Iowa files suit against GM and Onstar for collecting and selling data

Iowa Attorney General Brenna Bird has filed a lawsuit against General Motors (GM) and Onstar for what it claims is the unlawful collection and selling of data from Iowans without their knowledge or consent, a press release says. 

The suit claims GM collected and sold data from 186,000 Iowa vehicles, including selling to large data brokers partnered with Chinese data broker Jing You. 

It says that the data was harvested from sensors, cameras, speakers, and microphones that GM installed in vehicles and that the sensors revealed how fast GM customers drove, how quickly they accelerated and how hard they braked, how long they drove, and more. 

“GM profited handsomely from selling this driving data, resulting in millions of dollars of revenue for the company,” the suit says. “So valuable was this driving data that GM paid bonuses to salespeople who enrolled customers in GM services that would collect customer driving data.”

Iowa customers were not told that their driving data was sold to third parties for profit, nor did they give consent to do so, the suit alleges. 

The suit claims that GM offered usage-based insurance plans through partnerships with insurance carriers starting in 2005. The company also has added telematics systems that have been installed in almost all new GM vehicles since model year 2015. 

“GM aggressively enrolled purchasers of model year 2015 or newer vehicles in GM products that would collect customers’ driving data,” the suit says. 

This included connected vehicle services, mobile applications, and the OnStar Guardian mobile application. 

“Enrollment in any of these products meant that GM would collect and sell customers’ driving data to other companies, including insurers, even though GM had not provided clear and truthful disclosures and customers had not provided informed consent,” the suit says. 

Insurance companies used the data to raise rates, deny coverage, and cancel policies, the suit alleges. 

It also claims that GM deceived consumers by misrepresenting the nature and scope of OnStar-connected services, misled consumers into believing enrollment in OnStar was mandatory to access basic safety features, and failed to adequately disclose the enrollment in its mobile apps or ConnectedVehicle services that would allow the company to collect and sell detailed personal data. 

“Iowans deserve to know who is collecting, using, and selling their data and why,” said Bird in the release. “They should also be able to trust a company as large and well-known as General Motors. GM was not honest with Iowans who were spending hard-earned money to buy a dependable vehicle — and they did it to make more money. That is wrong, and our office is holding them accountable.”

In January, the Federal Trade Commission (FTC) finalized a 20-year order with GM and OnStar to settle allegations that they collected, used, and sold geolocation data and driving behavior data from millions of vehicles nationwide without consumer consent and notification.

The final order bans GM from disclosing consumers’ geolocation and driver behavior data to consumer reporting agencies for five years.

For the life of the order, GM will be required to:

• • Obtain affirmative express consent from consumers before collecting, using, or sharing connected vehicle data (including sharing data with consumer reporting agencies), with some exceptions, such as for providing location data to emergency first responders;
  • Create a way for all U.S. consumers to request a copy of their data and seek its deletion;
  • Give consumers the ability to disable the collection of precise geolocation data from their vehicles if their vehicle has the necessary technology; and
  • Provide a way for consumers to opt out of the collection of geolocation and driver behavior data, with some limited exceptions.

According to a GM news release, at that time the company ended its Smart Driver program in 2024 due to customer feedback. Customers were unenrolled, and GM ended its relationships with LexisNexis and Verisk, the release says. The company also said at the time that it consolidated its many U.S. privacy statements into a single, simpler statement to raise the bar on privacy.

Lawsuits have been filed by attorneys general in Arkansas, Nebraska, and Texas against GM, as well as by a Florida consumer over the same alleged activity. 

Image

Photo courtesy of jetcityimage/iStock