FTC banned GM from selling driver data, but the whole industry still collects it

Earlier this year, the US Federal Trade Commission handed General Motors an unusual punishment: a five-year prohibition on selling customer data to consumer reporting agencies and third-party data brokers. According to The Verge, which revisited the case in a recent column, that penalty is only the visible piece of a practice that spans the auto industry — and one that proposed legislation in Washington does little to stop.

How the GM data pipeline worked

The Verge reports that GM spent years logging details of how its customers drove — how often they exceeded speed limits, whether they were on the road late at night — and passing that information to two brokers, LexisNexis and Verisk, that serve the insurance industry. The brokers used it to build risk profiles of individual drivers.

Many owners had no idea. Enrollment often happened through an OnStar connected services plan, which switched on a Smart Driver feature that recorded the driving data. A 2024 investigation by The New York Times documented drivers whose insurance premiums rose as a result, and found the signup flow so confusing that people routinely did not know their driving habits were being shared at all.

Under the settlement, GM must make it simpler to turn off location tracking and give owners a way to access and delete the data the company holds on them.

Not just GM

A team of researchers at the Mozilla Foundation spent months reviewing the privacy policies of every major carmaker for a 2023 report. Their verdict, in the words of study co-author Jen Caltrider, was that every single one had "horrible privacy and security." Owners were also forced to accept layer upon layer of overlapping policies — covering the vehicle itself, its connected services, its smartphone app and the loan used to buy the car — each carrying its own data collection provisions.

Consumer Reports ran its own investigation and concluded that nearly every automaker selling cars in the United States collects and shares driver behavior data with outside companies, and continues to do so.

The Verge argues cars are a worse privacy problem than smartphones: a phone owner can usually locate and adjust privacy settings, whereas a vehicle's data collection is scattered across multiple systems and policy documents, leaving owners with almost no practical visibility into what is being recorded.

Washington weighs in, sideways

In December, according to The Verge, three House Republicans introduced the Data Rights for Information and Vehicle Electronics in Real-time, or DRIVER, Act. The bill is built on the principle that the person who owns a vehicle should own the data it produces — but it would still allow automakers to gather information and sell it to third-party brokers, which makes it unacceptable to privacy advocates. Caltrider's objection, as reported by The Verge, is that access and deletion rights are not the same as limits on collection: if a company can gather enormous amounts of data and leave the individual to discover what exists and request removal, the burden stays on the consumer.

The Trump administration has taken a different angle. In a July letter to Congress laying out priorities for the next surface transportation reauthorization bill, Transportation Secretary Sean Duffy floated a concept called "the Freedom Car" — the idea that Americans have a right to vehicles that are disconnected and free of automated driving systems. The proposal would bar the government from requiring cars to carry automation or wireless data capability, a requirement that, as The Verge points out, no one is currently trying to impose.

Why it matters

Whether either proposal survives Congress is unclear, but the underlying economics are not: as long as the broader data economy pays companies to collect and monetize information, automakers have every incentive to keep doing it. Meanwhile, The Verge notes genuine consumer demand for simpler cars — pointing to interest in stripped-down concepts like the Slate Truck and to Reddit users crowdsourcing a list of connected-car-free models from 2019 onward, a list that turns out to be remarkably short. For owners, the stakes are concrete: insurance pricing shaped by data they never knowingly shared, and a persistent record of location and driving habits that is difficult to audit, correct or switch off.

What owners can do now

Every automaker operates a privacy page where vehicle owners can submit requests, including opting out of data collection, though The Verge cautions that these pages are hidden behind dense legal boilerplate. The connected-car smartphone apps generally make adjusting privacy settings somewhat easier, so checking both is worth the effort.