"Tracking" vs. Reporting
I, too, work in the industry and feel we need to agree on certain definitions first, and then compare points. The issue with OnStar's Terms Of Service is not with "tracking" in the sense you use it. Instead, it is with "reporting." Yes, the GPS receiver in OnStar has to continuously determine its position for OnStar to offer the services you mention, but it does not need to continuously report position or even store it. So "track" as you use it really just means "know where I am" not "report where I am."
I believe the earlier and still current (until the new ones take effect) OnStar terms of service only provide for reporting location when an offered service is requested. The customer can request emergency service by pressing the OnStar button, which reports location. After the customer has notified police the vehicle is stolen, they can request OnStar report location to recover the vehicle. Most importantly to many people, when the airbag deploys or an impact is otherwise detected that suggests a collision, then OnStar will automatically make contact and report location. Note that none of these services involves recording or reporting location or other sensitive location or driving data on a routine basis.
That all changed with the new terms of service, which added permission with no further notice to the customer of routine reporting of driving data which can but may not necessarily include location: 1) vehicle-identifiable data that can be shared with third parties to provide various unspecified OnStar services; and 2) anonymous data for any use whatsoever. The most controversial change was 3) to continue reporting any of the data from #1 &/or #2 even after a consumer cancels the OnStar subscription, unless he or she additionally contacts OnStar and requests that the data link be cancelled.
As everyone following the news knows, OnStar retracted #3, but what many are missing is that both #1 and #2 are still in the terms of service scheduled to take effect January 1st. That's one point.
My last point is that #2 is getting some attention over whether data -- especially location data -- will adequately be made anonymous, but that many people are missing the real issues with #1. Those terms that allow vehicle-identified data to be shared with third parties to provide unspecified OnStar services with no further notice to customers or their permission is a door left wide open to potential abuse. Even if it doesn't include location data, would consumers agree to allow their vehicles' identifiable driving data to be provided to insurers for underwriting and rate-setting purposes?
I don't have any problem with a company requesting permission to collect customers' data for any legal purpose it likes, as long as the customers are explicitly told what data are involved, who will get it, how it will be used, and how it will be protected from mis-use. While OnStar may well take this approach, their new terms of service certainly do not require it. If they do plan to take the approach of explicitly asking permission, then they don't need terms of service in advance that don't require that behavior, and consumers shouldn't be required to accept such carte blanche terms.