FTC bars GM from selling driver behavior data to brokers for five years

The signup is where this was decided. A driver who wanted roadside assistance clicked through an OnStar connected services plan, and that enrollment turned on Smart Driver, which collected their driving data ^[3]. What the data described was how often they sped and whether they drove at night, and it went to brokers building risk profiles for insurance companies ^[2]. Teams tell themselves a checked box is consent. According to The Verge, most of these drivers did not know the degree to which they were being tracked ^[3].

The reading problem is structural. Mozilla Foundation researchers spent months on the privacy policies of every major car company and found each one had "horrible privacy and security," said Jen Caltrider, who helped write the 2023 study ^[7]. A buyer accepts four separate sets of terms with collection provisions in them: the car, the connected services, the smartphone app, and the financial services the loan came through ^[9][16]. "And so it was really overwhelming trying to understand what was going on," Caltrider said ^[8].

The Verge argues cars are worse than phones on this because a phone owner can find and tweak the privacy settings, while in a vehicle the collection is spread across multiple systems and policies ^[11]. Consumer Reports, in an investigation published last year, concluded that "nearly every automaker that sells cars in the U.S. is similarly collecting and sharing so-called 'driver behavior data' with other companies and continues to do so" ^[10]. No equivalent five-year ban applies to any of them ^[17].

GM's obligations under the settlement are two product changes: an easier way to turn location tracking off, and a route for drivers to access and delete what the automaker collected ^[6]. Both sit downstream of collection. Caltrider's point is that access and deletion rights are not the same thing as preventing excess collection in the first place ^[14]. The work of discovering and requesting falls to the person who never wanted the data taken.

Three House Republicans introduced the DRIVER Act last December, saying the bill "reaffirms a basic principle: if you own the vehicle, you should own the data it generates" ^[12]. It would give owners a bit more control and still allow automakers to gather the data and sell it to third-party data brokers ^[13]. That clause on broker sales is what privacy advocates call a nonstarter ^[13].

Before you ship an in-car data flow next quarter, ask whether the driver gets something back from it inside the vehicle. Then ask whether the driver could describe the flow in one sentence after reading the screen where they agreed. Crash detection passes both. The Smart Driver feed to LexisNexis and Verisk failed both ^[4], and the FTC's remedy only reaches the second one ^[6]. The design that follows is a separate, default-off switch for telemetry that leaves the car, and it costs enrollments: most drivers will decline, and the data product shrinks to the people who actually said yes.