In This Story
General Motors (GM-1.45%) can’t sell their consumers’ geolocation and driver behavior data to consumer reporting agencies for the next five years, according to a proposed settlement between the automaker and the Federal Trade Commission (FTC).
The Detroit carmaker had been collecting drivers’ data through its OnStar Smart Driver feature and OnStar connected vehicle service, according to the FTC’s initial complaint. It’s been accused by both the FTC and Texas’s attorney general of using a misleading enrollment process and failing to disclose that data was sold to third-parties without consumers’ consent.
The company collected data on when drivers got behind the wheel, how fast they were going, whether seatbelts were enabled, how far they drove, how long the engine was running — and more. Since at least 2018, the FTC alleged that data was being collected from millions of vehicles.
“GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,” FTC Chair Lina Khan said in a statement. “With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”
Under the order, GM and its OnStar subsidiary are required to provide a way for consumers to request a copy of their data and for their data to be deleted. They must also get consumers’ express consent before collecting connected vehicle data, with an exception carved out to aid emergency response efforts, and allow their customers to limit data collection.
According to a separate lawsuit filed by Texas prosecutors, GM had reached agreements with data brokers LexisNexis and Verisk (VRSK+0.44%), British-connected car startup Wejo, and Jacobs Engineer Group (J+0.97%). In 2019, GM took a 35% stake in Wejo as part of a deal that gave it access to drivers’ data, which Prolific North reported was routinely sold at a loss.
GM on Thursday said it had expanded a program to give U.S. customers options to access and delete their personal information, and it will need to obtain consumer consent to collect, use, or disclose certain types of data over the next 20 years. It also ended its relationships with LexisNexis and Verisk, discontinued its Smart Driver, and updated its privacy agreements.
“We’re more committed than ever to making our policies and controls clear and accessible as we continue to evolve the driving experience for our customers,” the company said in a statement.
It’s not uncommon for automakers to have agreements with data brokers, but they have come under recent scrutiny. The non-profit Mozilla Foundation in late 2023 released a report evaluating 25 car brands — including Tesla (TSLA+6.08%), Ford Motor Co. (F+1.46%), Volkswagen (VWAGY+0.57%), and Toyota Motor Co. (TM-0.35%) — and found that all of them collect “too much” personal data.
Kia America (HYMTF+4.56%), Subaru of America (FUJHY+0.60%), Mitsubishi Motors (MMTOF+4.48%), Ford, American Honda Motor (HMC+0.88%), Nissan North America (NSANY+2.67%), and Hyundai Motor America all reportedly have relationships with Lexis Nexis and Verisk. Their deals aren’t major money-makers; according to Democratic lawmakers, Hyundai shared data from 1.7 million vehicles with Verisk over a six-year period for $1.04 million, or 61 cents per car.