FTC bans GM from selling driver data, but the industry keeps doing it

Earlier this year the Federal Trade Commission issued what The Verge's newsletter The Stepback calls an unprecedented penalty against General Motors: a five year ban on selling customer data to consumer reporting agencies and third party data brokers. GM had been collecting details such as how often customers sped or drove at night, often through drivers who had unknowingly signed up for OnStar's connected services and its Smart Driver feature. GM then shared that data with two brokers, LexisNexis and Verisk, both of which work with insurers to build risk profiles. A 2024 investigative report by The New York Times found that some drivers said their insurance rates rose as a result, and that the enrollment process was confusing enough that many owners never realized their data was being shared. Under the settlement, GM must make it easier for drivers to turn off location tracking and must let them access and delete the data it has collected on them.

GM is not an outlier. A team of researchers from the Mozilla Foundation spent months in 2023 examining the privacy policies of every major car company for a report, and concluded, in the words of researcher Jen Caltrider, who helped author the study, that every single one had "horrible privacy and security." Caltrider said customers were forced to accept overlapping policies covering the car itself, its connected services, the smartphone app and the financial services behind the loan, each with its own data collection provisions. "And so it was really overwhelming trying to understand what was going on," she said. Consumer Reports reached a similar conclusion in its own investigation, finding that nearly every automaker selling cars in the US collects and shares so called driver behavior data with other companies and continues to do so.

Congress has two competing responses in play, and the column argues neither actually addresses the underlying collection. Last December, a trio of unnamed House Republicans introduced the Data Rights for Information and Vehicle Electronics in Real time Act, or DRIVER Act, arguing that if you own the vehicle, you should own the data it generates. But while the bill would give owners more control over their own data, including access and deletion rights, it would still let automakers keep gathering and selling it to brokers, which is why privacy advocates like Caltrider call access and deletion rights no substitute for simply not collecting so much data in the first place. Separately, last July, Transportation Secretary Sean Duffy sent Congress a letter on transportation reauthorization priorities that included a concept he called the Freedom Car, describing it as Americans' right to drive disconnected and non-automated vehicles. That proposal would only bar the government from requiring vehicles to carry automated driving systems or wireless data transmission, something the column's author notes no one appears to be pushing for anyway.

The piece closes by pointing to consumer demand for simpler, less connected vehicles, citing interest in stripped down models like the Slate Truck and Reddit threads crowdsourcing short lists of cars from 2019 onward that do not transmit data to the manufacturer. It also notes irritants beyond data collection itself, such as ads appearing on BMW's in car screens and license plate readers like Flock cameras tracking movement on public roads. Its conclusion is that as long as the broader data economy rewards companies for gathering and monetizing information, automakers have little incentive to stop.

Key facts

• The FTC banned GM for five years from selling customer driving data to consumer reporting agencies and third party brokers, after GM shared OnStar Smart Driver data with LexisNexis and Verisk for insurance risk profiles.
• A 2024 New York Times investigation found some drivers' insurance rates rose because of data GM sold, often without drivers realizing they had consented to the sharing.
• A 2023 Mozilla Foundation study of every major automaker's privacy policies concluded all of them had "horrible privacy and security," per researcher Jen Caltrider; Consumer Reports independently found nearly every US automaker collects and shares driver behavior data.
• The DRIVER Act, introduced in Congress last December, would give owners access to and deletion rights over their data but would still let automakers collect and sell it to brokers.
• Transportation Secretary Sean Duffy's separate "Freedom Car" proposal, outlined in a July letter to Congress, would only bar government mandates for automated or wirelessly connected vehicles, not the underlying data collection.

Why it matters

The FTC's GM settlement is the first concrete penalty in a practice researchers say is industry wide: cars have quietly become one of the most heavily instrumented consumer devices, feeding an insurance and data broker economy that most owners never agreed to knowingly. It puts a regulatory marker down, but on its own it changes the behavior of exactly one company.

Who it affects

Anyone who owns a connected vehicle, especially GM owners enrolled in OnStar's Smart Driver feature, and by extension anyone whose insurance premiums are set using driving behavior data bought from automakers. The Mozilla Foundation and Consumer Reports findings suggest the exposure extends to customers of nearly every major carmaker, not just GM.

How to use it

Every automaker maintains its own privacy page where owners can request to see, limit or delete collected data, though the column notes these are typically buried in dense legal language. Privacy settings inside a connected car's companion smartphone app are generally easier to find and adjust than settings on the vehicle or through the automaker's main portal.

How solid is it

The account rests on a named FTC settlement, a 2024 New York Times investigation, a 2023 Mozilla Foundation study naming researcher Jen Caltrider, and a separate Consumer Reports investigation, all cited directly. The source does not give the exact date or dollar amount of the FTC penalty, does not name the House Republicans behind the DRIVER Act, and does not state how many automakers the Mozilla and Consumer Reports studies covered beyond GM and BMW.

Risks and caveats

The DRIVER Act now before Congress and the Freedom Car concept from the Transportation Secretary's letter both leave the core practice intact: the DRIVER Act adds access and deletion rights but does not limit collection, and the Freedom Car proposal only blocks mandates for automated or connected vehicles, something the article's author notes nobody is actually proposing. The DRIVER Act has not cleared Congress, and it is unclear whether either will become policy.

“horrible privacy and security”

— Jen Caltrider, Mozilla Foundation researcher