Please note that all submissions to the site are subject to the wiki's licence, CC 4.0 BY-SA, as found here

General Motors data collection and sharing controversy: Difference between revisions

From Consumer Action Taskforce
Jump to navigation Jump to search
← Older editNewer edit →
VisualWikitext
revised article with greater detail and organization
Tag: 2017 source edit
Line 1: Line 1:
{{Under Development|date=January 14, 2025}}
General Motors (GM) has been collecting & monetizing driving data from millions of internet connected vehicles since 2015 which creates large privacy concerns. Through its OnStar system & vehicle telematics, GM gathers comprehensive data about drivers; including trip details, driving behavior, & real-time location information.<ref name="texaslawsuit" /> While marketed to drivers as features for safety & convenience, these data collection practices have faced legal and regulatory scrutiny for potentially deceptive practices and inadequate disclosure.<ref name="nytimes" />


General Motors (GM), along with other automakers, collects vast amounts of data from modern vehicles. This data includes locations, trip start and stop times, & detailed driving behavior such as acceleration, braking, and speed.<ref name="nytimes" /> These practices have raised huge privacy concerns as this data is often:
GM has shared driving data from over 14 million vehicles (including 1.8 million in Texas alone) with commercial data brokers like LexisNexis & Verisk, who analyze it to create "driving scores" that are sold to insurance companies.<ref name="texaslawsuit" /> These scores have reportedly led to increased insurance premiums and coverage denials for consumers who were unaware their data was being collected and sold.<ref name="nytimes" /> Additionally, investigations have revealed that GM shares customer location data with law enforcement through subpoenas rather than requiring warrants, a practice that contradicts the company's public privacy commitments.<ref name="wydenletter1" />
* Shared with law enforcement without a warrant,<ref name="wydenletter1" />
* Sold to third-party data brokers like LexisNexis and Verisk,<ref name="wydenletter2" />
* Resold to insurance companies, potentially leading to insurance price hikes for consumers.<ref name="texaslawsuit" />


This article explores GM’s data practices & their impact on consumers.
The company's data collection practices have attracted attention from federal legislators, state attorneys general, & privacy advocates, who argue that GM failed to obtain informed consent from consumers & used deceptive techniques to enroll drivers in data collection programs without their informed consent.<ref name="wydenletter2" /> This article examines GM's data collection and sharing practices, their impact on consumers, and the resulting legal and regulatory challenges, as well as the harm done by the [[EULA roofie]].


== Background ==
== Background ==
Modern cars are equipped with internet connections that allow automakers to collect real-time data for diagnostics, safety, and customer convenience. Investigations have revealed that this data is often shared without adequate(or any) consumer consent:
Since 2015, General Motors has installed technology in its vehicles that collects, records, and transmits highly specific "Driving Data" about vehicle usage.<ref name="texaslawsuit" /> While marketed to consumers as improving vehicle safety and functionality, these internet-connected systems allow the manufacturer unprecedented surveillance of driver behavior, & the ability to share that surveillance capabilities to any company that will pay for it. When consumers purchase a GM vehicle, their primary concern is typically getting from Point A to Point B. However, investigations have shown that these purchases unwittingly enrolled many drivers into a data collection system with far-reaching consequences.<ref name="texaslawsuit" />


