We often hear stories about companies selling sensitive personal information, like location data, to the highest bidder. The latest offender seems to be General Motors.
The Federal Trade Commission claims that GM and OnStar, the subscription-based in-vehicle safety and security system, collected, used, and sold drivers’ detailed location data and driving behavior information from millions of vehicles without properly informing consumers and obtaining their consent.
On Thursday, the agency issued a proposed order to prevent the company from selling such data to consumer reporting agencies for five years.
According to the complaint, GM used a deceptive registration process to enroll consumers in OnStar. Some users were unaware that they signed up for OnStar’s Smart Driver feature, which aimed to utilize driving data for vehicle performance improvement and promoting safer driving.
FTC Chair Lina M. Khan stated, “GM tracked and sold individuals’ precise location data and driving behavior information, often as frequently as every three seconds.”
This is the latest problem faced by the car manufacturer after GM discontinued funding for its autonomous vehicle unit Cruise, in which GM has invested over $10 billion.
The settlement with the FTC comes after an investigation by The New York Times’ Kashmir Hill revealed that GM was gathering information about customers’ driving habits and selling it to insurance companies and third-party data brokers, resulting in higher insurance premiums for drivers without explanation.
The misuse of customer data extends beyond insurance costs. Location data can expose private details like home and work locations, medical visits, or religious practices, potentially endangering individuals like abortion seekers.
Under the proposed order, GM and OnStar would be prohibited from sharing data with consumer reporting agencies and must obtain explicit consent from consumers before collecting vehicle data in the future. Customers should also have the option to access and delete their data, as well as limit data collection from their vehicles.
The agreement is pending a 30-day public comment period before final approval by a court.
TechCrunch has contacted GM and the FTC for further information and will provide updates if available.
