Until last year, consumers buying a GM vehicle were encouraged to sign up for its Smart Driver program that would collect data on aspects like chosen traffic routes and trip duration.

Yet it also extracted information on the rate of acceleration, what speeds they might attempt a corner at, and how hard the brakes would be slammed. It even relayed information on whether they were taking their car on a late-night spin. That’s because this information was of particular value for insurers keen on better assessing the risk posed by their policyholders.

What many of these GM customers did not know, however, is the carmaker had been cashing in on the sale of their personal data to third parties, irrespective of whether it would be to the detriment of the carmaker’s unwitting customers, who believed it was for internal purposes only.

The feature has since been discontinued after the New York Times last March first uncovered the practice. The case highlights the risks to data privacy stemming from the lack of U.S. legislation equivalent to the GDPR law in Europe.

“With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance,” outgoing FTC chair Lina Khan said in a statement on Thursday.

In her final days before her Republican colleague Andrew Ferguson replaces her as chair, Khan has been busy, recently issuing a report targeting pharmacy benefit managers over price gouging.

GM handed total ban for five years—even in cases of explicit consent

GM pledged to obtain affirmative consent by its owners to collect, use, or disclose certain types of connected vehicle data for the next two decades.

But for the first five years, the carmaker was slapped with a total ban—even if God came down personally to give explicit consent, GM would not be allowed to pass on the Almighty’s data to a consumer reporting agency.

Moving forward, GM agreed furthermore to create a way for all U.S. consumers to request a copy of their data and, importantly, give them the means by which they could delete that information permanently. 

“Respecting our customers’ privacy and earning their trust is deeply important to us,” GM said in a statement on Thursday. “We’re more committed than ever to making our policies and controls clear and accessible.”

GM declined to comment further on the settlement deal. The FTC can issue such orders once it has sufficient reason to believe the law has been violated. Each violation can potentially result in a penalty of up to $51,744 under the civil law statute book.

GM would harvest driver data for sale in some cases every three seconds

Smart Driver was billed as a feature to promote safer driving, according to GM. The technology was used, however, to sell to third parties data related to consumer’s precise geolocation data and their driving behavior without their explicit consent—sometimes as often as every three seconds. 

Not only did its customers not share in the revenue from their loss of privacy, the FTC reported, but this practice led to unexpected increases in their insurance premiums for Smart Driver participants, as well as in some case the total loss of coverage. The reverse, however, is also true, as it could in theory help lower payments.

Last year, the feature was discontinued across all vehicles sold by GM group brands, with the company ending its business arrangement with Verisk Analytics and LexisNexis Risk Solutions. 

How damaging news of this settlement actually is for GM’s reputation is a matter up for debate. 

In Europe, a market GM has largely exited, consumer advocates like Austria’s Max Schrems have gone to court in an effort to prevent the exploitation of their data from the likes of Meta, Google, and Apple—successfully in two landmark cases.

By comparison, Americans have a reputation for being more relaxed about their data, since many see leaving their digital fingerprints everywhere as an opportunity to gain valuable services. The more a platform like Facebook knows a user, the more tailored an experience they get, complete with targeted ads for products and services users find relevant.