The FTC's General Motors Order: OnStar Smart Driver, Consumer Reporting Agencies and a Five-Year Ban

The Complaint's Account of Smart Driver

The Federal Trade Commission's complaint names three respondents, General Motors LLC, General Motors Holdings LLC and OnStar, LLC, all wholly owned by General Motors Company and alleged to operate as a common enterprise. It describes OnStar as a connected car service begun in 1996 and an enrollment process that took place at the dealership, on screens a consumer accepted or declined after buying or leasing a Chevrolet, GMC, Cadillac or Buick.

The complaint's account turns on the second screen. Until at least late April 2024, according to the complaint, it was titled "Enrollment Preferences (Smart Driver and Notifications opt-in)" and offered a single accept or decline choice covering two features: OnStar Smart Driver and safety and diagnostic alerts such as low tire pressure and oil change reminders. A consumer could not take one without the other. The third screen, a summary, listed "Notifications" but not Smart Driver. The complaint alleges that GM told dealers to describe Smart Driver as a vehicle-health notification, which it says the feature was not.

Smart Driver itself was presented, the complaint says, as a game-like tool for drivers to assess their own habits, with badges, streaks and driving insights. GM's consumer-facing text stated that participation "is not intended as an assessment of your compliance with driving laws or guidelines." The complaint calls that statement a false reassurance.

The complaint describes two data streams GM called tasks. "Task A" collected precise geolocation every three seconds from ignition on, with latitude and longitude intended to be precise to six decimal places, together with speed, heading, a timestamp, a trip identifier and, since at least 2019, the vehicle identification number. The complaint alleges GM expanded Task A from around 500,000 vehicles to approximately nine million, licensed the data to Wejo Ltd. from 2018 and then to Jacobs Engineering Group from January 3, 2024, and approved onward licensees using it for transportation planning, outdoor advertising analytics and retail and real estate location planning. "Task B" was enabled by Smart Driver enrollment and recorded driving events.

Sale to Consumer Reporting Agencies

Task B is where the complaint locates the consumer reporting allegations. In December 2016 GM amended an agreement with Insurance Services Office, Inc., doing business as Verisk Analytics, to create a Telematics Data Exchange Program and furnish Smart Driver enrollees' names, addresses and VINs with trip IDs, mileage, hard braking, acceleration and speed events over 80 mph. In August 2019 it contracted with LexisNexis Risk Solutions to furnish names, addresses, email addresses, VINs, timestamps and driving events including seat belt usage, hard acceleration, hard braking, ignition on and off, and speed over 80 mph. For LexisNexis, Wejo and Jacobs, the data included precise geolocation.

According to the complaint, both companies used the data to compile consumer reports typically covering six months of driving events, and LexisNexis reports listed each event by date and time. Many consumers discovered the reports only after receiving adverse action notices from insurers that denied or cancelled coverage or raised premiums. The complaint quotes one consumer telling a GM representative: "When I signed up for this, it was so OnStar could track me. They said nothing about reporting it to a third party."

GM ended its agreements with Verisk and LexisNexis in March 2024 and publicly stated that sharing with them ended on March 20, 2024. The complaint alleges that Task B data continued to go to Jacobs until April 5, 2024, which GM's April 2024 announcement did not disclose, and that GM fully sunset Smart Driver on June 26, 2024.

The legal theory is section 5 of the FTC Act, not the Fair Credit Reporting Act. Count I alleges an unfair practice in collecting precise geolocation and driver behavior data without reasonable steps to obtain affirmative express consent, and selling it to licensees and to consumer reporting agencies. Count II alleges a deceptive failure to disclose, against GM's representation that Smart Driver data was for the driver's own assessment, that the data was sold to consumer reporting agencies and used for insurance decisions. How the FCRA governs consumer reports themselves is covered in this publication's permissible purpose explainer.

The Order's Five-Year Disclosure Ban

Provision I of the Decision and Order provides that the respondents "must not disclose Covered Driver Data to any person when that person is acting in the capacity of a Consumer Reporting Agency, for five years from the entry of this Order." The order defines a consumer reporting agency as any person which, for monetary fees, dues or on a cooperative nonprofit basis, regularly assembles or evaluates consumer credit information or other information on consumers to furnish consumer reports to other parties.

Covered Driver Data is defined by origin and content. It is information collected from a GM-branded vehicle or a GM mobile app, or derived from it, that is either Location Data or one of a list of events linked or reasonably linkable to a U.S. consumer: radio listening data, hard braking, hard acceleration, hard cornering, crossing a designated high-speed threshold, seat belt usage or late-night driving, along with trip time and duration. A VIN, or an identifier that links back to one, makes data reasonably linkable. Location Data excludes coarse location such as a ZIP code or a census block with a radius of at least 1,850 feet, and data used only to generate coarse location and deleted within 48 hours.

The ban is time-limited and the consent requirement is not. In its letters to commenters, the Commission explained that the order bans sharing with consumer reporting agencies for five years and would then allow it only after GM obtains affirmative express consent. The Consumer Data Industry Association and the American Property Casualty Insurance Association asked the Commission to strike Provision I, the former arguing among other things that it deprives consumers of rights under the FCRA. The Commission declined, calling the ban appropriate given the alleged misrepresentations and stating that drivers can still send behavior data from smartphone apps and onboard devices directly to their insurers for usage-based insurance programs.

