# The FTC’s Data-Sharing Order Against GM is Finally Settled
In a landmark decision, the Federal Trade Commission (FTC) has finalized its order against General Motors (GM) and OnStar, imposing strict limits on sharing drivers’ geolocation and driving behavior data while mandating greater transparency and consumer consent.[2][3] This settlement, approved on January 14, 2026, resolves allegations stemming from a New York Times exposé nearly two years ago, marking a pivotal moment for automotive privacy.[2][3]
## The Backstory: How GM’s Data Practices Sparked FTC Scrutiny
The controversy ignited in early 2024 when a New York Times investigation revealed that GM and its OnStar telematics service collected precise geolocation data and driving behaviors from millions of vehicles through the **Smart Driver program**.[2] This free feature, embedded in GM’s connected car apps, tracked metrics like seatbelt use, speeding, and hard braking, then sold the data to third-party brokers such as LexisNexis and Verisk.[2][3] These brokers, in turn, shared it with insurance companies, potentially influencing drivers’ premiums without their knowledge.[2]
The FTC’s complaint, first announced in January 2025, accused GM of using a **misleading enrollment process** for OnStar services and the Smart Driver feature.[2][3] Consumers were not adequately informed that their data—highly sensitive precise location information—would be harvested and sold.[3] In response to backlash, GM discontinued the Smart Driver program across all brands in April 2024, unenrolled users, and severed ties with the data brokers.[2]
This case highlighted broader concerns in the connected car era, where vehicles generate vast amounts of personal data. As cars evolve into rolling computers, regulators are cracking down on opaque practices that erode consumer trust.[5]
## Key Provisions of the Finalized FTC Order
The FTC’s order, voted 2-0 by commissioners, delivers robust “fencing-in relief” to prevent future violations.[3] Here’s what it entails:
– **Five-Year Ban on Data Sharing**: GM is prohibited from disclosing geolocation and driver behavior data to **consumer reporting agencies** for five years. This targets the exact misuse alleged in the complaint.[3]
– **20-Year Consent Requirements**: For the order’s full 20-year term, GM must obtain **affirmative express consent** before collecting, using, or sharing connected vehicle data.[3] Consent is sought at dealerships, linked to the vehicle’s VIN, ensuring new owners are prompted clearly.[2]
– **Consumer Control Tools**: GM must provide U.S. consumers with mechanisms to:
– Request a copy of their data and delete it.
– Disable precise geolocation collection (if vehicle technology allows).
– Opt out of geolocation and driver behavior data collection.[3]
GM reports already complying with these, having overhauled privacy policies in 2024 by consolidating statements and expanding data access programs.[2]
**Exceptions** allow flexibility for safety and innovation:
– Sharing location with emergency first responders.
– Internal research and development.
– De-identified data sharing with partners like the University of Michigan for urban planning and road safety.[2][3]
In a statement, GM emphasized its commitment: “As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”[2]
## Broader Implications for the Auto Industry and Privacy
This settlement signals the FTC’s intensifying focus on **geolocation data** and connected vehicle privacy.[1][5] It’s part of a pattern: recent actions include penalties against Vroom for shipment misrepresentations and Leader Automotive for defrauding buyers.[4] The GM order’s 20-year duration and explicit consent mandates set a high bar, hinting at future enforcement against data-use limits.[5]
For drivers, it means empowered choices. No longer can automakers bury data collection in fine print. Transparent opt-ins at purchase and easy deletion tools shift power back to consumers.[2][3] Insurers may feel the pinch too, losing easy access to granular driving data that could hike rates unfairly.
GM’s proactive steps—ending Smart Driver and simplifying privacy notices—demonstrate lessons learned.[2] Yet, the FTC described GM’s original practices as an “egregious betrayal of consumers’ trust,” underscoring the need for industry-wide reform.[3]
## What This Means for You as a Driver
If you own a GM vehicle (Chevrolet, Buick, GMC, or Cadillac), check your OnStar settings today. GM’s privacy portal lets you access, delete data, or disable tracking.[2] For new buyers, expect prominent consent prompts at the dealership.
This ruling arrives amid rising vehicle connectivity—think over-the-air updates and AI-driven features. While exceptions support safety (e.g., crash detection), they balance innovation with privacy.[2] Experts predict ripple effects: other automakers like Ford and Tesla may face similar scrutiny as data brokers evolve.[5]
## Looking Ahead: A New Era of Automotive Privacy
The FTC-GM settlement isn’t just a win for regulators; it’s a blueprint for ethical data handling in smart cars.[1][3] By mandating consent and transparency, it fosters trust essential for adopting advanced features like autonomous driving.
As MLex notes, this order “hints at US FTC focus on geolocation data, data-use limits,” potentially reshaping how all connected devices handle personal info.[5] Drivers benefit from protections against surveillance capitalism, while companies like GM can innovate responsibly.
In 2026, with connectivity ubiquitous, this case reminds us: your data, your rules. Stay informed, opt out when needed, and drive on—with privacy intact.
*(Word count: 812)*
Original source: TechCrunch – The FTC’s data-sharing order against GM is finally settled