**GM’s Data Sharing Scandal: A Wake-Up Call for Transparency**
In a major win for consumer privacy, the Federal Trade Commission (FTC) has finalized an order requiring General Motors (GM) and its OnStar telematics service to get explicit consent from customers before collecting, using, or sharing their data. This comes after a 2024 report exposed how GM was collecting and selling drivers’ geolocation data and driving habits to third-party companies.
**The Smart Driver Program: A Data-Collection Scandal**
In 2024, a New York Times investigation revealed that GM’s Smart Driver program, a feature within its connected car apps, was tracking and rating drivers’ behavior and seatbelt use. The data was then sold to insurance companies, which could affect customers’ rates. This was done without the customers’ knowledge or consent.
**GM’s Response: Discontinuing the Smart Driver Program**
In April 2024, GM discontinued the Smart Driver program across all its brands, citing customer feedback. The company claimed it unenrolled all customers and ended its relationships with LexisNexis and Verisk, two data brokers that sold the data to insurance companies.
**FTC Allegations: Deceptive Enrollment and Lack of Transparency**
The FTC alleged that GM and OnStar used a deceptive enrollment process to get customers to sign up for their OnStar connected car service and OnStar Smart Driver feature. Additionally, the FTC claimed that the company failed to clearly disclose that the data would be collected and sold to third parties.
**New Order: Explicit Consent Required**
Under the finalized order, GM is now required to obtain explicit consent from customers before collecting, using, or sharing connected car data. This happens when a customer buys a car from a GM brand. At that time, the OnStar system is linked to the car’s VIN number, and the customer is asked whether or not they agree to data collection.
**Exceptions to the Data Collection Ban**
There are some exceptions to the data collection ban. GM is allowed to share location data with emergency first responders and for internal analysis, according to the FTC.
**GM’s New Privacy Measures**
GM has already implemented several new privacy measures, including allowing customers to request a copy of their data and seek its deletion, as well as giving them the ability to disable the collection of exact geolocation data from their cars.
**A New Era of Transparency**
GM has started overhauling its policies and programs on data collection and privacy. As part of this effort, the company has consolidated its U.S. privacy statements into a single, easier-to-read statement and expanded its GM Privacy program, which allows customers to access and delete their personal data.
**What This Means for Consumers**
This order serves as a reminder that consumers have the right to control their personal data and that companies must be transparent about their data collection and sharing practices. As the automotive industry becomes increasingly connected, this ruling sets a precedent for other companies to follow in protecting customer privacy.
