Four days after 36 attorneys general announced a $220 million settlement with General Motors over driving data, Ford’s chief privacy officer published a pledge of her own: “We also never sell data about how you drive your vehicle to data brokers.” Kristin Jones, Ford’s chief privacy officer and deputy general counsel for data and privacy, posted the Ford Privacy Promise on Nov. 2 with a new privacy-settings website, and wrote that Ford is making “an explicit commitment to customers that their vehicle data is safe with us.”
The promise is real, and it is narrow. It covers one kind of data and one kind of buyer, and nothing in it is enforceable by a court. GM’s version of the same promise now is.
What Ford’s promise covers
The pledge names data brokers and data about how a driver drives. A FAQ on the same Ford page asks whether Ford sells that driving-behavior data to data brokers or insurance companies and answers no, so insurers are covered there even though the pledge sentence leaves them out.
Ford’s privacy policy is wider than the pledge. Its connected-vehicle section, effective July 1, 2026, defines Driving Data as information about how the vehicle is operated, such as speed, accelerator, brakes, steering and seat belts. The policy’s state-law disclosures say Ford may use personal data in ways that count as a “sale” and lists SiriusXM, joint marketing partners, authorized dealers, advertising and analytics companies and social media platforms as possible recipients. It also says Ford may disclose deidentified information, including connected-vehicle information, to others. In the sections I read, the policy does not say Driving Data goes to any of them.
Ford also says drivers can decline to share connected-vehicle data, and that doing so turns off BlueCruise, internet connectivity and in-app vehicle location. Settings live on the center display or in the Ford App, and Ford says vehicles from 2018 on should show them on the screen. Resources for Lincoln, Mexico and Canada are listed as coming in the following weeks.
What the states say GM did
According to Michigan Attorney General Dana Nessel’s office, GM enrolled millions of drivers in its Smart Driver program between 2016 and 2024 and said the data would not go to insurers without express consent. The coalition alleges GM instead sold driving and location data to data brokers under contracts that named insurance as the use, and that insurers used trip counts, hard braking, hard acceleration and speeding to help set premiums, sometimes raising them.
The attorneys general also allege that most enrollments happened at dealerships, where employees accepted the terms for customers. Minnesota’s release adds that staff were incentivized through bonuses and rankings, and that the OnStar app wrongly told 370,000 drivers they were not enrolled. GM later unenrolled them without disclosing the error, the states allege, and left their data with brokers and insurers. GM discontinued Smart Driver after a March 2024 New York Times report, according to the releases. Montana made a similar claim in its own lawsuit earlier this month.
The money goes to the states. Michigan’s share is $7,205,319 and Minnesota’s is $7,095,664, and the Michigan release says drivers receive no restitution. Under the consent decree, Michigan can spend its share on fees, investigation costs, enforcement and consumer education at the attorney general’s discretion. A nationwide private class action seeking money for drivers is still pending, according to the Michigan release. Our earlier coverage has the state-by-state numbers.
Why a decree and a pledge are different things
The decree was filed in the Ingham County Circuit Court in Michigan and takes effect Nov. 30, 2026. Its privacy program runs until Jan. 13, 2046. Separately, the FTC’s January final order, which the commission approved 2-0 on Jan. 14, runs 20 years and bars GM from sharing geolocation and driver-behavior data with consumer reporting agencies for five years. We covered that order when it came down.
The decree is specific about what counts as consent. Hovering, muting, closing a window, accepting general terms of use, silence and pre-ticked boxes do not count. The disclosure has to be separate from the privacy policy. GM must start an enrollment policy within 60 days that requires the customer’s own action, with no response in 10 days treated as a no. Dealership staff must be trained that they “must accept those disclosures themselves” before enrolling someone in OnStar, which is a direct answer to the allegation that employees clicked through for customers.
Two details cut the other way. The decree’s definition of covered driver data excludes data that has been deidentified after collection, and I found no flat ban on selling to consumer reporting agencies in it; that ban comes from the FTC order. The decree also requires that drivers can withhold or withdraw consent without losing product functionality as a penalty. Ford’s page says drivers who decline to share connected-vehicle data lose BlueCruise, connectivity and in-app location. That decree binds GM, not Ford, and no attorney general has alleged Ford did anything wrong with driving data.
What happens next
GM’s payment is due within 30 days of Nov. 30, its enrollment changes within 60 days, and its deletion of driver data retained before Jan. 16, 2025 within 180 days, with exceptions. Ford’s promise page lists no deadlines or penalties. Ford owners with a 2018 or newer car can open the privacy screen on the dash today. (For the Honda version of this story, see how Honda’s driver data ended up in an insurer-facing report.)
Have you opened your Ford’s privacy screen yet? Opting out costs you BlueCruise and connectivity, among other things. Did you switch anything off?