Safa Marwah
In a significant move addressing escalating concerns over digital privacy within the automotive sector, the U.S. Federal Trade Commission (FTC) has finalized a stringent directive against General Motors (GM) and its telematics subsidiary, OnStar. This landmark regulatory action stems from allegations that the automotive giant systematically gathered and commercialized sensitive geolocation and driving behavior insights from millions of vehicle owners without obtaining explicit consent, a practice that subsequently impacted consumers through inflated insurance premiums and coverage denials.
The resolution, formally approved by the commission, prohibits GM from sharing specific consumer data with consumer reporting agencies for an initial period of five years, and institutes comprehensive mandates for two decades, fundamentally reshaping how the company must approach driver data collection and utilization. This ruling underscores a growing global scrutiny of data practices in connected vehicles, positioning the FTC’s intervention as a critical precedent for an industry increasingly reliant on data monetization.
The Genesis of the Dispute: Unconsented Data Harvesting
At the heart of the FTC’s action was the revelation of GM’s data collection via OnStar’s "Smart Driver" feature, a service that, while ostensibly marketed as a tool for drivers to self-assess and improve their habits, secretly functioned as a sophisticated data extraction mechanism. Through this feature, GM collected granular details, including precise geolocation coordinates and intricate driving behavior patterns, from millions of vehicles. The frequency of this data capture — reported to be every three seconds — highlights the invasive nature of the collection, building comprehensive profiles of individual driving styles and daily routines.
General Motors, a global automotive behemoth, oversees iconic brands such as GMC, Cadillac, Chevrolet, and Buick, producing in excess of 6.1 million vehicles annually. Its subsidiary, OnStar, has long been a pioneering force in in-car digital services, offering a suite of functionalities spanning navigation, communication, security, emergency assistance, and remote diagnostics. However, the integration of the "Smart Driver" feature transformed this convenience into a conduit for unconsented data aggregation, blurring the lines between value-added service and surreptitious surveillance. The core of the FTC’s January 2025 complaint centered on the fundamental lack of transparent and explicit consumer consent for these extensive data collection activities.
The Commercialization of Personal Mobility: A Lucrative yet Controversial Practice
The data acquired through the "Smart Driver" program was not merely collected; it was systematically sold to a network of third parties, primarily consumer reporting agencies. These agencies, acting as intermediaries, then supplied the detailed driver profiles to insurance companies. The ramifications for consumers were immediate and tangible: individuals found themselves facing unexpectedly higher insurance rates or, in some cases, outright denial of coverage, all based on data they were unaware was being collected and shared.
This commercial exploitation of personal mobility data raises profound ethical and legal questions. Consumers, in purchasing a vehicle equipped with modern telematics, often do not anticipate that their daily commutes and travel patterns will be quantified, analyzed, and monetized in ways that directly impact their financial well-being. The opacity surrounding these practices represents a significant breach of trust, eroding the implicit contract between consumers and manufacturers regarding personal data stewardship. The lack of informed consent transforms a utility feature into a liability, where the very act of driving can lead to adverse financial consequences without the driver’s knowledge or approval.
The FTC’s Definitive Response: A Framework for Data Governance
The FTC’s finalized order introduces a robust framework designed to curtail such practices and re-establish consumer control over their automotive data. The most immediate and impactful measure is the five-year prohibition against GM sharing consumers’ geolocation and driver behavior data with consumer reporting agencies. This specific ban directly addresses the most egregious aspect of the prior conduct—the weaponization of driving data for insurance purposes without explicit consent.
Beyond this initial five-year restriction, the order imposes several far-reaching requirements for a comprehensive 20-year duration, signaling a long-term commitment to data privacy. Foremost among these is the mandate that GM must obtain explicit, affirmative consent from consumers before collecting, utilizing, or sharing their connected vehicle data. While exceptions are permitted for emergency services, this provision fundamentally shifts the burden of proof to the company, requiring clear communication and demonstrable agreement from the consumer.
Furthermore, the order empowers U.S. consumers with critical data rights, aligning with principles seen in broader privacy regulations like the GDPR and CCPA. GM is now obligated to provide vehicle owners with the ability to request copies of their collected data, fostering transparency, and crucially, to seek its deletion. This right to access and erasure is complemented by the requirement to enable vehicle owners to disable precise geolocation data collection and to opt out of broader location and driving behavior data collection, albeit with limited exceptions for essential vehicle functions.
