The FTC has announced an action against General Motors, GM, for collecting and selling drivers’ precise geolocation data and driving behavior information from millions of vehicles

General Motors has reached an agreement to settle allegations from the Federal Trade Commission (FTC) that it collected, used, and sold data from connected vehicles without drivers' knowledge or consent.

According to a press release issued by the FTC on Thursday (Jan. 16), the data included drivers’ precise geolocation information—such as visits to medical facilities—and details about their driving habits, including hard braking, speeding, and late-night driving.

Under the proposed order, GM and its subsidiary, OnStar, are prohibited from sharing such information with consumer reporting agencies for five years. The order also mandates that GM must obtain explicit consumer consent before collecting connected vehicle data, provide a mechanism for consumers to access and delete their data, and allow them to opt out of data collection altogether.

This case marks the FTC's first action addressing connected vehicle data.

“GM monitored and sold individuals’ precise geolocation data and driver behavior information, sometimes as frequently as every three seconds,” FTC Chair Lina M. Khan said in the release. “This action safeguards Americans’ privacy and protects them from unchecked surveillance.”

In response, GM stated on its website Thursday that it discontinued the Smart Driver program—the focus of the FTC’s complaint—in 2024 following customer feedback. The company also ended third-party telematics partnerships with LexisNexis and Verisk and streamlined its U.S. privacy policies into a unified statement.

“The FTC consent order introduces new requirements that go beyond existing laws, while reflecting measures we’ve already implemented to provide customers with control over data collection and clearer communication about how their information is used,” GM said in its statement. “As part of the agreement, GM will secure affirmative customer consent before collecting, using, or disclosing certain types of connected vehicle data, except for specific purposes.”