On Wednesday, the Federal Trade Commission issued a final order prohibiting General Motors and its OnStar telematics service from sharing precise geolocation and driving behavior data with consumer reporting agencies. The action comes one year after the agency announced a proposed settlement and nearly two years after a New York Times investigation revealed that GM’s Smart Driver program sold detailed driver data to brokers LexisNexis and Verisk. The FTC characterized the prior enrollment process as misleading and determined that consumers were not clearly informed their data would be sold to third parties, potentially affecting insurance rates.

Under the finalized order, GM must obtain explicit, opt-in consent from each vehicle purchaser before collecting, using, or sharing connected-vehicle data. This consent process is to occur at the dealership when the consumer’s OnStar system is first linked to the vehicle’s VIN. The automaker is also required to simplify its privacy disclosures into a single, clear statement and to alert consumers of any data collection practices at least annually. GM confirmed it has already consolidated its U.S. privacy statements and expanded its customer portal to allow data access and deletion requests.

The FTC’s order carves out limited exceptions for data sharing: GM may continue to transmit location information to emergency first responders under E911 protocols and share anonymized, de-identified data with academic and municipal partners for internal research and urban-planning projects. GM cited collaborations with the University of Michigan to improve road safety as an example. The automaker must also implement a mechanism enabling all U.S. consumers to disable precise geolocation tracking in their vehicles and to request copies of any personal data GM holds.

By formally approving this settlement, the FTC has set a precedent for stricter oversight of connected-vehicle services, signaling to other automakers and telematics providers that transparent enrollment, explicit consent, and consumer control over data are non-negotiable. Investor attention is likely to focus on how competitors adapt their telematics programs and privacy policies in response. The order underscores the growing regulatory scrutiny around emerging vehicle connectivity technologies, with potential ripple effects on product development timelines and third-party data partnerships across the industry.