The policy authorizes use and disclosure of de-identified data for purposes not described in the privacy statement, states that reasonable re-identification prevention measures are applied and required of third parties, but does not specify what technical standards constitute adequate de-identification.
This analysis describes what General Motors's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that de-identified data falls outside the policy's stated use and disclosure limitations, and may be shared with third parties for unstated purposes, subject to a reasonable safeguard standard whose specific technical parameters are not defined in the document.
Interpretive note: The specific technical standard applied to de-identification is not defined in the document, making it difficult to assess whether the stated 'reasonable steps' standard satisfies the specific requirements of CCPA, CPRA, or other applicable state frameworks.
The updated statement narrowed its definition of personal information from 'identifies, relates to, or could reasonably be linked to you' to 'describes, relates to, or could reasonably be linked to you.' This language change affects which information GM must treat as personal information under the policy. The revised de-identification section reorganizes prior language, now stating GM 'may use technical measures to remove information that could reasonably identify you or your vehicle' and requires 'the same safeguards from any third parties we share it with.' The policy clarifies that its protections apply to personal information dealers disclose to GM, but do not cover dealers' independent data practices. Cruise is no longer listed as a GM affiliate exempt from this privacy statement, though the scope of privacy protections for Cruise users depends on whether Cruise now operates under this statement or maintains separate privacy terms.
View change record →The agreement establishes that data from which identifying information has been removed using technical measures is classified as de-identified, is not subject to the policy's personal information use restrictions, and may be used and disclosed for purposes not described in the privacy statement, with a stated but unspecified reasonable re-identification prevention standard.
Cross-platform context
See how other platforms handle De-identified Data Use and Third-Party Sharing and similar clauses.
Compare across platforms →"We may use technical measures to remove information that could reasonably identify you or your vehicle. We take reasonable steps to prevent this de-identified data from being re associated with you and require the same safeguards from any third parties we share it with. De-identified data is not Personal Information and may be used and disclosed for purposes not described in this Privacy Statement.Excerpt from General Motors's GM Privacy Statement
(1) REGULATORY LANDSCAPE: The de-identification framework engages CCPA and CPRA, which establish specific technical and administrative standards for de-identification, including a requirement that the business implement processes to prevent re-identification and publicly commit to not …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that de-identified data falls outside the policy's stated use and disclosure limitations, and may be shared with third parties for unstated purposes, subject to a reasonable safeguard standard whose specific technical parameters are not defined in the document.
The agreement establishes that data from which identifying information has been removed using technical measures is classified as de-identified, is not subject to the policy's personal information use restrictions, and may be used and disclosed for purposes not described in the privacy statement, with a stated but unspecified reasonable re-identification prevention standard.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by General Motors.