FTC Settles GM OnStar Data Case Over Unauthorized Geolocation Sales
FTC Order Bars GM and OnStar from Geolocation Data Sales Without Consent
The Federal Trade Commission finalized an enforcement order on January 14, 2026, settling allegations that General Motors and OnStar LLC collected, used, and sold consumers' precise geolocation and driving-behavior data without informed consent, according to the FTC. The order imposes a 20-year restriction on both companies' handling of driver location information and establishes new transparency and data-retention requirements.
Under the FTC's administrative action—issued under Section 5 of the FTC Act—GM and OnStar are now prohibited from collecting or using precise geolocation data and driving behavior information without consumers' "informed consent." The order mandates that the companies obtain affirmative express consent before deploying such data, a significant tightening of their previous practices. The FTC Press Release stated: "The order bars GM and OnStar from collecting or using precise geolocation data and driving behavior data without consumers' informed consent."
The FTC's enforcement action reflects broader scrutiny of connected vehicle platforms and AI-adjacent data practices that enable third-party data brokers and insurers to develop driver-risk products from sensitive location and behavioral datasets. The agency has cited the GM-OnStar case as part of its ongoing work to police privacy and data-security misconduct tied to connected vehicles, according to regulatory roundup materials from MS Law Group.
California Adds $12.75 Million Penalty Under CCPA
While the FTC order itself imposes no direct monetary penalty, GM and OnStar faced a related enforcement action at the state level. On May 8, 2026, California authorities announced a $12.75 million civil settlement with GM under the California Consumer Privacy Act (CCPA) over the same data practices, according to legal commentary. California alleged that GM sold drivers' location and behavioral data collected via OnStar to third-party data brokers without adequate notice or consumer consent.
The dual enforcement—federal and state—underscores the regulatory cost of unauthorized geolocation commerce in the connected vehicle sector. The FTC's 20-year order requires GM and OnStar to enhance incident reporting, data-retention protocols, and deletion practices, establishing a compliance framework that extends well into the 2040s.
What the Order Requires
Beyond the prohibition on collecting or using geolocation and driving-behavior data without informed consent, the FTC's order mandates:
• Transparency obligations for data collection practices
• Enhanced incident reporting for data breaches or misuse
• Data-retention limits to minimize storage of sensitive driver information
• Data deletion procedures to ensure consumer data is not retained indefinitely
The enforcement action reflects the FTC's growing focus on policing privacy abuses tied to vehicle connectivity and the monetization of driver behavioral data without clear consumer awareness or control.
