General Motors Tracked Millions of Drivers With Centimeter Precision
The U.S. Federal Trade Commission (FTC) has announced a settlement with General Motors (GM) and its subsidiary OnStar, requiring the automaker to stop sharing customers’ geolocation data with third parties, including data brokers, for five years. GM is also required to stop misleading consumers about the collection, use, and sharing of their data, and must obtain explicit consent before collecting information. The FTC has demanded that consumers be given a clear and transparent choice regarding the use of their data.
During its investigation, the agency found that flawed consent mechanisms forced customers to agree to data sharing, often without understanding the consequences. GM transmitted detailed location and driving behavior data, which was used to determine insurance premiums.
The complaint alleges that GM collected customers’ geolocation data with an accuracy of up to 11.5 centimeters every three seconds and shared route information for 9 million people. The data included time, speed, direction, and trip identifiers, making it possible to track the routes of specific vehicles.
Since 2016, GM has sold this data to brokers, including Verisk Analytics and LexisNexis Risk Solutions, who used the information to create consumer reports. These reports included details about hard braking, speeding, seat belt usage, and other driving behaviors.
Some customers only learned about the data collection after their insurance policies were canceled or their premiums unexpectedly increased. The FTC states that GM’s privacy policy was not transparent enough, and its 2024 updates—made after a series of media reports—did not fully disclose the extent of data usage.
The FTC also noted that opting out of data sharing with GM resulted in the loss of critical services, such as automatic emergency calls. This forced consumers to accept the terms of the OnStar Smart Driver program, even if they did not want to participate.
Under the proposed settlement, GM must give customers the ability to delete their data, obtain copies of their information, and limit the collection of geolocation data. The company will need to develop mechanisms that allow customers to disable precise location tracking and opt out of driving behavior monitoring. Experts believe this decision sends a strong message to the entire automotive industry about the need for strict privacy compliance.
It’s worth noting that in May, the FTC warned automakers that it is closely monitoring the collection and sale of customer data. The commission highlighted possible actions that could be taken against automakers for sharing sensitive data with advertisers, with particular attention to the sale of geolocation data and the “covert disclosure of confidential information.”
Additionally, Texas Attorney General Ken Paxton filed a lawsuit against GM in August 2024, accusing the company of violating state privacy laws. According to Paxton, the automaker deliberately misrepresented its data collection practices, encouraging customers to sign up for services that secretly collected and sold car owners’ personal data to third parties. The lawsuit was filed just weeks after Paxton announced an investigation into several automakers, including GM, regarding how they handle the vast amounts of data collected by connected vehicles.
Source