* '''NY Times Investigation''': A report highlighted how GM, through its OnStar Smart Driver program, collected driving data and shared it with LexisNexis and Verisk for resale to insurance companies. Drivers often discovered premium increases based on telematics data without prior knowledge.<ref name="nytimes">[https://web.archive.org/web/20240311090514/https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html Hill, Kashmir. "Automakers Are Sharing Consumers' Driving Behavior With Insurance Companies." The New York Times, March 11, 2024.]</ref>
=== Evolution of Data Collection ===
* '''Legislative Concerns''': Senators Ron Wyden (D-OR) and Edward Markey (D-MA) requested the FTC investigate automakers for deceptive practices, including sharing location and driving data without obtaining informed consent.<ref name="wydenletter1">[https://www.wyden.senate.gov/imo/media/doc/signed_wyden_markey_letter_to_ftc_with_attachmentpdf.pdf Senator Wyden and Senator Markey. "Request to Investigate Automakers’ Disclosure of Driving Data." April 30, 2024.]</ref><ref name="wydenletter2">[https://www.wyden.senate.gov/imo/media/doc/wyden-markey_auto_privacy_letter_to_ftc.pdf Senator Wyden and Senator Markey. "Urging the FTC to Investigate Automakers' Disclosure of Driving Data to Brokers." July 26, 2024.]</ref>
The practice began in 2005 when GM partnered with insurance carriers to provide usage-based insurance through devices customers would voluntarily install. As technology advanced, separate monitoring devices became unnecessary - GM began manufacturing vehicles with built-in telematics systems that could directly obtain the same data.<ref name="texaslawsuit" /> The OnStar system, installed in most GM vehicles since 2015, consists of both hardware (cameras, sensors, speakers) and software components that enable comprehensive data collection.<ref name="texaslawsuit" />
* '''Texas Lawsuit''': The Texas Attorney General filed a lawsuit against GM for violating consumer protection laws, alleging it collected and monetized consumer data without clear consent.<ref name="texaslawsuit">[https://www.texasattorneygeneral.gov/sites/default/files/images/press/General%20Motors%20Original%20Petition%20Filestamped.pdf 457th Judicial District Court, Montgomery County, Texas. "State of Texas v. General Motors LLC and OnStar LLC." 2024.]</ref>
 
=== Investigations & Oversight ===
Several major investigations have exposed the scope of GM's data practices:
 
* '''NY Times Investigation''': In March 2024, reporting revealed how GM's OnStar Smart Driver program collected and shared driving data with data brokers like LexisNexis and Verisk. The investigation found many cases where drivers faced insurance premium rate hikes based on this data without their knowledge. In one case, a careful driver with no accidents saw his insurance go up 21% due to data in his LexisNexis report, which contained over 130 pages detailing six months of driving behavior.<ref name="nytimes" />
 
* '''Legislative Action''': Senators Ron Wyden and Edward Markey requested FTC investigation into automakers' deceptive practices, particularly focusing on GM's use of "dark patterns" and misleading interfaces to obtain nominal consent for data collection; an example of the ever-prevalent [[EULA roofie]].<ref name="wydenletter1" /><ref name="wydenletter2" /> Their investigation found that GM was selling data for pennies per vehicle - Honda received just 26 cents per car for data sold to Verisk, while Hyundai got 61 cents.<ref name="wydenletter2" />
 
* '''Texas Lawsuit''': In August 2024, the Texas Attorney General filed suit against GM and OnStar LLC for violating the Texas Deceptive Trade Practices Act. The lawsuit revealed that GM had collected data from over 14 million vehicles nationally and 1.8 million in Texas alone, while maintaining a network of over 300 dealerships that were incentivized to enroll customers in data collection programs through commissions.<ref name="texaslawsuit" />
 
The scope of data collection expanded considerably in recent years. Beyond standard vehicle diagnostics, GM now collects detailed behavioral data including driving speed, acceleration patterns, braking habits, seatbelt usage, & even radio listening habits - information that has proven valuable to insurers, marketers, & other commercial entities.<ref name="texaslawsuit" /><ref name="nytimes" />


== Data Collection Practices ==
== Data Collection Practices ==
GM collects a wide range of data through its OnStar and vehicle systems, including:
GM's OnStar and vehicle telematics systems collect a large array of data points, including(but not limited to):
* '''Location Data''': Real-time GPS coordinates, routes, and travel history.
 
* '''Driving Behavior''': Speeding, hard braking, and rapid acceleration metrics.
* '''Trip Information''': Precise date, start time, end time, distance driven, & route data for each journey
* '''Vehicle Diagnostics''': Maintenance needs, battery status, and crash data.<ref name="nytimes" />
* '''Vehicle Operation''': Current speed, acceleration patterns, braking power, & seatbelt status
* '''Technical Data''': Including synthetic keys, trip IDs, GPS coordinates, engine diagnostics, & fuel usage
* '''Additional Metrics''': Vehicle ignition status, odometer readings, & even radio listening patterns<ref name="texaslawsuit" />
 
The system automatically logs events deemed "bad driving behavior," including late-night driving, hard braking, sharp turns, and speeds over 80 miles per hour.<ref name="texaslawsuit" />
 
