The Federal Trade Commission finalized a settlement order with General Motors and its OnStar subsidiary addressing allegations that the companies collected and sold consumers' precise geolocation data and driving behavior information from millions of vehicles without adequate consumer notification or consent.
Under the order, General Motors LLC, General Motors Holdings LLC, and OnStar LLC are prohibited from sharing certain consumer data with consumer reporting agencies and must implement enhanced transparency measures for connected vehicle data collection. The settlement stems from a complaint the FTC first announced in January 2025.
The FTC alleged that GM used misleading enrollment processes to persuade consumers to sign up for its OnStar connected vehicle service and OnStar Smart Driver feature. The agency also alleged that GM failed to clearly disclose that it collected consumers' precise geolocation and driving behavior data through the Smart Driver feature and sold this information to third parties without obtaining proper consumer consent.
The commission characterized GM's conduct as an "egregious betrayal of consumers' trust," leading to the imposition of what the FTC calls "fencing-in relief" designed to prevent similar violations in the future.
The settlement includes a five-year prohibition on GM disclosing consumers' geolocation and driver behavior data to consumer reporting agencies. This represents the most immediate restriction on the company's data-sharing practices.
For the entire 20-year duration of the order, GM must comply with several comprehensive requirements designed to protect consumer privacy and provide greater transparency over data collection practices.
First, the company must obtain affirmative express consent from consumers before collecting, using, or sharing connected vehicle data, including any sharing with consumer reporting agencies. The order includes limited exceptions, such as providing location data to emergency first responders during crisis situations.
Second, GM must create mechanisms allowing all U.S. consumers to request copies of their personal data and seek its deletion. This data access and deletion requirement gives consumers greater control over their personal information collected through connected vehicle services.
Third, the company must provide consumers with the ability to disable the collection of precise geolocation data from their vehicles, provided the vehicle has the necessary technology to support this feature. This represents a significant shift toward user control over location tracking.
Fourth, GM must establish methods for consumers to opt out of the collection of geolocation and driver behavior data, with only limited exceptions permitted under the order.
The case highlights growing federal scrutiny of connected vehicle data practices as automobiles increasingly collect detailed information about driver behavior, locations, and travel patterns. Modern vehicles equipped with connected services can track precise geolocation data, driving habits, acceleration patterns, braking behavior, and other detailed metrics about how consumers use their vehicles.
The FTC's action against GM represents part of a broader enforcement trend targeting companies that collect consumer data without adequate disclosure or consent. Connected vehicle data has become particularly valuable to third parties, including consumer reporting agencies that use driving behavior information for insurance and credit assessment purposes.
The settlement demonstrates the FTC's willingness to impose long-term compliance requirements on companies that violate consumer privacy expectations. The 20-year duration of the order ensures that GM will face ongoing federal oversight of its data collection practices for an extended period.
Consumer advocacy groups have praised the settlement as a step toward greater protection for vehicle owners who may not realize the extent of data collection occurring through their connected car services. The order's requirements for affirmative consent and opt-out mechanisms address concerns that consumers were unknowingly agreeing to extensive data sharing when signing up for vehicle services.
The Commission voted 2-0 to approve the final order and complaint, as well as to provide responses to public commenters who submitted feedback during the order's public comment period.
For consumers currently using OnStar or other GM connected vehicle services, the settlement means enhanced control over personal data collection and sharing. The company must now provide clear disclosure about data collection practices and obtain explicit consent before collecting or sharing location and driving behavior information.
The FTC's action against GM serves as a warning to other automakers and connected vehicle service providers about the importance of transparent data collection practices and obtaining proper consumer consent before collecting or sharing personal information derived from vehicle usage.