Privacy & Information Security Law Blog

On January 16, 2025, the FTC announced a proposed order against General Motors (GM) and OnStar that would resolve allegations that the companies collected, used and sold drivers’ precise geolocation data and driving behavior information from millions of vehicles without adequately notifying consumers and obtaining their affirmative consent. In the FTC’s press release, the agency noted that this type of data can be used to set insurance rates.

According to the FTC’s complaint, GM allegedly used a misleading enrollment process to get consumers to sign up for its OnStar connected vehicle service and the OnStar Smart Driver feature. The complaint further alleged that GM failed to clearly disclose that it collected consumers’ precise geolocation and driving behavior data (such as every instance of hard braking, late night driving and speeding) and sold it to third parties, including consumer reporting agencies, without consumers’ consent. The FTC alleged that these consumer reporting agencies then used this sensitive information to compile credit reports on consumers, which were used by insurance companies to deny insurance and set rates.

The FTC’s proposed order with GM and OnStar would prohibit the companies from misrepresenting how they collect, use and share consumers’ location and driver behavior data. Additionally, the proposed order would require GM and OnStar to: (1) not disclose consumers’ precise geolocation data and driver behavior data to consumer reporting agencies for five years; (2) obtain affirmative express consent from consumers prior to collecting connected vehicle data, with certain exceptions (e.g., for emergency first responders); (3) allow consumers to access and delete their data and (4) allow consumers to disable the collection of precise geolocation data and driver behavior data, with limited exceptions.