The FTC’s public statement regarding the order underscored the gravity of GM’s actions, declaring that "This fencing-in relief is appropriate given GM’s egregious betrayal of consumers’ trust." This strong language reflects the commission’s view that GM’s practices were not merely a technical oversight but a deliberate disregard for consumer privacy, necessitating stringent, preventative measures to safeguard future conduct.
Industry Reaction and the Broader Implications
In response to reaching the settlement agreement with the FTC, General Motors issued a statement acknowledging the regulatory intervention. The company emphasized that the consent order includes "new measures that go above and beyond existing law," while also noting that it captures "steps we’ve already taken to establish choices for customer data collection and communications about how the information is used." GM further stated its commitment to enhanced transparency and control for customers, including the expansion of a privacy program to offer data access and deletion options to customers across all 50 states. This response, while acknowledging the regulatory pressure, attempts to frame the changes as an evolution of existing privacy commitments rather than a forced overhaul.
The FTC’s action against GM is not an isolated incident but rather a significant marker in an evolving landscape of data privacy concerns surrounding connected vehicles. Modern automobiles are increasingly sophisticated data hubs, equipped with a myriad of sensors and connectivity features that generate vast quantities of information. From telematics systems that monitor engine performance and driving habits to infotainment units that track user preferences and locations, the "car as a data center" paradigm presents both unprecedented opportunities for innovation and substantial risks to personal privacy.
Indeed, the automotive industry has been grappling with similar accusations from various angles. Approximately one year prior to the GM settlement, in January 2025, the Texas Attorney General, Ken Paxton, initiated a lawsuit against the car insurance giant Allstate. This lawsuit alleged the unlawful collection and sale of driving data from over 45 million Americans. The tracking in this instance was reportedly facilitated by an SDK (Software Development Kit) developed by Allstate’s subsidiary, Arity, which was integrated into popular mobile applications such as Life360, GasBuddy, Fuel Rewards, and Routely, again without explicit driver consent. Alarmingly, this lawsuit also implicated several prominent car manufacturers, including Toyota, Lexus, Mazda, Chrysler, Jeep, Dodge, Fiat, Maserati, and Ram, for allegedly directly collecting and selling data to Allstate and Arity. These parallel legal actions underscore a systemic issue within the industry, where the monetization of driver data has become a widespread, albeit often clandestine, business model.
Challenges and the Path Forward: Balancing Innovation and Privacy
The FTC’s ruling against GM sets a powerful precedent, signaling that regulatory bodies are prepared to take decisive action against automotive manufacturers who prioritize data monetization over consumer privacy. This move is likely to compel other carmakers and technology providers within the connected vehicle ecosystem to re-evaluate their data collection, usage, and sharing policies. The emphasis on express consent, data access, and deletion rights will likely become a baseline expectation across the industry.
However, the challenge of balancing technological innovation with robust privacy protections remains complex. As vehicles become more autonomous, more connected, and more integrated into smart city infrastructures, the volume and sensitivity of the data they generate will only increase. Future discussions will need to address how data generated by advanced driver-assistance systems (ADAS), in-cabin monitoring, and vehicle-to-everything (V2X) communication systems are handled. The question of who owns this data, who can access it, and under what conditions it can be used will continue to be a focal point for regulators, policymakers, and consumer advocates.
The increasing complexity of data flows in connected vehicles also highlights the need for clearer, more standardized consent mechanisms. Current "terms and conditions" often lack the transparency and user-friendliness required for informed consent, leading to situations where users unwittingly agree to extensive data collection. The automotive industry, in collaboration with regulatory bodies, must develop intuitive and unambiguous methods for consumers to understand and control their data preferences.
This landmark decision by the FTC is a critical step towards establishing greater accountability and transparency in the realm of connected vehicle data. It serves as a stern reminder to manufacturers that the immense value derived from consumer data must be ethically sourced and responsibly managed. As the digital transformation of transportation continues, the imperative to protect individual privacy will remain paramount, shaping the future of automotive design, service provision, and regulatory oversight.
Ridwan Kamil
Aura Kasih
Lisa Mariana
Ayu Aulia