=== Data Monetization ===
GM has developed multiple revenue streams from consumer data:
 
# '''Direct Sales''': Between 2015-2024, GM sold data to Verisk Analytics and LexisNexis Risk Solutions, receiving multi-million dollar lump sum payments
# '''Ongoing Revenue''': The company earns "royalty payments" from data brokers based on subsequent license sales to insurers
# '''Volume Incentives''': GM receives guaranteed annual payments when providing data from a threshold number of vehicles<ref name="texaslawsuit" />
 
=== Third-Party Sharing ===
GM's data sharing network includes:
 
* '''Data Brokers''': Companies like Verisk and LexisNexis compile "telematics exchanges" containing data from over 16 million customers' vehicles<ref name="texaslawsuit" />
* '''Insurance Companies''': At least eight different insurers accessed one customer's data through LexisNexis in a single month<ref name="nytimes" />
<big>* '''Law Enforcement''': Unlike Honda, Ford, Tesla, & Stellantis, GM provides location data without requiring a warrant<ref name="wydenletter1" /></big>
* '''Other Partners''': GM shared location data with an unnamed British data broker (likely Wejo) until May 2023, then began sharing with another undisclosed company<ref name="wydenletter2" />
 
== Consumer Impact ==
=== Deceptive Practices ===
GM uses several [[EULA roofie|EULA roofying]] techniques to obscure its data collection:
 
* '''Bundled Consent''': The OnStar "onboarding" process combines data sharing acceptance with safety features & theft alerts
* '''Overwhelming Information''': Customers must navigate over fifty pages of disclosures about OnStar products during vehicle purchase
* '''Hidden Terms''': Data sharing agreements are buried in complex privacy policies that don't explicitly mention data sales<ref name="texaslawsuit" />
 
=== Financial Consequences ===
The damage to consumers is clear:


=== Sharing with Third Parties ===
* '''Insurance Increases''': Some drivers saw premiums rise by 21% based on collected data
GM shares data with:
* '''Coverage Denials''': At least one Cadillac owner was denied coverage by seven different insurance companies due to their driving data
# '''Data Brokers''': LexisNexis and Verisk use GM’s data to generate driver risk profiles sold to insurers.<ref name="nytimes" /><ref name="wydenletter2" />
* '''No Notice''': Only Tesla currently informs customers when their data is shared with third parties<ref name="wydenletter2" /><ref name="nytimes" />
# '''Insurance Companies''': These profiles affect premiums, often raising costs for drivers deemed “risky.”<ref name="texaslawsuit" />
# '''Law Enforcement''': GM has admitted to sharing location data with law enforcement via subpoenas, bypassing warrant requirements.<ref name="wydenletter1" />


== Consumer Harm ==
=== Privacy Issues ===
=== Lack of Transparency ===
GM's practices raise several privacy concerns:
Many consumers are unaware of GM's data-sharing practices. Consent is often bundled with unrelated features like theft notifications or safety diagnostics, using manipulative ''"dark patterns"'' to obscure data-sharing terms.<ref name="wydenletter2" />


=== Financial Harm ===
* '''Mandatory Sharing''': Internet-connected features can't be used without accepting some level of data collection
Drivers have reported increased insurance premiums based on data profiles generated from GM’s telematics systems, even when unaware of their enrollment in programs like OnStar Smart Driver.<ref name="nytimes" />
* '''Long Retention''': GM stores detailed driving records for extended periods - far longer than competitors like Tesla and Mercedes-Benz who limit data retention
* '''Limited Control''': Customers have no meaningful way to limit data sharing while maintaining vehicle connectivity<ref name="wydenletter2" />


=== Privacy Violations ===
== Legal Challenges ==
The inability to opt out of data sharing without disabling the vehicle's internet connectivity poses significant privacy concerns. GM confirmed that all drivers activating internet-connected features automatically have some location data shared with third parties.<ref name="texaslawsuit" />
The Texas Attorney General's lawsuit specifically alleges that GM:


