General Motors recently faced a landmark FTC penalty for selling customer driving data, highlighting widespread privacy concerns as automakers routinely gather and share driver behavior information with third parties, often without clear consumer consent.
- GM banned from selling driver data to brokers for five years
- All major automakers have complex, overlapping privacy policies
- Lawmakers propose data ownership bill criticized by privacy advocates
What happened
This year, the Federal Trade Commission imposed a five-year ban on General Motors from selling customer driving data to consumer reporting agencies and third-party brokers. GM had been collecting detailed information such as speeding patterns and nighttime driving, then selling these behavioral insights to data brokers like LexisNexis and Verisk. Many drivers were unaware their data was being harvested extensively, often consenting unknowingly through OnStar connected services enrollment, which enabled features that gather driving habits.
A 2024 investigation by The New York Times revealed that these practices contributed to increased insurance costs for some drivers. The FTC settlement requires GM to simplify how customers can disable location tracking and give better access to their data for review or deletion. However, GM is not alone; research by the Mozilla Foundation and Consumer Reports found that nearly every major US automaker collects and shares driver data across multiple overlapping agreements and systems, making it difficult for consumers to fully understand or control their information.
Why it matters
The automotive industry’s collection of driver data raises profound privacy and transparency issues. Vehicles gather a wide array of personal data that extends beyond typical smartphone privacy settings, complicating consumers' ability to manage who accesses and uses their data. Unlike apps with intuitive controls, car data collection spans multiple platforms including the vehicle, connected services, mobile apps, and financing agreements—often with complex, conflicting policies.
There is growing public and regulatory scrutiny as these privacy gaps become more apparent. Data brokers use the information to profile drivers and adjust insurance rates, frequently without drivers' direct consent or even awareness. The stakes extend beyond privacy into fairness and consumer protection, prompting calls for stronger regulations that limit excessive data collection rather than just offering access and deletion options, which place an undue burden on individuals.
What to watch next
In December, House Republicans introduced the DRIVER Act aiming to reaffirm vehicle owners' rights over their vehicle-generated data. While this legislation would increase consumer control over data access and deletion, it still permits automakers to collect and sell data to third-party brokers, limiting its effectiveness according to privacy advocates. The debate continues over how best to balance innovation in connected car technology with consumer privacy rights.
Meanwhile, enforcement actions like the FTC’s penalty against GM may set precedents for future regulatory oversight. Consumers and advocacy groups will be monitoring how automakers comply with transparency and opt-out requirements. Continued investigative reporting and research by organizations like Mozilla and Consumer Reports will likely pressure lawmakers and regulators to develop more comprehensive protections that address the root cause of data overcollection in connected vehicles.