The FTC said its complaint alleged that “GM used a deceptive enrollment process to induce consumers to sign up for the OnStar connected vehicle service and the OnStar Smart Driver feature.” Lina Khan, who is in her final week as FTC chair, said that “GM monitored and sold precise geolocation data and information about people's driving habits, sometimes as often as every three seconds.”
Settlement not yet completely completed
The proposed settlement was approved in a closed meeting by the FTC's three Democrats, with the two Republicans recorded as absent. The pending agreement will be subject to public comment for 30 days after publication in the Federal Register, and a final FTC decision will be made under the Trump administration.
In addition to location data, the GM/FTC settlement also includes “radio listening data related to specific content, channel, or station; hard braking, hard acceleration, hard cornering, exceeding a designated high-speed threshold, use of seat belts, or late driving.” night driving; and travel time and duration for such events.” GM and OnStar agreed to delete data collected before the settlement and to require third parties to delete data previously shared with them.
GM “should also allow consumers to disable the collection of location data from their vehicles to the extent the vehicle is equipped with the necessary technology.”
GM issued a press release about the settlement. “Last year, we discontinued Smart Driver for all GM vehicles, de-enrolled all customers and ended our telematics relationships with LexisNexis and Verisk,” GM said. “In September, we consolidated many of our U.S. privacy statements into a single, simpler statement as part of our broader work to continue to raise the bar on privacy… As part of the agreement, GM will obtain affirmative consent from customers to collect, use or disclose certain types of connected vehicle data (with exceptions for certain purposes).”
No affirmative consent is required for purposes such as providing driver information to emergency responders, responding to customer-initiated communications, complying with government requests and legal requirements, and investigating product quality or safety issues. While the driving data sharing ban only lasts for five years, the overall settlement would be in effect for 20 years.
