FTC Takes Action Against GM Over Unseen Tracking of Drivers’ Data

It’s the kind of scenario that sounds like a privacy nightmare. You’re driving your car, thinking you’re just using a standard service like navigation or emergency assistance, only to later discover that every movement you make—your precise location, your driving behavior—has been quietly tracked and sold without your knowledge or consent. That’s exactly what the Federal Trade Commission (FTC) is accusing General Motors (GM) and its OnStar service of doing.

In a groundbreaking move that underscores the increasing tension between technological innovation and consumer privacy, the FTC is holding GM accountable for allegedly collecting and selling sensitive geolocation and driving data from millions of drivers. This data, which GM did not fully disclose to consumers, was sold to third-party agencies—including those that help set insurance rates—without proper consent. The FTC’s action shines a light on the growing privacy concerns tied to connected vehicles in today’s tech-driven world.

The Hidden Cost of ‘Connected’ Cars

If you own a GM car equipped with OnStar, you might have signed up for the service thinking it would simply help in emergencies or guide you with real-time traffic information. What you might not have realized is that OnStar was collecting detailed data on your every move—how hard you brake, how fast you drive, and where you go. This data was not just stored; it was sold to third parties, including consumer reporting agencies, who then used it to influence insurance premiums.

The frequency with which this data was collected was also unsettling—sometimes every three seconds—providing a detailed map of your driving habits. From your daily commute to your visits to the hospital, this information paints an intimate portrait of your life.

The FTC’s complaint suggests that GM misled consumers from the start. When drivers enrolled in OnStar’s services, they were not clearly informed that their driving data would be collected and sold. Many didn’t even realize they had been automatically enrolled in the “Smart Driver” feature. The enrollment process, according to the FTC, was confusing and buried in fine print, leaving consumers unaware of how their data would be used.

One frustrated consumer told GM customer service, “When I signed up for this, it was so OnStar could track me. They said nothing about reporting it to a third party. Nothing.” This lack of transparency is at the heart of the FTC’s action, which seeks to safeguard consumer privacy in an era where data collection is pervasive.

A Proposed Resolution with Greater Control & Transparency

The proposed settlement mandates significant changes for GM and OnStar. For the next five years, they will be prohibited from sharing geolocation and driving behavior data with consumer reporting agencies. More importantly, they will have to overhaul how they collect and use data, starting with a requirement to obtain clear and explicit consent from consumers before tracking or selling any information.

Consumers will also be granted greater control over their own data. They will be able to request copies of their data, ask for it to be deleted, and even disable the collection of certain types of information. These provisions are aimed at giving drivers more power and awareness regarding what data is being collected, how it’s used, and how they can opt out if they don’t want to participate.

FTC Chair Lina M. Khan emphasized the broader implications by stating, “GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds. With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”

What’s Next for GM & OnStar

While the proposed order is still in the public comment phase, the message is clear—the FTC is taking a stand against companies that collect and use consumer data without proper consent. If finalized, GM and OnStar will be required to adhere to these new privacy standards, with penalties for any violations.

As we continue to embrace connected technology in our cars, this case serves as an important reminder about privacy and transparency. Drivers should have control over their own data, and companies must be upfront about how they use it. In the future, it shouldn’t just be about how smart your car is—it should also be about how smart your privacy choices are.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.