The Federal Trade Commission (FTC) has reached a settlement with General Motors (GM) regarding the automaker’s unauthorized collection and sale of drivers’ personal data. This settlement arises from a New York Times investigation that revealed GM’s practice of gathering granular details about its customers’ driving habits, including acceleration, braking patterns, and trip distances, through its OnStar connected vehicle service and Smart Driver feature. This data was subsequently sold to insurance companies and data brokers like LexisNexis and Verisk, leading to unexpected increases in insurance premiums for unsuspecting vehicle owners. The FTC accused GM of deceptive practices, alleging that the company failed to adequately inform customers about the data collection and never obtained their consent to share this sensitive information with third parties. This settlement marks a significant victory for consumer privacy rights, establishing a precedent for data protection in the burgeoning connected vehicle industry.
The crux of the issue lies in GM’s misleading enrollment process for the OnStar connected vehicle service and its associated Smart Driver feature. While OnStar primarily focuses on safety and security services like emergency assistance and vehicle diagnostics, the Smart Driver program was designed to monitor driving behaviors and offer personalized feedback for improved fuel efficiency and safer driving practices. However, GM failed to transparently disclose the extent of data collection associated with these features. Customers were led to believe that data collected through OnStar was primarily used for the provision of the advertised services, unaware that their driving habits were being meticulously recorded and subsequently sold. This lack of transparency created a significant breach of trust between GM and its customers, who were unknowingly subjected to invasive data collection practices without their informed consent.
The New York Times investigation brought this practice to light, highlighting the experiences of several GM customers who were surprised and angered by the unexpected rise in their insurance premiums. One customer, quoted in the article, expressed frustration with GM’s undisclosed data sharing, emphasizing the direct financial impact: “I pay you, now you’re making me pay more to my insurance company.” This statement encapsulates the core issue of the case: GM profited from the sale of customer data while simultaneously contributing to increased costs for those same customers. The investigation prompted public outrage and spurred the FTC to investigate GM’s data handling practices, ultimately leading to the settlement.
The FTC’s intervention and the resulting settlement represent a crucial step towards protecting consumer privacy in the context of connected vehicles. FTC Chair Lina Khan’s statement underscores the severity of GM’s actions, characterizing them as “unchecked surveillance.” The collection of highly precise geolocation and driving behavior data, sometimes as frequently as every three seconds, paints a picture of extensive and intrusive monitoring. The FTC’s action aims to curb such practices, establishing a clear message that companies cannot surreptitiously collect and monetize sensitive personal data without the explicit and informed consent of their customers.
The terms of the settlement impose significant restrictions on GM’s data collection and handling practices moving forward. Crucially, the settlement mandates that GM obtain explicit consent from customers before collecting any driving behavior data. This requirement shifts the power dynamic, ensuring that customers have agency over their own data and are not subject to passive data collection without their knowledge. Further, the settlement grants customers the right to access and delete their collected data, empowering them to control the information held by GM. These provisions mark a critical victory for consumer privacy rights, establishing important safeguards against unauthorized data collection and use.
This settlement serves as a pivotal precedent for the connected vehicle industry. As vehicles become increasingly connected and data-driven, the potential for privacy violations grows exponentially. The FTC’s action against GM establishes a clear standard for data protection in this evolving landscape, emphasizing the importance of transparency and informed consent. It sends a strong signal to other automakers and connected vehicle service providers that surreptitious data collection and sharing will not be tolerated. The settlement reinforces the principle that individuals have a right to control their personal data, particularly sensitive information like location and driving behavior, and that companies must respect these rights by implementing responsible data handling practices. This case marks a significant milestone in the ongoing struggle to balance the benefits of connected vehicle technologies with the fundamental right to privacy.
