Your Car Was Watching You. Now the FTC Is Watching GM.

The FTC's landmark order against GM and OnStar bans driver data sharing and mandates consent across connected vehicles

9 Apr 2026

The Federal Trade Commission has finalised an enforcement order against General Motors and its telematics unit OnStar, marking the first time a US federal regulator has taken direct action against connected vehicle data practices. The order, issued on 14 January 2026, sets binding compliance requirements that apply for up to two decades.

The case centred on GM's Smart Driver programme, which collected driver behaviour data, including speed, braking, and seatbelt use, at intervals as frequent as every three seconds. That data was sold to brokers, who supplied it to insurance companies. Consumers reported discovering the arrangement only after their premiums increased or their policies were cancelled.

The FTC found that GM had bundled consent for data monetisation within the same enrolment flow used for routine safety and maintenance alerts. The agency ruled this violated Section 5 of the FTC Act, which prohibits unfair or deceptive trade practices.

Under the final order, GM and OnStar are prohibited from sharing geolocation and driving behaviour data with consumer reporting agencies for five years. Over a 20-year period, GM must obtain clear, standalone consent before collecting or sharing any connected vehicle data; grant all US drivers rights to access and delete their information; and allow location tracking to be disabled without affecting other services. All previously retained driver data must be destroyed within 180 days. No financial penalty was imposed.

GM discontinued the Smart Driver programme in April 2024. The company confirmed that OnStar services continue to function regardless of whether a customer consents to data collection, and said it remained committed to customer privacy.

The order arrives as software-defined vehicles generate growing volumes of sensitive telematics data, creating new questions about who owns that data, how it is used, and what disclosure standards should apply. The FTC's action offers the clearest federal signal yet that opaque data monetisation, absent transparent consent, carries regulatory risk. Whether other agencies or Congress will move to establish broader statutory standards for connected vehicle data remains unresolved.