General Motors data collection and sharing controversy

General Motors (GM) has been collecting and monetizing driving data from millions of internet connected vehicles since 2015. Through its OnStar system and vehicle telematics, GM gathers comprehensive data about drivers, including trip details, driving behavior, and real-time location information. These data collection practices have been marketed to drivers as features for safety and convenience. GM now faces legal and regulatory scrutiny alleging that the practices are potentially deceptive, and that consumers were given inadequate disclosure.

GM has shared driving data from over 14 million vehicles (including 1.8 million in Texas alone) with commercial data brokers like LexisNexis and Verisk, who analyze it to create "driving scores" that are sold to insurance companies. These scores have reportedly led to increased insurance premiums and coverage denials for consumers who were unaware their data were being collected and sold. Additionally, investigations have revealed that GM shares customer location data with law enforcement through subpoenas rather than requiring warrants, a practice that contradicts the company's public-privacy commitments.

The company's data-collection practices have attracted attention from federal legislators, state attorneys general, and privacy advocates, who argue that GM failed to obtain informed consent from consumers and used deceptive techniques to enroll drivers in data-collection programs without their informed consent. This article examines GM's data collection and sharing practices, their impact on consumers, and the resulting legal and regulatory challenges, as well as the harm done by the EULA roofie.

Background

Since 2015, General Motors has installed technology in its vehicles that collects, records, and transmits highly specific "Driving Data" about vehicle usage. While marketed to consumers as improving vehicle safety and functionality, these internet-connected systems allow the manufacturer unprecedented surveillance of driver behavior, and the ability to share that surveillance capabilities to any company that will pay for it. When consumers purchase a GM vehicle, their primary concern is typically getting from Point A to Point B. Investigations have shown, however, that these purchases unwittingly enrolled many drivers into a data-collection system with far-reaching consequences.

Evolution of data collection

The practice began in 2005, when GM partnered with insurance carriers to provide usage-based insurance through devices customers would voluntarily install. As technology advanced, separate monitoring devices became unnecessary: GM began manufacturing vehicles with built-in telematics systems that could directly obtain the same data. The OnStar system, installed in most GM vehicles since 2015, consists of both hardware (cameras, sensors, speakers) and software components that enable comprehensive data collection.

Investigations and oversight

Several major investigations have examined the scope of GM's data practices:

• New York Times Investigation: In March 2024, reporting revealed how GM's OnStar Smart Driver program collected and shared driving data with data brokers like LexisNexis and Verisk. The investigation found many cases where drivers faced increases to their insurance-premium rates based on these data, which had been collected without their knowledge. In one case, a careful driver with no accidents saw his insurance go up 21% because of data in his LexisNexis report, which contained over 130 pages detailing six months of driving behavior.

• Legislative Action: Senators Ron Wyden and Edward Markey requested an FTC investigation into automakers' deceptive practices, particularly focusing on GM's use of "dark patterns" and misleading interfaces to obtain nominal consent for data collection; which has been characterized as an example of a EULA roofie. Their investigation found that GM was selling data for pennies per vehicle: Honda received just 26 cents per car for data sold to Verisk, while Hyundai got 61 cents.

• Texas Lawsuit: In August 2024, the Texas Attorney General filed suit against GM and OnStar, LLC for violating the Texas Deceptive Trade Practices Act. The lawsuit revealed that GM had collected data from over 14 million vehicles nationally and 1.8 million in Texas alone, while maintaining a network of over 300 dealerships that were incentivized to enroll customers in data-collection programs through commissions.

The scope of data collection expanded considerably in recent years. Beyond standard vehicle diagnostics, GM now collects detailed behavioral data including driving speed, acceleration patterns, braking habits, seatbelt usage, and even radio-listening habits, information that has proven valuable to insurers, marketers, and other commercial entities.

Data collection

GM's OnStar and vehicle telematics systems collect a large array of data points, including:

• Trip information: Precise date, start time, end time, distance driven, and route data for each journey
• Vehicle operation: Current speed, acceleration patterns, braking power, and seatbelt status
• Technical data: Including synthetic keys, trip IDs, GPS coordinates, engine diagnostics, and fuel usage
• Additional metrics: Vehicle-ignition status, odometer readings, and even radio-listening patterns

The system automatically logs events deemed "bad driving behavior," including late-night driving, hard braking, sharp turns, and speeds over 80 miles per hour.

Data monetization

GM has developed multiple revenue streams from consumer data:

1. Direct Sales: Between 2015 and 2024, GM sold data to Verisk Analytics and LexisNexis Risk Solutions, receiving multi-million-dollar, lump-sum payments
2. Ongoing Revenue: The company earns "royalty payments" from data brokers based on subsequent license sales to insurers
3. Volume Incentives: GM receives guaranteed annual payments when providing data from a threshold number of vehicles.

Third-party sharing

GM's data-sharing network includes:

• Data brokers: Companies like Verisk and LexisNexis compile "telematics exchanges" containing data from over 16 million customers' vehicles.
• Insurance companies: At least eight different insurers accessed one customer's data through LexisNexis in a single month.
• Law enforcement: Unlike Honda, Ford, Tesla, and Stellantis, GM provides location data without requiring a warrant.

• Other partners: GM shared location data with an unnamed British data broker (likely Wejo) until May 2023, then began sharing with another undisclosed company

Consumer impact

Deceptive practices

GM uses several EULA roofying techniques to obscure its data collection:

• Bundled consent: The OnStar "onboarding" process combines data-sharing acceptance with safety features and theft alerts
• Overwhelming information: Customers must navigate over fifty pages of disclosures about OnStar products during vehicle purchase
• Hidden terms: Data-sharing agreements are buried in complex privacy policies that don't explicitly mention data sales.

Financial consequences

Accusations of harm caused to consumers by GM's policy include:

• Insurance increases: Some drivers saw premiums rise by 21% based on collected data.
• Coverage denials: At least one Cadillac owner was denied coverage by seven different insurance companies, because of his driving data. ^{[citation needed ]}
• No notice: Only Tesla currently informs customers when their data are shared with third parties

Privacy issues

GM's practices raise several privacy concerns:

• Mandatory sharing: Internet-connected features can't be used without accepting some level of data collection
• Long retention: GM stores detailed driving records for extended periods, far longer than competitors like Tesla and Mercedes-Benz who limit data retention
• Limited control: Customers have no meaningful way to limit data sharing while maintaining vehicle connectivity.

Legal challenges

The Texas Attorney General's lawsuit specifically alleges that GM:

• Failed to obtain informed consent before collecting and selling driving data
• Used deceptive enrollment practices through dealership incentive programs
• Misrepresented how customer data would be used and shared
• Created an "all-seeing surveillance system" that monetized private consumer behavior.

The suit seeks civil penalties and restitution for affected consumers, as well as requirements for GM to delete collected data and implement clear opt-out mechanisms.

See Also

• Automotive data privacy
• Vehicle telematics
• Connected car security
• Volkswagen Car Location Data Exposure Incident