The FTC said its complaint alleged that “GM used a misleading enrollment process to get consumers to sign up for its OnStar connected vehicle service and the OnStar Smart Driver feature.” Lina Khan, who is in her final week as FTC chair, said that “GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds.”

Settlement not quite finalized

The proposed settlement was approved in a closed meeting by the FTC’s three Democrats, with the two Republicans recorded as absent. The pending agreement will be subject to public comment for 30 days after publication in the Federal Register, and a final FTC decision will be made under the Trump administration.

In addition to location data, the GM/FTC settlement covers “radio listening data regarding specific content, channel, or station; hard braking, hard acceleration, hard cornering, crossing of a designated high-speed threshold, seat belt usage, or late-night driving; and trip time and duration for such events.” GM and OnStar agreed to delete data collected before the settlement and ask third parties to delete data previously shared with them.

GM also “must allow consumers to disable the collection of Location Data from their Vehicles to the extent the Vehicle is equipped with the necessary technology.”

GM issued a press release on the settlement. “Last year, we discontinued Smart Driver across all GM vehicles, unenrolled all customers, and ended our third-party telematics relationships with LexisNexis and Verisk,” GM said. “In September, we consolidated many of our US privacy statements into a single, simpler statement as part of our broader work to keep raising the bar on privacy… As part of the agreement, GM will obtain affirmative customer consent to collect, use, or disclose certain types of connected vehicle data (with exceptions for certain purposes).”

Affirmative consent is not required for purposes such as providing driver data to emergency responders, responding to customer-initiated communications, complying with government requests and legal requirements, and investigating product quality or safety problems. While the ban on sharing driving data lasts only five years, the overall settlement would be in place for 20 years.