General Motors GM has agreed to a settlement with the Federal Trade Commission FTC over allegations that the company collected and sold driving behavior data from millions of vehicles without proper consent from customers. The settlement, announced in January 2025, follows an investigation into GMs connected vehicle services, including its OnStar and Smart Driver programs, which have been at the center of controversy for years.
The case revolves around GMs failure to adequately disclose to customers that their driving data, including precise geolocation, braking patterns, and acceleration habits, was being collected and sold to third parties, including insurance companies. These actions have raised serious concerns over privacy and consumer rights, leading to significant legal and financial consequences for the automaker.
Allegations and Investigation
The FTCs investigation began after a wave of reports emerged in 2024, revealing that GM had been collecting driving data from customers using its OnStar service without their explicit consent. OnStar, a subsidiary of GM, provides a suite of invehicle connectivity services such as crash response, navigation, and vehicle tracking. While these services are marketed as safety features, they also track a wide range of data that goes far beyond simple location.
According to the FTC, GM did not clearly inform customers that the data collected by OnStar, including detailed information about driving behaviors, would be sold to thirdparty entities. The data included highly personal details like hard braking events, latenight driving habits, and even instances of speeding. This information was then provided to consumer reporting agencies such as LexisNexis and Verisk Analytics, which insurance companies reportedly used to adjust premiums for policyholders .
The investigation also found that GM had used misleading methods to enroll customers in the Smart Driver program, which tracked their driving habits under the assumption it was solely for personal improvement and feedback. However, the company later expanded its data collection to include sensitive information that was shared with third parties without proper consent.
The Terms of the Settlement
In response to these allegations, GM has agreed to a number of measures aimed at restoring customer trust and improving transparency. Under the proposed settlement, GM and OnStar will be required to:
1. Obtain Explicit Consent: Before collecting or sharing any data, GM must obtain clear and affirmative consent from customers. This includes allowing users to opt in or out of data collection features and offering them the option to disable data tracking features entirely.
2. Data Deletion and Transparency: GM must delete all previously collected data that was obtained without proper consent. Additionally, customers will be given the ability to access and delete their data upon request, providing greater control over their personal information.
3. Discontinue Data Sales: GM is prohibited from selling customer driving data to third parties, including insurance companies, for a period of 20 years. The automaker will also be required to clearly disclose how their data is collected and used in future privacy policies.
4. Public Comment Period: The FTCs proposed settlement will be open to public comment for 30 days. Once the comment period concludes, the FTC will decide whether to finalize the agreement.
Industry and Consumer Implications
This settlement is a significant move in the ongoing battle over connected vehicle data and privacy. As automakers continue to expand their use of telematics and connectivity services, questions over the ethics of data collection and the potential for surveillance have become a growing concern for both regulators and consumers. GMs settlement could set a precedent for other companies in the automotive industry to reassess their data collection practices and make necessary adjustments to comply with privacy laws.
For consumers, the settlement represents a victory in the fight for privacy rights. It underscores the importance of understanding how personal data is collected and used, especially in the context of modern, connected vehicles. Many vehicle owners were unaware that their driving behavior was being monitored and shared with outside organizations, often leading to higher insurance premiums or unwanted marketing tactics.
The settlement also highlights the shifting regulatory landscape in the U.S., where agencies like the FTC are increasingly focused on holding companies accountable for how they handle consumer data. It also serves as a reminder to consumers to remain vigilant about the privacy policies of services they use and to actively manage their datasharing preferences.
Looking Ahead
While GM has made significant strides in addressing these privacy concerns, the company still faces ongoing class action lawsuits related to its data practices. These lawsuits, filed by affected vehicle owners, allege that GM misled customers about the extent of data collection and its eventual sale to third parties . As the legal process continues, GM will need to navigate a complicated web of litigation, regulatory scrutiny, and reputational damage.
Additionally, the settlement comes at a time when connected vehicle technology is rapidly advancing. As the market for smart vehicles grows, the issue of data privacy will continue to evolve. Automakers, tech companies, and regulators will need to work together to establish clearer guidelines for data use and consumer consent to avoid future controversies.
In the end, the GM settlement marks a crucial turning point for both the automotive industry and consumer privacy rights. It demonstrates the growing power of regulatory bodies to address complex issues in an increasingly interconnected world, ensuring that consumers are protected from unfair practices and unwarranted surveillance.