FTC Accuses GM of Selling Customer Location and Driving Data Without Consent

General Motors (GM) failed to inform customers that it tracked their precise locations and driving behavior and subsequently sold the data to third parties, the Federal Trade Commission (FTC) alleged in a proposed order issued Thursday.

GM, like many other automakers, offers internet connectivity in its vehicles. This capability allows car companies to collect extensive information about drivers, their habits, and the places they frequent. Federal regulations categorize such information as private, requiring individuals to give consent before sensitive data, including geolocation, can be gathered.

The FTC alleges that GM, through its internet-connected OnStar service, amassed vast amounts of customer data, such as instances of hard braking and speeding, and sold this information to credit reporting agencies. These agencies, in turn, made the data available to insurers. This case marks the FTC’s first enforcement action concerning privacy and data collection in the context of automobile connectivity.

GM allegedly assured millions of customers that the collected data would benefit them personally, enabling them to review and improve their driving habits. Contrary to these claims, the FTC stated, GM sold the data without obtaining customer consent. The agency further alleged that this practice led to increased insurance rates for some drivers, while others lost coverage altogether.

“GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,” said FTC Chair Lina Khan in a press release. “With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”

The FTC’s commission voted 3-2 in favor of the proposed order, with Commissioners Melissa Holyoak and Andrew Ferguson listed as absent.

Under the proposed order, which will be finalized after a 30-day public comment period, GM could face fines of up to $51,744 per violation. Additionally, the order would prohibit GM for five years from sharing geolocation or driver behavior data with third parties.

The FTC also stipulated that GM must implement policies to ensure customers are fully informed about any data collection practices. Only those who provide affirmative consent would have their data collected. GM would also be required to create tools allowing customers to toggle off data collection, access their collected data, or request its deletion.

By fLEXI tEAM