General Motors data collection and sharing controversy

General Motors (GM) has been collecting & monetizing driving data from millions of internet connected vehicles since 2015 which creates large privacy concerns. Through its OnStar system & vehicle telematics, GM gathers comprehensive data about drivers; including trip details, driving behavior, & real-time location information. While marketed to drivers as features for safety & convenience, these data collection practices have faced legal and regulatory scrutiny for potentially deceptive practices and inadequate disclosure.

GM has shared driving data from over 14 million vehicles (including 1.8 million in Texas alone) with commercial data brokers like LexisNexis & Verisk, who analyze it to create "driving scores" that are sold to insurance companies. These scores have reportedly led to increased insurance premiums and coverage denials for consumers who were unaware their data was being collected and sold. Additionally, investigations have revealed that GM shares customer location data with law enforcement through subpoenas rather than requiring warrants, a practice that contradicts the company's public privacy commitments.

The company's data collection practices have attracted attention from federal legislators, state attorneys general, & privacy advocates, who argue that GM failed to obtain informed consent from consumers & used deceptive techniques to enroll drivers in data collection programs without their informed consent. This article examines GM's data collection and sharing practices, their impact on consumers, and the resulting legal and regulatory challenges, as well as the harm done by the EULA roofie.

Background

Since 2015, General Motors has installed technology in its vehicles that collects, records, and transmits highly specific "Driving Data" about vehicle usage. While marketed to consumers as improving vehicle safety and functionality, these internet-connected systems allow the manufacturer unprecedented surveillance of driver behavior, & the ability to share that surveillance capabilities to any company that will pay for it. When consumers purchase a GM vehicle, their primary concern is typically getting from Point A to Point B. However, investigations have shown that these purchases unwittingly enrolled many drivers into a data collection system with far-reaching consequences.

Evolution of Data Collection

The practice began in 2005 when GM partnered with insurance carriers to provide usage-based insurance through devices customers would voluntarily install. As technology advanced, separate monitoring devices became unnecessary - GM began manufacturing vehicles with built-in telematics systems that could directly obtain the same data. The OnStar system, installed in most GM vehicles since 2015, consists of both hardware (cameras, sensors, speakers) and software components that enable comprehensive data collection.

Investigations & Oversight

Several major investigations have exposed the scope of GM's data practices:

• NY Times Investigation: In March 2024, reporting revealed how GM's OnStar Smart Driver program collected and shared driving data with data brokers like LexisNexis and Verisk. The investigation found many cases where drivers faced insurance premium rate hikes based on this data without their knowledge. In one case, a careful driver with no accidents saw his insurance go up 21% due to data in his LexisNexis report, which contained over 130 pages detailing six months of driving behavior.</ref>

• Legislative Action: Senators Ron Wyden and Edward Markey requested FTC investigation into automakers' deceptive practices, particularly focusing on GM's use of "dark patterns" and misleading interfaces to obtain nominal consent for data collection; an example of the ever-prevalent EULA roofie. Their investigation found that GM was selling data for pennies per vehicle - Honda received just 26 cents per car for data sold to Verisk, while Hyundai got 61 cents.

• Texas Lawsuit: In August 2024, the Texas Attorney General filed suit against GM and OnStar LLC for violating the Texas Deceptive Trade Practices Act. The lawsuit revealed that GM had collected data from over 14 million vehicles nationally and 1.8 million in Texas alone, while maintaining a network of over 300 dealerships that were incentivized to enroll customers in data collection programs through commissions.

The scope of data collection expanded considerably in recent years. Beyond standard vehicle diagnostics, GM now collects detailed behavioral data including driving speed, acceleration patterns, braking habits, seatbelt usage, & even radio listening habits - information that has proven valuable to insurers, marketers, & other commercial entities.</ref>

Data Collection Practices

GM's OnStar and vehicle telematics systems collect a large array of data points, including(but not limited to):

• Trip Information: Precise date, start time, end time, distance driven, & route data for each journey
• Vehicle Operation: Current speed, acceleration patterns, braking power, & seatbelt status
• Technical Data: Including synthetic keys, trip IDs, GPS coordinates, engine diagnostics, & fuel usage
• Additional Metrics: Vehicle ignition status, odometer readings, & even radio listening patterns

The system automatically logs events deemed "bad driving behavior," including late-night driving, hard braking, sharp turns, and speeds over 80 miles per hour.

Data Monetization

GM has developed multiple revenue streams from consumer data:

1. Direct Sales: Between 2015-2024, GM sold data to Verisk Analytics and LexisNexis Risk Solutions, receiving multi-million dollar lump sum payments
2. Ongoing Revenue: The company earns "royalty payments" from data brokers based on subsequent license sales to insurers
3. Volume Incentives: GM receives guaranteed annual payments when providing data from a threshold number of vehicles

Third-Party Sharing

GM's data sharing network includes:

• Data Brokers: Companies like Verisk and LexisNexis compile "telematics exchanges" containing data from over 16 million customers' vehicles
• Insurance Companies: At least eight different insurers accessed one customer's data through LexisNexis in a single month</ref>

* Law Enforcement: Unlike Honda, Ford, Tesla, & Stellantis, GM provides location data without requiring a warrant

• Other Partners: GM shared location data with an unnamed British data broker (likely Wejo) until May 2023, then began sharing with another undisclosed company

Consumer Impact

Deceptive Practices

GM uses several EULA roofying techniques to obscure its data collection:

• Bundled Consent: The OnStar "onboarding" process combines data sharing acceptance with safety features & theft alerts
• Overwhelming Information: Customers must navigate over fifty pages of disclosures about OnStar products during vehicle purchase
• Hidden Terms: Data sharing agreements are buried in complex privacy policies that don't explicitly mention data sales

Financial Consequences

The damage to consumers is clear:

• Insurance Increases: Some drivers saw premiums rise by 21% based on collected data
• Coverage Denials: At least one Cadillac owner was denied coverage by seven different insurance companies due to their driving data
• No Notice: Only Tesla currently informs customers when their data is shared with third parties</ref>

Privacy Issues

GM's practices raise several privacy concerns:

• Mandatory Sharing: Internet-connected features can't be used without accepting some level of data collection
• Long Retention: GM stores detailed driving records for extended periods - far longer than competitors like Tesla and Mercedes-Benz who limit data retention
• Limited Control: Customers have no meaningful way to limit data sharing while maintaining vehicle connectivity.

Legal Challenges

The Texas Attorney General's lawsuit specifically alleges that GM:

• Failed to obtain informed consent before collecting and selling driving data
• Used deceptive enrollment practices through dealership incentive programs
• Misrepresented how customer data would be used and shared
• Created an "all-seeing surveillance system" that monetized private consumer behavior

The suit seeks civil penalties and restitution for affected consumers, as well as requirements for GM to delete collected data and implement clear opt-out mechanisms.

See Also

• Automotive data privacy
• Vehicle telematics
• Connected car security
• Volkswagen Car Location Data Exposure Incident