The Federal Trade Commission (FTC) finalized an order Wednesday banning General Motors (GM) and its OnStar telematics service from sharing specific consumer data with consumer reporting agencies. This order, finalized a year after the proposed settlement with GM, mandates greater transparency from the automaker regarding data collection practices, requiring explicit consumer consent for any such activities.

The finalized order follows a New York Times report nearly two years prior, which detailed how GM and OnStar collected, used, and sold precise geolocation data and driving behavior to third-party data brokers, including LexisNexis and Verisk. This data originated from GM's Smart Driver program, a free feature within its connected car apps that monitored and rated driving behaviors and seatbelt usage. The New York Times reported that data brokers then sold this information to insurance providers, potentially impacting customers' insurance rates.

The core issue revolves around the use of artificial intelligence (AI) and machine learning (ML) algorithms to analyze driving data. These algorithms, trained on vast datasets of driver behavior, can predict risk profiles that are then used by insurance companies to adjust premiums. The FTC's action highlights growing concerns about the ethical implications of using AI-driven data analysis in ways that can disproportionately affect consumers without their explicit knowledge or consent.

GM discontinued the Smart Driver program across all its brands in April 2024, citing customer feedback. At that time, GM stated that it unenrolled all customers and terminated its third-party telematics relationships with LexisNexis and Verisk.

The FTC's order underscores the increasing scrutiny of data privacy practices in the automotive industry, particularly as vehicles become increasingly connected and generate vast amounts of data. The settlement requires GM to implement comprehensive data security safeguards and to provide clear and conspicuous disclosures to consumers about its data collection and sharing practices. This includes obtaining affirmative express consent before collecting and sharing sensitive information, such as geolocation data and driving behavior.

This case reflects a broader trend of regulatory bodies worldwide focusing on the responsible development and deployment of AI. The European Union's AI Act, for example, aims to regulate AI systems based on their potential risk to society, with strict rules for high-risk applications such as those used in autonomous vehicles and financial services.

The settlement with GM serves as a warning to other automakers and technology companies that collect and use consumer data. It emphasizes the importance of transparency, consumer consent, and data security in the age of AI-driven data collection. The FTC's action signals a commitment to protecting consumers from unfair or deceptive practices related to the use of their data, particularly when AI algorithms are involved in analyzing and utilizing that data. The long-term impact of this order will likely be a greater emphasis on data privacy and consumer control in the connected car ecosystem.