WASHINGTON, D.C. — The Federal Trade Commission (FTC) announced today that General Motors (GM) will be banned for five years from disclosing consumers’ sensitive geolocation and driver behavior data to consumer reporting agencies. GM, absent receiving affirmative express consent, will also be required to delete the ill-gotten data, as well as instruct third-party recipients to do the same, among other remedies. The decision follows allegations that GM collected, used, and sold precise geolocation data and driving behavior information from millions of vehicles—data that can be used to set insurance rates—without adequately informing consumers or obtaining their consent.
Justin Brookman, director of technology policy at CR and a former policy director of FTC’s Office of Technology, Research, and Investigation said, “Secretly collecting and sharing driver location data is a terrible practice that can cause real harm to unsuspecting consumers. We are encouraged that the FTC is taking action under existing consumer protection law to put a stop to it. But because of ambiguity in the law, the best way to avoid these types of abuses in the future is a strong and clear comprehensive privacy law that restricts unwanted data sharing by default.”
CR delivered a petition in August 2024 to the FTC signed by nearly 30,000 CR members following a New York Times report that found several auto manufacturers, including GM, collected consumer driving behavior and surreptitiously shared it with data brokers who then shared it with insurance companies that subsequently used it for rate-setting purposes. The petition urged the FTC to investigate and hold these companies accountable for any unfair or deceptive practices that they may have engaged in. CR and the Electronic Privacy Information Center released model privacy legislation last year that, if adopted, would help mitigate the misuse of personal data.
Contact: Cyrus Rassool, cyrus.rassool@consumer.org