Every Three Seconds: The FTC's Case Against GM Selling Driver Data

The Federal Trade Commission announced an action against General Motors and its OnStar subsidiary on January 16, 2025, alleging the companies collected consumers' precise geolocation and driving behavior data without adequately disclosing the practice or obtaining affirmative consent, then sold that data to consumer reporting agencies that used it to help set insurance rates.DOCUMENTED

Under the proposed settlement, General Motors LLC, General Motors Holdings LLC, and OnStar, LLC agreed to a five-year ban on disclosing geolocation and driver behavior data to consumer reporting agencies, along with a 20-year requirement to obtain affirmative express consent before collecting, using, or sharing connected vehicle data.DOCUMENTED

How the data collection worked

According to the FTC's complaint, GM's OnStar Smart Driver feature was designed to track granular details of a driver's habits and behavior, including how frequently they braked hard, how fast they drove, and their precise location, collecting this information at a rate of roughly every three seconds while a vehicle was in operation. The complaint alleges GM's enrollment process for the feature failed to clearly disclose that this data would be collected, used, and sold to third parties.DOCUMENTED

The FTC's complaint charged GM with two distinct violations of Section 5(a) of the FTC Act: unfairly using and disclosing precise geolocation and driver behavior data without taking reasonable steps to obtain consumers' affirmative express consent, and deceptively failing to disclose that it was using and disclosing that data in the first place.DOCUMENTED

Where the data went

The complaint alleges GM sold the collected driving data to consumer reporting agencies, including LexisNexis Risk Solutions and Verisk, which in turn made that data available to insurance companies. Those insurers could then use detailed driving-behavior scores, generated from data drivers were unaware was being collected, to help set individual insurance premiums, effectively allowing a driver's daily commute and braking habits, tracked without clear consent, to affect the price they paid for auto insurance.DOCUMENTED

The practice came to public attention through a New York Times investigation that found GM was selling its OnStar Smart Driver customers' geolocation and driving behavior data without adequate consumer awareness. GM discontinued the Smart Driver program less than two months after the article was published, a step the FTC noted it considered during settlement negotiations, though the agency determined it did not eliminate the need for formal enforcement given the scope of data already collected and shared.DOCUMENTED

The settlement's terms

Under the order, GM and OnStar are banned for five years from disclosing consumers' geolocation and driver behavior data to any consumer reporting agency. Separately, for a period of 20 years, the companies must obtain consumers' affirmative express consent before collecting, using, or sharing connected vehicle data of this kind, with limited exceptions for emergency services such as providing location information to first responders.DOCUMENTED

The order also requires GM to give consumers the ability to access their own collected data, request its deletion, disable precise geolocation tracking on vehicles that support it, and opt out of data collection entirely. GM must further direct any third parties it previously shared data with to delete that information and to refrain from further sharing it.DOCUMENTED

No monetary penalty, but a fundamental overhaul

Unlike many FTC data-privacy settlements, the GM order includes no civil penalty or monetary redress fund for affected consumers. Legal commentary on the case has noted this reflects the FTC's more limited toolkit for pure privacy-based unfairness claims absent an accompanying deceptive-practices violation carrying separate penalty authority; instead, the order's primary mechanism for accountability is the multi-year injunctive relief governing GM's future data practices.REVIEWED

The FTC's first connected-car case

The FTC described the GM action as its first enforcement matter focused specifically on connected vehicle data, following comments the agency made in May 2024 signaling it would begin more closely monitoring data practices in the automotive industry. Regulators emphasized that geolocation data is inherently sensitive, and that surreptitious disclosure of driving behavior and location information can reveal intimate details about a person's life, including where they live, work, worship, and travel.DOCUMENTED

Industry analysts have described the case as precedent-setting for the broader automotive sector, given how heavily modern vehicles increasingly rely on connected software and sensors capable of generating exactly the kind of granular behavioral data at issue in GM's settlement. Other automakers collect similar categories of data through their own connected-vehicle programs, and the case is widely viewed as a signal that comparable practices elsewhere in the industry could draw similar scrutiny going forward.

The absence of a monetary penalty in the GM settlement has drawn attention from privacy advocates who argue that purely injunctive relief, without an accompanying fine, may understate the deterrent value regulators intend such settlements to carry for other automakers weighing similar data-monetization strategies. Because connected-vehicle data represents a growing revenue opportunity across the auto industry, the durability of the GM order's consent and disclosure requirements, running two decades in some respects, may ultimately matter more than any one-time penalty in shaping how the broader industry approaches driver data going forward.REVIEWED

For consumers evaluating any connected vehicle purchase going forward, the case underscores a practical lesson regulators have repeatedly emphasized across their broader privacy enforcement docket: opting into a convenience feature bundled with a new vehicle purchase, without carefully reviewing what data that feature collects and to whom it may eventually be sold, can carry consequences reaching well beyond the vehicle itself, including effects on insurance pricing determined by data the driver never knowingly agreed to share.REVIEWED

Have documents relevant to this story? Reach us through our tips channel.