban planning.

GM should also create a way for all U.S. consumers to request a copy of their data and seek deletion and give them the ability to opt out of the collection of precise geolocation data from their vehicles. GM says it has already complied with these mandates.

GM says it has begun overhauling its data collection and privacy policies and programs in 2024. For example, the automaker said it has consolidated many of its U.S. privacy statements into one simpler statement and expanded GM’s privacy program that allows customers to access and delete their personal information.

“The FTC has formally approved the agreement reached last year with GM to address concerns,” an emailed statement from GM said. “As vehicle connectivity becomes an integral part of the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”