The U.S. Federal Trade Commission (FTC) has finalized a settlement with General Motors (GM) and its OnStar subsidiary over allegations that the two companies collected and sold location and driving behavior data from millions of drivers without their explicit consent, turning cars into tools for the mass collection of personal information.
OnStar and the connected vehicle ecosystem
General Motors, which includes iconic brands such as GMC, Cadillac, Chevrolet and Buick, produces more than 6.1 million vehicles annually. OnStar, a GM subsidiary, is the group's digital arm , offering navigation , communication, safety, remote diagnostics and emergency notification services
It is precisely this technological interface, which promises convenience and security, that was at the center of the FTC investigation, revealing the dark side of "smart" functions.
See also: Apple Maps: Searching for locations becomes easier in iOS 26
The Smart Driver program and invisible data collection
According to the complaint filed by the FTC in January 2025, GM used OnStar’s “Smart Driver” feature to collect extremely precise geographic location and detailed driving behavior data — every three seconds. The feature was presented to users as a tool for self-assessing their driving habits, without making it clear that the data was being used commercially.
The crucial element, according to the FTC, is that this collection was done without meaningful and informed consent from consumers.
From cars to insurance companies
The data collected did not stay within GM. Instead, it was sold to third parties, including consumer reporting agencies. They, in turn, provided it to insurance companies, who used it to price policies.
The result? Higher insurance premiums or even denial of insurance coverage for drivers, without them knowing that their own movements were working against them.
See also: FTC: Illuminate ordered to delete student data
What the FTC order provides
The FTC’s final order places strict restrictions on GM. For the next five years, it is expressly prohibited from sharing location and driving behavior data with consumer reporting agencies. At the same time, for the entire 20-year term of the order, GM is required to obtain explicit consent before any collection, use or sharing of connected vehicle data — except in emergency situations.
Additionally, consumers gain the right to access their data, the ability to delete it, the option to disable precise geolocation tracking, and the right to opt out of the collection of driving behavior data.
"A flagrant betrayal of trust"
The FTC's language was particularly harsh. It said the measures were necessary because of GM's "blatant betrayal of consumer trust." The company argued that the order went beyond existing law and said it had already begun initiatives to provide greater transparency and control for consumers.
GM also announced the expansion of its privacy program to all U.S. states, giving customers rights to access and delete personal data.
See also: 21 states join FTC lawsuit against Uber
A wider data scandal in the automotive industry
The GM case is not an isolated one. In January 2025, Texas Attorney General Ken Paxtonfiled a lawsuit against Allstate for illegally collecting and selling the driving data of 45 million Americans. The tracking was done through an SDK embedded in popular apps like Life360 and GasBuddy.
The same lawsuit also involves major car manufacturers, including Toyota, Lexus, Mazda, Chrysler, Jeep and Ram, indicating that the issue of privacy in vehicles is now a systemic problem.
The era of “smart” cars undoubtedly brings innovation — but as the GM case shows, without strict rules and transparency, the technology can easily turn into a tool of invisible surveillance.
Source: www.bleepingcomputer.com
