The Federal Trade Commission has finalized a sweeping enforcement order against General Motors and its OnStar subsidiary, concluding that the automaker collected, used and sold sensitive vehicle data without adequately informing consumers or obtaining their affirmative consent.
The final order, announced Jan. 14, resolves allegations first brought by the FTC in January 2025 and represents one of the agency’s most significant actions to date involving connected vehicle data and consumer privacy. Regulators said GM’s practices violated federal law by misleading drivers about how their personal information was collected and shared.
According to the FTC’s complaint, General Motors LLC, General Motors Holdings LLC and OnStar LLC gathered precise geolocation data and detailed driving behavior information from millions of vehicles enrolled in OnStar-connected services, including the Smart Driver feature. The agency said GM failed to clearly disclose that the data would be shared with third parties, including consumer reporting agencies, and that consumers were not given meaningful choices or informed consent.
The FTC alleged that GM’s enrollment process led many vehicle owners to believe the data was collected solely to provide safety, convenience or driver feedback features. In reality, regulators said, the company tracked information such as vehicle location, speed, braking events, mileage and driving patterns, in some cases recording location data every few seconds. That information was then disclosed or sold to outside entities without drivers fully understanding how their data would be used.
Under the final order, GM is prohibited for five years from disclosing consumers’ precise geolocation and driving behavior data to consumer reporting agencies. The FTC said the restriction is designed to prevent future harm and address what it described as a serious breach of consumer trust.
In addition to the five-year ban, the order imposes long-term compliance requirements that will remain in effect for 20 years. Chief among them is a mandate that GM obtain affirmative express consent from consumers before collecting, using or sharing connected vehicle data. That consent must be clearly presented and cannot be implied through silence or preselected options. Limited exceptions are allowed, such as sharing location data with emergency responders during a crash or other emergency situation.
The order also requires GM to give consumers greater control over their information. The company must provide a way for U.S. drivers to request access to the data collected about them and to request deletion of that data. GM must also offer drivers the ability to disable the collection of precise geolocation data in vehicles that are technically capable of doing so.
In addition, the automaker must provide an opt-out option for the collection of geolocation and driving behavior data more broadly, subject to limited exceptions. The FTC said these measures are intended to ensure transparency and allow consumers to make informed decisions about whether they want their vehicle data collected at all.
The Commission approved the final order by a 2-0 vote of the commissioners participating in the decision.
FTC officials have repeatedly warned that connected vehicles can generate highly sensitive information that reveals intimate details about consumers’ lives, including where they live, work, worship and travel. In earlier statements tied to the proposed settlement, the agency emphasized that precise location tracking can pose serious privacy risks if collected or shared without clear disclosure and consent.
General Motors has said it supports consumer privacy and has already made changes to its data practices. The company previously discontinued the Smart Driver program and updated its consent process, steps the FTC said were considered during the settlement process but did not eliminate the need for formal enforcement.
Privacy advocates and industry analysts say the final order sends a strong signal to automakers and other connected-device manufacturers that data collection practices will be closely scrutinized. The case is widely viewed as a precedent-setting action that could shape how vehicle data is handled across the auto industry as vehicles become increasingly software-driven and connected.
The FTC said the order underscores its broader commitment to protecting consumers as new technologies collect growing amounts of personal data, and it warned that companies must be transparent, truthful and obtain clear permission when handling sensitive information.
Photo: OnStar in a GM vehicle. Credit: General Motors.
