FTC Imposes 5-Year Ban on GM Disclosing Geolocation, Driver Data to Consumer Reporting Agencies

The company must now obtain ‘affirmative express consent’ from customers before collecting their data.

GMC Hummer EVs at General Motors' Factory ZERO electric vehicle assembly plant in Detroit on Nov. 17, 2021. Nic Antaya/Getty Images

The Federal Trade Commission (FTC) has finalized an order banning General Motors (GM) from disclosing consumers’ geolocation and driver behavior data to consumer reporting agencies for a period of five years, the agency said in a Jan. 14 statement.

The FTC had filed a complaint against GM and its subsidiary OnStar LLC in January 2025. GM “collected, used, and sold drivers’ precise geolocation data and driving behavior information from millions of vehicles—data that can be used to set insurance rates—without adequately notifying consumers and obtaining their affirmative consent,” the agency said at the time.

GM was encouraging customers to sign up for its OnStar connected vehicle service and the OnStar Smart Driver feature through a “misleading enrollment process,” the FTC said at the time.

During enrollment, the company did not “clearly disclose” that collected information—including data regarding speeding, late-night driving, and instances of hard braking—would be sold to third parties such as consumer reporting agencies, the commission said.

This information was used by reporting agencies to compile credit reports that were subsequently utilized by insurance companies to set rates and deny insurance, the commission said. The FTC said that tracking and collecting geolocation data was an invasion of privacy.

The five-year ban is part of the FTC’s settlement order with GM. The ban is appropriate “given GM’s egregious betrayal of consumers’ trust,” the FTC statement said. The order was issued against OnStar LLC, General Motors LLC, and General Motors Holdings LLC, which are all owned by the General Motors Company.

In addition, for the next 20 years of the order, GM is required to obtain “affirmative express consent from consumers prior to collecting, using, or sharing connected vehicle data” except under certain circumstances, such as providing location data to emergency first responders, the FTC said.

During that period, GM must ensure that U.S. customers can request a copy of their data, ask for their data to be deleted, and opt out of geolocation and driver behavior data collection.

“The Federal Trade Commission has formally approved the agreement reached last year with General Motors to address concerns,” a GM spokesperson told The Epoch Times on Jan. 15.

“As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices.”

In a statement on Jan. 16, 2025, GM said that although Smart Driver was created to promote safer driving among users, the company ended the program following customer feedback.

“Last year, we discontinued Smart Driver across all GM vehicles, unenrolled all customers, and ended our third-party telematics relationships with LexisNexis and Verisk,” GM said at the time.

“The FTC consent order includes new measures that go above and beyond existing law, while capturing steps we’ve already taken to establish choices for customer data collection and communications about how the information is used.”

GM had affirmed that it would obtain customer consent before collecting, using, or disclosing certain types of connected vehicle data, in line with its agreement with the FTC.

Vehicle Data Collection

Multiple other car companies admit to collecting driver data as part of their privacy policies.

For instance, Honda gathers geolocation and driver behavior data, according to its data privacy practices webpage.

Driver behavior information includes “vehicle speed, vehicle acceleration and deceleration, pedal positions, engine speed, direction and time of travel, steering angle, yaw rate, vehicle control, and Honda Sensing or Acura Watch system settings and usage,” it said.

In a Jan. 6 statement, Toyota said it collects a vehicle’s precise location, within 1,850 feet. The company clarified that it does not use the location or driving data for marketing purposes or offer it to third parties.

Kia’s privacy policy states that the company collects geolocation data and other vehicle information that could be shared with third parties for purposes such as crash notification assistance, content-based services, roadside assistance, and determining driving score and usage-based insurance.

In April, Sen. Elissa Slotkin (D-Mich.) introduced the Connected Vehicle National Security Review Act, which would allow the Department of Commerce to ban or restrict connected vehicles or components coming from China or other nations of concern if deemed to pose a threat to national security, according to an April 10, 2025, statement from the lawmaker’s office.

“Chinese vehicles, which are dirt cheap thanks to state subsidies, could collect full motion video of sensitive sites, 3-D mapping, and geolocation of individual drivers—all of which could be sent back to Beijing,” Slotkin said.

The bill was referred to the Committee on Banking, Housing, and Urban Affairs in June 2025.