Consent, Access and Deletion Provisions

Most of the order runs for its full 20-year term and is built on one defined term. "Affirmative Express Consent" requires a freely given, specific, informed and unambiguous indication of agreement, following a clear and conspicuous disclosure of the categories of data, the specific purposes, the names or categories of third parties (with a linked, updated list of names if categories are used), and how to withdraw. The disclosure must be separate from any privacy policy, terms of service or similar document, and consent obtained through an interface that subverts or impairs user autonomy does not count.

• Provision II: within 180 days of the effective date, consent before collecting, using or disclosing Covered Driver Data to a third party, with a separate consent for each unrelated feature, and exceptions for emergency responders, consumer-initiated and vehicle safety communications, legal requests, deidentified research and development (excluding marketing), recalls and warranty work, and diagnostics
• Provision III: no degrading a product or service to penalize a consumer who withholds or withdraws consent, unless the data is technically necessary for that functionality
• Provision IV: collection limited to what is reasonably necessary for the specific purpose, with use, disclosure and retention tied to that purpose
• Provision V: a documented and published retention schedule for each type of Covered Driver Data within 180 days
• Provision VI: deletion of previously retained Covered Driver Data within 180 days, subject to listed exceptions, with an option to request consent within 90 days from consumers whose data was collected before the order
• Provision VII: a simple, easily located means for all U.S. consumers to request a copy of their Covered Driver Data and its deletion
• Provision VIII: requests to third parties that received Covered Driver Data to delete it, and no further sharing with any of them until they confirm receipt
• Provision IX: a way, such as an in-vehicle toggle, to disable collection of Location Data where the vehicle has the technology
• Provision X: a way to disable remote collection of all vehicle data by declining or ending OnStar enrollment, with limited exceptions for consumer-initiated and safety communications and over-the-air updates
• Provision XI: no misrepresentations about collection, use, disclosure or deletion of vehicle data or about consumers' controls over it

The remaining provisions are standard compliance machinery: acknowledgments, a sworn compliance report one year after issuance, 20 years of recordkeeping that includes records of each consumer's consent and the notice the consumer saw, and Commission monitoring. The order contains no provision requiring GM to pay money. The Commission's January 2025 release noted that each violation of a final consent order may result in a civil penalty of up to $51,744.

Status of the Order

The FTC's own documents chart the path from proposed to final. On January 16, 2025 the Commission announced a proposed order, stating that it voted 3-0-2 to accept the consent agreement for public comment, with Commissioners Holyoak and Ferguson recorded as absent. The Federal Register notice followed on January 30, 2025 at 90 FR 8528, with comments due by March 3, 2025. The analysis to aid public comment described the order as accepted subject to final approval.

The Commission received seven comments. It issued the final complaint and the Decision and Order on January 13, 2026, under Docket No. C-4828, and announced it on January 14, 2026. That release states that the Commission voted 2-0 to approve the final order and complaint; the final documents list Chairman Andrew N. Ferguson and Commissioner Mark R. Meador. The letters to commenters state that the order issued in final form without modification. Under Provision XVI the order is final and effective on publication on ftc.gov as a final order, and it terminates 20 years from issuance, subject to extension if the government files a complaint alleging a violation. The case page lists the status as Under Order.

In the Decision, GM neither admits nor denies the complaint's allegations except as to jurisdiction. The factual account above is therefore the Commission's allegation, not a finding against the company.

Where It Sits in the FTC's Location and Sensitive Data Cases

The January 2025 release described the matter as the FTC's first action related to connected vehicle data. It arrived at the end of a run of location data orders against data brokers. In January 2024 the Commission announced its order against X-Mode Social and Outlogic, describing it as its first settlement with a data broker over the collection and sale of sensitive location information. Orders against Gravy Analytics and Venntel and against Mobilewalla were finalized on January 14, 2025, two days before the GM proposal was announced.

The GM matter differs from at least the X-Mode case in where the data started. The X-Mode release describes a broker that collected location data through software in third-party apps, through its own apps and by buying it from other brokers. GM, according to the complaint, collected data from vehicles it manufactured, through an enrollment presented at GM-authorized dealerships, and the complaint's injury theory runs through insurance: consumer reports, adverse action notices and premiums. That is why the order's centerpiece is a ban keyed to consumer reporting agencies rather than to sensitive locations, and why it reaches radio listening data and late-night driving alongside geolocation.

The same conduct drew a state action. On May 8, 2026 the California Attorney General announced a $12.75 million settlement with GM under the California Consumer Privacy Act and the Unfair Competition Law, alleging that from 2020 to 2024 GM sold Californians' location and driving data to Verisk and LexisNexis and retained it in violation of the CCPA's purpose limitation and data minimization requirements. The release states that California drivers were not subject to increased premiums from the sales, likely because California insurance law bars insurers from using driving data to set rates. That settlement is placed in context in this publication's CCPA enforcement record. The federal order, by contrast, recovers nothing and regulates what GM may do with vehicle data until 2046.

Frequently Asked Questions