GM Banned by FTC for 5 Years Over Unauthorized Sale of Driver Data; Must Obtain Explicit Consent for 20 Years

On January 16, the U.S. Federal Trade Commission (FTC) announced a settlement with General Motors (GM) over its collection and sale of drivers’ location and behavioral data without user consent. Under the final order, GM is prohibited from sharing such data for five years and must obtain explicit user authorization before providing vehicle data to credit reporting agencies for the next 20 years. The company must also provide users with mechanisms to view and delete their data and allow them to disable location-sharing features. Exceptions apply in specific circumstances, such as emergency response or law enforcement, and any shared data must be de-identified. GM acknowledged that it previously failed to adequately inform users about how their data would be used in its OnStar and Smart Driver programs, which led to increased insurance premiums for some vehicle owners. While the settlement does not include a monetary fine, it underscores automakers’ responsibility to protect user privacy in the era of connected vehicles.