Selling your data GM faces ban on selling driver data that can be used to raise insurance rates GM sold geolocation and other driving data without adequate consent, FTC says. Jon Brodkin Jan 17, 2025 1:51 pm | 44 OnStar and SOS buttons in a Chevrolet vehicle on May 3, 2024. Credit: Getty Images | Smith Collection/Gado OnStar and SOS buttons in a Chevrolet vehicle on May 3, 2024. Credit: Getty Images | Smith Collection/Gado Story textSizeSmallStandardLargeWidth *StandardWideLinksStandardOrange* Subscribers only Learn moreGeneral Motors and its subsidiary OnStar agreed to a settlement that prohibits them from sharing driver location and behavior data with third parties, the Federal Trade Commission announced yesterday. The proposed settlement comes less than a year after GM responded to public backlash by announcing that it stopped sharing driving data from its connected cars with companies such as LexisNexis.The FTC said it "is taking action against General Motors (GM) and OnStar over allegations they collected, used, and sold drivers' precise geolocation data and driving behavior information from millions of vehiclesdata that can be used to set insurance rateswithout adequately notifying consumers and obtaining their affirmative consent." GM did not admit to or deny the allegations.GM and OnStar "will be banned for five years from disclosing consumers' sensitive geolocation and driver behavior data to consumer reporting agencies," the FTC said. Under the settlement, "consumer reporting agency" means a firm that collects or evaluates "consumer credit information or other information on consumers for the purpose of furnishing consumer reports to other parties and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."A New York Times report last year described how the data sharing works. "After LexisNexis and Verisk [a data broker that works with the insurance industry] get data from consumers' cars, they sell information about how people are driving to insurance companies," the NYT report said. "To access it, the insurance companies must get consent from the driverssay, when they go out shopping for car insurance and sign off on boilerplate language that gives insurance companies the right to pull third-party reports."A pending class-action lawsuit against GM, OnStar, and LexisNexis alleges that the defendants deceived and harmed consumers.The FTC said its complaint alleged that "GM used a misleading enrollment process to get consumers to sign up for its OnStar connected vehicle service and the OnStar Smart Driver feature." Lina Khan, who is in her final week as FTC chair, said that "GM monitored and sold people's precise geolocation data and driver behavior information, sometimes as often as every three seconds."Settlement not quite finalizedThe proposed settlement was approved in a closed meeting by the FTC's three Democrats, with the two Republicans recorded as absent. The pending agreement will be subject to public comment for 30 days after publication in the Federal Register, and a final FTC decision will be made under the Trump administration.In addition to location data, the GM/FTC settlement covers "radio listening data regarding specific content, channel, or station; hard braking, hard acceleration, hard cornering, crossing of a designated high-speed threshold, seat belt usage, or late-night driving; and trip time and duration for such events." GM and OnStar agreed to delete data collected before the settlement and ask third parties to delete data previously shared with them.GM also "must allow consumers to disable the collection of Location Data from their Vehicles to the extent the Vehicle is equipped with the necessary technology."GM issued a press release on the settlement. "Last year, we discontinued Smart Driver across all GM vehicles, unenrolled all customers, and ended our third-party telematics relationships with LexisNexis and Verisk," GM said. "In September, we consolidated many of our US privacy statements into a single, simpler statement as part of our broader work to keep raising the bar on privacy... As part of the agreement, GM will obtain affirmative customer consent to collect, use, or disclose certain types of connected vehicle data (with exceptions for certain purposes)."Affirmative consent is not required for purposes such as providing driver data to emergency responders, responding to customer-initiated communications, complying with government requests and legal requirements, and investigating product quality or safety problems. While the ban on sharing driving data lasts only five years, the overall settlement would be in place for 20 years.Jon BrodkinSenior IT ReporterJon BrodkinSenior IT Reporter Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry. 44 Comments