== Data Theft Allegations ==
* Failed to obtain informed consent before collecting and selling driving data
The Texas Attorney General’s lawsuit alleges that GM penalized consumers for ''“bad”'' driving behavior by sharing their data with brokers and insurers without informed consent. The lawsuit also demonstrates GM’s failure to provide easy to understand opt-out mechanisms for its data-sharing programs.<ref name="texaslawsuit" />
* Used deceptive enrollment practices through dealership incentive programs
* Misrepresented how customer data would be used and shared
* Created an "all-seeing surveillance system" that monetized private consumer behavior<ref name="texaslawsuit" />


The suit seeks civil penalties and restitution for affected consumers, as well as requirements for GM to delete collected data and implement clear opt-out mechanisms.<ref name="texaslawsuit" />
== See Also ==
== See Also ==
* [[Automotive data privacy]]
* [[Automotive data privacy]]

Revision as of 08:47, 19 January 2025

General Motors (GM) has been collecting & monetizing driving data from millions of internet connected vehicles since 2015 which creates large privacy concerns. Through its OnStar system & vehicle telematics, GM gathers comprehensive data about drivers; including trip details, driving behavior, & real-time location information.[1] While marketed to drivers as features for safety & convenience, these data collection practices have faced legal and regulatory scrutiny for potentially deceptive practices and inadequate disclosure.[2]

GM has shared driving data from over 14 million vehicles (including 1.8 million in Texas alone) with commercial data brokers like LexisNexis & Verisk, who analyze it to create "driving scores" that are sold to insurance companies.[1] These scores have reportedly led to increased insurance premiums and coverage denials for consumers who were unaware their data was being collected and sold.[2] Additionally, investigations have revealed that GM shares customer location data with law enforcement through subpoenas rather than requiring warrants, a practice that contradicts the company's public privacy commitments.[3]

The company's data collection practices have attracted attention from federal legislators, state attorneys general, & privacy advocates, who argue that GM failed to obtain informed consent from consumers & used deceptive techniques to enroll drivers in data collection programs without their informed consent.[4] This article examines GM's data collection and sharing practices, their impact on consumers, and the resulting legal and regulatory challenges, as well as the harm done by the EULA roofie.

Background

Since 2015, General Motors has installed technology in its vehicles that collects, records, and transmits highly specific "Driving Data" about vehicle usage.[1] While marketed to consumers as improving vehicle safety and functionality, these internet-connected systems allow the manufacturer unprecedented surveillance of driver behavior, & the ability to share that surveillance capabilities to any company that will pay for it. When consumers purchase a GM vehicle, their primary concern is typically getting from Point A to Point B. However, investigations have shown that these purchases unwittingly enrolled many drivers into a data collection system with far-reaching consequences.[1]

Evolution of Data Collection

The practice began in 2005 when GM partnered with insurance carriers to provide usage-based insurance through devices customers would voluntarily install. As technology advanced, separate monitoring devices became unnecessary - GM began manufacturing vehicles with built-in telematics systems that could directly obtain the same data.[1] The OnStar system, installed in most GM vehicles since 2015, consists of both hardware (cameras, sensors, speakers) and software components that enable comprehensive data collection.[1]

Investigations & Oversight

Several major investigations have exposed the scope of GM's data practices:

  • NY Times Investigation: In March 2024, reporting revealed how GM's OnStar Smart Driver program collected and shared driving data with data brokers like LexisNexis and Verisk. The investigation found many cases where drivers faced insurance premium rate hikes based on this data without their knowledge. In one case, a careful driver with no accidents saw his insurance go up 21% due to data in his LexisNexis report, which contained over 130 pages detailing six months of driving behavior.[2]
  • Legislative Action: Senators Ron Wyden and Edward Markey requested FTC investigation into automakers' deceptive practices, particularly focusing on GM's use of "dark patterns" and misleading interfaces to obtain nominal consent for data collection; an example of the ever-prevalent EULA roofie.[3][4] Their investigation found that GM was selling data for pennies per vehicle - Honda received just 26 cents per car for data sold to Verisk, while Hyundai got 61 cents.[4]
  • Texas Lawsuit: In August 2024, the Texas Attorney General filed suit against GM and OnStar LLC for violating the Texas Deceptive Trade Practices Act. The lawsuit revealed that GM had collected data from over 14 million vehicles nationally and 1.8 million in Texas alone, while maintaining a network of over 300 dealerships that were incentivized to enroll customers in data collection programs through commissions.[1]

