Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy establishes that precise geolocation and driver behavior information are subject to a specific retention schedule of up to 3 years from collection, with extensions permitted for legal or regulatory obligations, and that data is de-identified or disposed of when no longer needed for stated purposes.
This analysis describes what General Motors's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a documented retention baseline of up to 3 years for sensitive connected vehicle data categories, with an open-ended extension clause for legal or regulatory obligations that may result in retention beyond the stated period in circumstances not further specified in the excerpted text.
Interpretive note: The document excerpt was truncated before the full retention schedule table was reproduced, so the complete retention periods for all data categories listed in the schedule could not be confirmed from the provided text.
The updated statement narrowed its definition of personal information from 'identifies, relates to, or could reasonably be linked to you' to 'describes, relates to, or could reasonably be linked to you.' This language change affects which information GM must treat as personal information under the policy. The revised de-identification section reorganizes prior language, now stating GM 'may use technical measures to remove information that could reasonably identify you or your vehicle' and requires 'the same safeguards from any third parties we share it with.' The policy clarifies that its protections apply to personal information dealers disclose to GM, but do not cover dealers' independent data practices. Cruise is no longer listed as a GM affiliate exempt from this privacy statement, though the scope of privacy protections for Cruise users depends on whether Cruise now operates under this statement or maintains separate privacy terms.
View change record →The agreement establishes that precise geolocation and driver behavior data are retained for up to 3 years from collection, with retention extended as required by legal or regulatory obligations; data is stated to be de-identified or disposed of when it is no longer needed for the purposes described in the policy.
Cross-platform context
See how other platforms handle Connected Vehicle Data Retention Schedule and similar clauses.
Compare across platforms →Monitoring
General Motors has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may keep the Personal Information we collect for as long as necessary for the purposes described in this Privacy Statement. We will de-identify or dispose of the Personal Information we collect when we no longer need it for the uses described in this Privacy Statement. More detailed information about the retention of Precise Geolocation Information, Driver Behavior Information (including seatbelt information), and Radio Listening Information is provided below. Data may be retained for longer than the stated retention periods below if required to comply with legal or regulatory obligations.Excerpt from General Motors's GM Privacy Statement
(1) REGULATORY LANDSCAPE: Data retention periods for precise geolocation and driver behavior data engage state privacy law data minimization requirements, including California CPRA's requirement that personal information not be retained longer than necessary for its disclosed purpose. The open-ended legal obligation extension clause is a standard retention framework feature but creates compliance monitoring obligations to confirm that extensions are documented and justified. (2) GOVERNANCE EXPOSURE: Medium. A 3-year retention period for precise geolocation and driver behavior data is a specific and auditable commitment. The legal obligation extension clause is operationally common but should be governed by documented internal review processes to avoid indefinite retention under broadly construed legal hold rationales. (3) JURISDICTION FLAGS: California CPRA requires that retention periods be disclosed and tied to specific business purposes. Other state privacy laws with data minimization requirements may impose similar disclosure obligations. The 3-year retention baseline should be assessed against each applicable state's standards for sensitive personal information retention. (4) CONTRACT AND VENDOR IMPLICATIONS: Service providers who store or process precise geolocation or driver behavior data on GM's behalf should have contractual obligations reflecting the stated 3-year retention limit and the conditions under which extensions are permissible. Data processing agreements should specify deletion or de-identification timelines consistent with the policy. (5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that internal data governance processes enforce the 3-year retention limit for precise geolocation and driver behavior data and document the basis for any legal obligation extensions. De-identification processes applied at end of retention should be assessed to confirm they meet applicable standards for preventing re-identification, including the policy's stated commitment to take reasonable steps to prevent re-association.
This provision establishes a documented retention baseline of up to 3 years for sensitive connected vehicle data categories, with an open-ended extension clause for legal or regulatory obligations that may result in retention beyond the stated period in circumstances not further specified in the excerpted text.
The agreement establishes that precise geolocation and driver behavior data are retained for up to 3 years from collection, with retention extended as required by legal or regulatory obligations; data is stated to be de-identified or disposed of when it is no longer needed for the purposes described in the policy.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by General Motors.