The FTC’s January 2026 final order against GM and its OnStar subsidiary marks the culmination of a long-running investigation into how connected vehicle data was collected, disclosed, and shared. The order resolves allegations that GM and OnStar collected and sold precise geolocation and driving behavior data without obtaining consumers’ express informed consent.

According to the FTC, consumers often did not understand that they were enrolled in data-collection programs or that their information would be shared with third parties, including consumer reporting agencies used by insurers.

Background and Path to the Final Order

Concerns about GM and OnStar’s data practices surfaced publicly well before the FTC acted, driven by consumer complaints, media coverage, and private litigation alleging surprise tracking and downstream insurance impacts. After investigating, the FTC issued a proposed complaint and consent order in January 2025, alleging violations of Section 5 of the FTC Act based on deceptive disclosures and unfair data collection practices.

Following the required public comment period, the FTC finalized the order on January 14, 2026, with the core injunctive provisions largely intact.

Key Requirements in the Final Order

The final order imposes extensive restrictions on GM and OnStar’s handling of connected vehicle data, including:

• A five-year prohibition on sharing geolocation and driving behavior data with consumer reporting agencies;
• A requirement that GM obtain affirmative express consent before collecting, using, or sharing covered vehicle data, subject to limited safety-related exceptions; and
• Obligations to provide consumers with access to their data, deletion rights, and meaningful opt-out mechanisms for certain data collection.

What This Means for Advertisers and Data-Driven Businesses

The GM/OnStar order underscores the FTC’s sustained focus on how sensitive data is collected and monetized, particularly where consumers are unlikely to anticipate downstream uses. Disclosures that technically exist but fail to convey the practical consequences of data sharing remain a core enforcement target. For companies that rely on connected devices, location data, or behavioral insights, the message is consistent with recent FTC actions: consent must be meaningful, choices must be real, and surprise may result in liability.