Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes collection of precise vehicle location data (defined as within a 1,850-foot radius) while a vehicle is in use and upon specified events, with a stated retention period of up to 3 years, and discloses that geolocation collection may continue even after OnStar disconnection under certain emergency or battery-safety conditions.
This analysis describes what General Motors's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a data collection practice tied to vehicle operation that persists under specified conditions even after a user takes affirmative steps to disconnect from OnStar or disable location services, creating a documented carve-out that compliance teams should assess against state-level precise geolocation consent requirements.
The updated statement narrowed its definition of personal information from 'identifies, relates to, or could reasonably be linked to you' to 'describes, relates to, or could reasonably be linked to you.' This language change affects which information GM must treat as personal information under the policy. The revised de-identification section reorganizes prior language, now stating GM 'may use technical measures to remove information that could reasonably identify you or your vehicle' and requires 'the same safeguards from any third parties we share it with.' The policy clarifies that its protections apply to personal information dealers disclose to GM, but do not cover dealers' independent data practices. Cruise is no longer listed as a GM affiliate exempt from this privacy statement, though the scope of privacy protections for Cruise users depends on whether Cruise now operates under this statement or maintains separate privacy terms.
View change record →The agreement establishes that precise geolocation data identifying vehicle location within a 1,850-foot radius may be collected during vehicle operation and retained for up to 3 years, and that collection may continue in defined emergency or battery-safety scenarios even after the user disables location services or disconnects from OnStar.
Cross-platform context
See how other platforms handle Precise Geolocation Collection and Retention and similar clauses.
Compare across platforms →Monitoring
General Motors has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may collect the location of the vehicle, including Precise Geolocation, while the vehicle is in use, upon the occurrence of certain events, and to deliver OnStar services as set forth in the OnStar Services Consent available here. Precise Geolocation is location information that identifies a location within a radius of 1850 feet. In limited circumstances GM may still collect Geolocation Information from a disconnected vehicle.Excerpt from General Motors's GM Privacy Statement
(1) REGULATORY LANDSCAPE: Precise geolocation collection engages the California Privacy Rights Act, which classifies precise geolocation as sensitive personal information subject to opt-out rights; Washington's My Health MY Data Act may apply where geolocation intersects with health-related inferences. The FTC has issued guidance on location data practices. Multiple state comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas) impose consent or opt-out requirements for precise geolocation processing. The document's carve-out permitting collection after user disconnection in emergency or battery-safety scenarios should be evaluated against each state's definition of permissible exceptions. (2) GOVERNANCE EXPOSURE: High. The combination of precise geolocation collection during vehicle operation, a 3-year retention period, continued collection after disconnection in defined circumstances, and potential disclosure to affiliates, service providers, and insurance partners creates layered compliance obligations across multiple state frameworks. The emergency and battery-safety carve-outs are operationally significant because they limit the effectiveness of user opt-out choices. (3) JURISDICTION FLAGS: California residents have specific opt-out and limitation rights under CPRA for sensitive personal information including precise geolocation. Washington State's My Health MY Data Act may apply where geolocation data is used to infer health conditions. Illinois does not currently have a standalone geolocation privacy statute but BIPA may be implicated if biometric identifiers are linked to location data. Heightened exposure exists in any jurisdiction that requires affirmative opt-in consent for precise geolocation rather than opt-out. (4) CONTRACT AND VENDOR IMPLICATIONS: Disclosure of precise geolocation to GM Financial, insurance partners, wireless connectivity providers, and fleet operators requires vendor agreements confirming data use limitations consistent with the policy's stated purposes. The policy states that service providers receiving this data do not have an independent right to use it, which should be verified in underlying data processing agreements. (5) COMPLIANCE CONSIDERATIONS: Legal teams should audit whether the emergency and battery-safety carve-outs for continued geolocation collection after disconnection are disclosed with sufficient specificity to satisfy state transparency requirements. Retention schedules for precise geolocation should be mapped against data minimization obligations in applicable state laws. Consent mechanisms for OnStar geolocation collection should be reviewed to confirm they satisfy applicable opt-in or opt-out standards by jurisdiction.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a data collection practice tied to vehicle operation that persists under specified conditions even after a user takes affirmative steps to disconnect from OnStar or disable location services, creating a documented carve-out that compliance teams should assess against state-level precise geolocation consent requirements.
The agreement establishes that precise geolocation data identifying vehicle location within a 1,850-foot radius may be collected during vehicle operation and retained for up to 3 years, and that collection may continue in defined emergency or battery-safety scenarios even after the user disables location services or disconnects from OnStar.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by General Motors.