FTC Finalizes Order Against GM in Driver Data Sharing Case

The Federal Trade Commission has officially finalized its order against General Motors, concluding a case that highlights the increasing tension between data collection and consumer privacy. The finalized order, first proposed last year, restricts GM's ability to share specific consumer data and mandates clearer consent procedures. This action serves as a stark reminder of the potential pitfalls in the burgeoning market of vehicle data.

The settlement stems from revelations in a New York Times report two years ago, detailing how GM's OnStar "Smart Driver" program collected and disseminated granular driving data. This included geolocation information and driving behavior metrics, which were then sold to third-party data brokers like LexisNexis and Verisk. These brokers, in turn, provided the data to insurance companies, resulting in some drivers facing inflated premiums. A Chevy Bolt owner quoted by Engadget described the experience as "a betrayal," after seeing their insurance rates jump 21 percent.

Key Terms of the FTC Order

The FTC's order places significant constraints on GM's data practices. For the next five years, GM is barred from sharing specific user data with consumer reporting agencies. Furthermore, the automaker must now obtain explicit user consent before collecting, using, or sharing vehicle data with any third party. GM must solicit this consent in person at dealerships when a consumer purchases a vehicle, ensuring a direct and transparent interaction regarding data collection practices, according to TechCrunch.

It's worth noting that GM discontinued its Smart Driver program across all brands in April 2024, before the FTC finalized its order. The company also terminated its relationships with LexisNexis and Verisk at that time. While these proactive steps may mitigate some immediate concerns, the FTC's action underscores the need for a robust regulatory framework to govern the collection and use of vehicle data. Texas Attorney General Ken Paxton, whose office also pursued legal action against GM, stated, "Our investigation revealed that General Motors has engaged in egregious business practices that violated Texans’ privacy and broke the law. We will hold them accountable."

Implications for the Broader Auto Industry

While the FTC's order against GM addresses a specific instance of alleged misconduct, it carries broader implications for the entire automotive industry. As vehicles become increasingly connected and data-rich, automakers face growing pressure to balance innovation with consumer privacy. The case underscores the need for companies to be transparent about their data collection practices and to obtain informed consent from consumers.

"As vehicle connectivity becomes increasingly integral to the driving experience, GM remains committed to protecting customer privacy, maintaining trust, and ensuring customers have a clear understanding of our practices," GM said in a statement reported by TechCrunch. Whether this commitment translates into tangible changes in data practices remains to be seen. The FTC's action will likely spur further scrutiny of data practices across the industry, potentially leading to additional regulatory interventions. The convergence of automotive technology and data privacy presents a complex challenge for policymakers, regulators, and companies alike. This case is a significant step in defining the boundaries of acceptable data practices in the automotive sector, but it is likely just the beginning of a long and evolving debate.