The FTC has reached a final resolution regarding its data-sharing directive involving GM

FTC Finalizes Ban on GM and OnStar Data Sharing with Credit Agencies

The Federal Trade Commission (FTC) has officially enacted a ruling that prohibits General Motors and its OnStar telematics service from providing specific consumer information to credit reporting agencies. This decision, which follows a preliminary agreement reached last year, also mandates that GM must clearly inform customers about its data practices and secure their direct approval before collecting any personal data.

This finalized directive was issued nearly two years after investigative reporting revealed that GM and OnStar were gathering and distributing detailed location and driving behavior data to third parties, such as data brokers LexisNexis and Verisk. The information, collected through GM’s complimentary Smart Driver feature within its connected vehicle apps, tracked driving habits and seatbelt usage. These brokers then sold the data to insurance companies, potentially impacting customers’ insurance premiums.

In response to customer concerns, GM ended the Smart Driver program across all its brands in April 2024. At that time, the company unenrolled all participants and terminated its data-sharing agreements with LexisNexis and Verisk.

The FTC accused GM and OnStar of using deceptive methods to enroll users in their connected vehicle services and Smart Driver feature, without adequately disclosing that collected data could be sold to outside parties.

New Consumer Protections and Consent Requirements

Under the new FTC order, GM must now obtain clear, affirmative consent from customers before collecting, using, or sharing data from connected vehicles. This consent process takes place at the dealership when a customer purchases a GM vehicle, at which point the OnStar system is linked to the car’s VIN and the new owner is asked to approve or decline data collection.

There are limited exceptions to the data sharing ban. GM is permitted to provide location data to emergency responders and use data internally for research and development. The company may also share anonymized, non-identifiable data with select partners for purposes such as urban planning and road safety improvements. For example, GM has collaborated with the University of Michigan on city infrastructure projects using such data.

Enhanced Consumer Rights and Privacy Measures

The order also requires GM to offer all U.S. customers the ability to request copies of their personal data, ask for its deletion, and opt out of precise location tracking from their vehicles. GM states that these options are already available to its customers.

In 2024, GM began updating its privacy policies and data management practices. The company consolidated its U.S. privacy statements into a single, more accessible document and expanded its privacy program, enabling customers to view and erase their personal information.

“The Federal Trade Commission has now formally approved the agreement with General Motors to address these privacy concerns,” GM said in a statement. “As vehicles become more connected, we remain dedicated to safeguarding customer privacy, building trust, and ensuring transparency in our data practices.”

Upcoming Event: Disrupt 2026

Be among the first to secure your spot for Disrupt 2026 in San Francisco, taking place October 13-15, 2026. Previous events have featured industry giants like Google Cloud, Netflix, Microsoft, and many more, with over 250 leaders and 200+ sessions designed to inspire innovation and growth. Don’t miss the opportunity to connect with hundreds of pioneering startups across various sectors.

• Location: San Francisco
• Dates: October 13-15, 2026