GM data lawsuit
“Sharing data without consent is bad,” said David Vladeck, former director of the Federal Trade Commission’s Bureau of Consumer Protection during President Barack Obama’s first term and a law professor at Georgetown University. “There will be cases coming down the pike. This is a serious breach by the car companies. It’s a breach of confidentiality and there are financial consequences.”
A ‘standard rotten thing’
GM said it shares limited data with insurers through a third party, which is collected through the OnStar Smart Driver program, after a customer consents to it three times. That OnStar program is optional. It monitors driving habits to help reduce wear-and-tear on the car and improve driving safety and customers can unenroll at any time.
On Friday, GM spokesman Kevin Kelly declined to comment on the lawsuit, but he sent the Detroit Free Press the following statement: “As of March 20th, OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk. Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies.”
Kelly declined to provide any further information as to how long GM has done business with LexisNexis and Verisk, which is also a data analytics firm that collects and shares data to help businesses manage risk, or why GM severed ties at this time.
The practice of using data for purposes that are not made clear in the consent, is widespread across many industries, said Erik Gordon, a professor at the Ross School of Business at the University of Michigan — and a lawyer.
“It’s not just car companies. The fine print of disclosing data
Gordon is used by cable companies, almost any app you download, loyalty programs by retailers. …. What the core of the plaintiff’s complaint is, is that the law allows data gathers, date resellers and data brokers to do things using fine print, in language that isn’t clear to the data-givers,” Gordon said.
He believes this case will be settled, but if it proceeds to trial and the plaintiff wins, “there will be a rash of lawsuits” against automakers and others.
“What GM is doing here is the standard rotten thing that most companies do and that the government should step in and protect us against,” said Gordon.
A decline of OnStar services
The 36-page lawsuit stated that on Nov. 16, 2021, Chicco bought a new 2021 Cadillac XT6 SUV in Delray Beach, Florida, and that the purchase agreement made no mention of OnStar, LexisNexis, data-sharing, or anything privacy-related.
Chicco downloaded the MyCadillac App to his cellphone, the lawsuit stated. Days later, Chicco received an email offering him a Cadillac Connected Services trial and OnStar Safety and Security Coverage. It instructed him to hit the blue OnStar button to activate the services, which he never did because he said he did not want them.
The lawsuit said the email did not mention OnStar’s Smart Driver program — for which, according to www.onstar.com, “there is no charge for customers to enroll.” It is available as part of “Connected Access.”
OnStar states: “With customer consent, we share select OnStar Smart Driver insights about driving behavior with LexisNexis and Verisk, third-party telematics exchange companies that work with some insurance carriers” and, it adds, “insights about driving behavior are only shared with an insurance carrier with your explicit consent.”
A record of 258 driving trips
The lawsuit contends that Chicco never enrolled in any OnStar services and he never consented for his driving data to be shared.
Yet in December 2023, he called Liberty Mutual to ask why he was rejected for insurance. An agent said it was because of information in Chicco’s LexisNexis report. Chicco got a copy of his LexisNexis report and it contained details of about 258 trips he had taken in his Cadillac in recent months, the lawsuit stated. It included the “acceleration events, hard brake events, high speed events,” the lawsuit stated.
“Notably absent from the consumer report is any context related to these driving events,” the complaint said.
Chicco said he called GM and LexisNexis several times to find out why his data had been collected without his consent, the lawsuit said. Eventually, he was told that his data came through OnStar because he had enrolled in OnStar’s Smart Driver program and he had an OnStar account. Chicco said he never enrolled in OnStar nor consented to sharing his driving data.
The complaint said no one at OnStar or GM could tell him why OnStar distributed his driving data without his consent.
GM should just stop selling data
It is unclear how much money GM makes from selling data. It is not broken out in the company’s annual earnings filing with the Securities and Exchange Commission. But Gordon said it’s likely a small percentage of GM’s total multibillions in revenue, which might not be worth continuing to do it, he said.
“You make $5 million on it, but get $30 million in bad publicity and now we have a legal settlement,” Gordon said. “There’s a near-term solution that says just drop it.”
But with a proliferation of electric vehicles on the horizon, the connectivity of cars will increase and offer more opportunities for automakers to add revenue through data sharing, Gordon said. For example, selling a driver’s GPS location to retailers who can then ping a driver to stop at their store, he said. The key will be to get drivers’ clear and informed consent.
“For years, the trucking companies knew where all their trucks were and they knew when the truck was moving, how fast it was going and if it got off the freeway,” Gordon said. “That information has been valuable for safety purposes and efficiency. But the difference is the drivers knew. This plaintiff said he didn’t know and most of us have no idea..”
‘Your car isn’t spying on you’
Georgetown’s Vladeck agreed and added that what a person is doing while driving would be considered “sensitive data” by the Federal Trade Commission.
“If car companies are collecting the data to make the car safer, that’s one thing. But if they are doing it to monetize it and it leaves General Motors to go somewhere else, that’s a serious concern,” Vladeck said.
In December, the Alliance for Automotive Innovation issued a statement titled, “No, your car isn’t spying … it’s keeping you safe.” It said carmakers collect telematic driving data mostly to support the proper functions of the vehicle, including onboard computers for safety.
The alliance’s memo did not address the sale of data, only that automakers are complying with privacy principles that are enforceable by the FTC.
“Yes, some of these policies might be a little confusing, accounting for incidental collection and inferences drawn from, for example, where the vehicle may have traveled,” the alliance’s memo states. “Blame the lawyers, but that’s to ensure manufacturer compliance with notice obligations in the growing patchwork of state privacy laws on health information, biometrics, and others. (Again, a single federal standard is urgent.)”
Free Press staff writer Todd Spangler contributed to this report.
Contact Jamie L. LaReau: jlareau@freepress.com. Follow her on Twitter @jlareauan. Read more on General Motors and sign up for our autos newsletter.