Overview
- Under the finalized order, GM and OnStar are barred from sharing certain consumer data with consumer reporting agencies for five years and must comply with broader privacy requirements for 20 years.
- GM must obtain explicit opt‑in consent before collecting, using, or sharing connected‑vehicle data, with consent obtained at the dealership when OnStar is linked to a vehicle’s VIN.
- The order requires U.S. consumers be able to request copies of their data, ask for deletion, and disable precise geolocation collection, which GM says it has already implemented.
- Limited exceptions allow sharing location data with emergency responders and using or sharing de‑identified data for internal research and projects with partners such as the University of Michigan.
- The action follows allegations that GM used a misleading enrollment process and failed to disclose third‑party sales of Smart Driver data to brokers including LexisNexis and Verisk; GM ended Smart Driver and those partnerships in April 2024.