The scope of data collection expanded considerably in recent years. Beyond standard vehicle diagnostics, GM now collects detailed behavioral data including driving speed, acceleration patterns, braking habits, seatbelt usage, & even radio listening habits - information that has proven valuable to insurers, marketers, & other commercial entities.[1][2]

Data Collection Practices

GM's OnStar and vehicle telematics systems collect a large array of data points, including(but not limited to):

  • Trip Information: Precise date, start time, end time, distance driven, & route data for each journey
  • Vehicle Operation: Current speed, acceleration patterns, braking power, & seatbelt status
  • Technical Data: Including synthetic keys, trip IDs, GPS coordinates, engine diagnostics, & fuel usage
  • Additional Metrics: Vehicle ignition status, odometer readings, & even radio listening patterns[1]

The system automatically logs events deemed "bad driving behavior," including late-night driving, hard braking, sharp turns, and speeds over 80 miles per hour.[1]

Data Monetization

GM has developed multiple revenue streams from consumer data:

  1. Direct Sales: Between 2015-2024, GM sold data to Verisk Analytics and LexisNexis Risk Solutions, receiving multi-million dollar lump sum payments
  2. Ongoing Revenue: The company earns "royalty payments" from data brokers based on subsequent license sales to insurers
  3. Volume Incentives: GM receives guaranteed annual payments when providing data from a threshold number of vehicles[1]

Third-Party Sharing

GM's data sharing network includes:

  • Data Brokers: Companies like Verisk and LexisNexis compile "telematics exchanges" containing data from over 16 million customers' vehicles[1]
  • Insurance Companies: At least eight different insurers accessed one customer's data through LexisNexis in a single month[2]

* Law Enforcement: Unlike Honda, Ford, Tesla, & Stellantis, GM provides location data without requiring a warrant[3]

  • Other Partners: GM shared location data with an unnamed British data broker (likely Wejo) until May 2023, then began sharing with another undisclosed company[4]

Consumer Impact

Deceptive Practices

GM uses several EULA roofying techniques to obscure its data collection:

  • Bundled Consent: The OnStar "onboarding" process combines data sharing acceptance with safety features & theft alerts
  • Overwhelming Information: Customers must navigate over fifty pages of disclosures about OnStar products during vehicle purchase
  • Hidden Terms: Data sharing agreements are buried in complex privacy policies that don't explicitly mention data sales[1]

Financial Consequences

The damage to consumers is clear:

  • Insurance Increases: Some drivers saw premiums rise by 21% based on collected data
  • Coverage Denials: At least one Cadillac owner was denied coverage by seven different insurance companies due to their driving data
  • No Notice: Only Tesla currently informs customers when their data is shared with third parties[4][2]

Privacy Issues

GM's practices raise several privacy concerns:

  • Mandatory Sharing: Internet-connected features can't be used without accepting some level of data collection
  • Long Retention: GM stores detailed driving records for extended periods - far longer than competitors like Tesla and Mercedes-Benz who limit data retention
  • Limited Control: Customers have no meaningful way to limit data sharing while maintaining vehicle connectivity[4]

Legal Challenges

The Texas Attorney General's lawsuit specifically alleges that GM:

  • Failed to obtain informed consent before collecting and selling driving data
  • Used deceptive enrollment practices through dealership incentive programs
  • Misrepresented how customer data would be used and shared
  • Created an "all-seeing surveillance system" that monetized private consumer behavior[1]

The suit seeks civil penalties and restitution for affected consumers, as well as requirements for GM to delete collected data and implement clear opt-out mechanisms.[1]

See Also

References

  1. ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 1.11 1.12 1.13 1.14 Cite error: Invalid <ref> tag; no text was provided for refs named texaslawsuit
  2. ↑ 2.0 2.1 2.2 2.3 2.4 2.5 Cite error: Invalid <ref> tag; no text was provided for refs named nytimes
  3. ↑ 3.0 3.1 3.2 Cite error: Invalid <ref> tag; no text was provided for refs named wydenletter1
  4. ↑ 4.0 4.1 4.2 4.3 4.4 4.5 Cite error: Invalid <ref> tag; no text was provided for refs named wydenletter2
Retrieved from "https://wiki.rossmanngroup.com/index.php?title=General_Motors_data_collection_and_sharing_controversy&oldid=2620"