The Federal Trade Commission (FTC) has imposed a five-year ban on General Motors (GM) and its subsidiary OnStar, prohibiting them from selling customer data, including geolocation and driving behavior. This decision follows an investigation into the companies’ failure to fully inform customers about how their personal information was collected and sold.
The FTC alleges that GM and OnStar harvested detailed data on millions of drivers’ locations and driving habits without obtaining proper consent. This data was then sold to insurance companies and data brokers, resulting in higher premiums for drivers who were unaware of the data sales.
Data Collection Without Consent
The issue was uncovered following a New York Times investigation, which revealed that GM was tracking various aspects of its customers’ driving, including acceleration, braking, and trip length. This information was sold to firms like LexisNexis and Verisk, which provide data to insurance companies. Many drivers only realized something was wrong when they saw their insurance rates increase, with no clear explanation.
One customer shared their frustration with GM’s customer service:
“When I signed up for this, it was so OnStar could track me. They said nothing about reporting it to a third party. Nothing. […] Now, you’re making me pay more to my insurance company.”
Deceptive Enrollment Practices
The FTC accused GM of misleading customers during the enrollment process for its OnStar service and the Smart Driver program. The automaker allegedly failed to disclose that the data collected would be shared with third parties.
Following the New York Times report, GM announced it would discontinue the Smart Driver program. Despite this, the FTC acted to ensure that GM’s data collection practices comply with stricter privacy standards moving forward.
FTC Chair Lina Khan emphasized the significance of the action, saying:
“GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds. With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”
Consumer Protections and Privacy Initiatives
Under the settlement, GM will be required to obtain explicit consent from customers before collecting driving behavior data. Customers will also have the right to request access to, and deletion of, their data.
The FTC’s ruling imposes additional restrictions:
- GM and OnStar are prohibited from sharing data with consumer reporting agencies.
- The companies must seek clear and explicit consent before collecting any vehicle data.
- Customers will have control over their data, with the ability to access, manage, and delete it.
The settlement highlights the growing concerns about the risks of location data. Information like where someone lives or works, or places they visit regularly, can reveal deeply personal details. In the wrong hands, such data could put individuals in vulnerable situations, particularly in sensitive areas like healthcare or legal matters.
GM’s Response to the Settlement
In its response, GM stated that the FTC’s order reflects changes the company has already made in how it collects and manages customer data. GM noted that it ended the Smart Driver program last year and ceased selling telematics data to analytics companies LexisNexis and Verisk.
“The FTC’s consent order captures steps we’ve already taken to establish choices for customer data collection and communication about how the information is used,” GM said in a statement.
The company also emphasized recent improvements to its privacy program, including a simplified privacy statement for U.S. customers and expanded options for customers in all 50 states to manage and delete their data.
What Happens Next
The FTC’s decision will be open to public comment for 30 days before becoming final. If the order is approved, GM and OnStar will face the five-year ban on selling customer data.
This settlement marks another challenge for GM, which has faced a series of setbacks. Last month, the company pulled back funding for its autonomous vehicle division, Cruise, after investing more than $10 billion in the project.
The FTC’s action serves as a warning to automakers about the growing scrutiny of data privacy. As consumers become increasingly aware of how their personal information is handled, companies will be under pressure to adopt more transparent and ethical data practices.
