Texas sues GM for selling driver data to analytics, insurance companies

Texas has sued General Motors for what it said is a years-long scheme to collect and sell drivers' data to third parties - including insurance companies - without their knowledge or consent. 

The lawsuit [PDF], filed yesterday in Texas state court, accuses both GM and its OnStar subsidiary of using telematics technology installed in most of its model year 2015 and later vehicles to transmit detailed driving data each time a vehicle is used.

Collected data was then sold to several data analytics companies to build driver scores, and the Lone Star state alleges GM required those firms to license access to insurance companies for the purpose of calculating rates based on their compiled data. 

"Our investigation revealed that General Motors has engaged in egregious business practices that violated Texans' privacy and broke the law. We will hold them accountable," Texas Attorney General Ken Paxton said of the lawsuit. "Millions of American drivers wanted to buy a car, not a comprehensive surveillance system that unlawfully records information about every drive they take and sells their data to any company willing to pay for it." 

The lawsuit alleges that more than 16 million GM customers had their data sold to third parties without their knowledge or consent, with 1.8 million of them residing in Texas, according to the petition. 

"Insurers could - and did - use these scores and data to make significant decisions that impacted customers including monthly premium increases, dropped coverage, or coverage denials," the lawsuit alleged. 

Data sold to third parties reportedly included the date, start and end time of trips, vehicle speed, seatbelt status, distance traveled, GPS data and other information. Driving scores calculated using the data allegedly flagged drivers for bad behavior including driving late at night, seatbelt violations, turning too sharply, braking or accelerating too quickly and driving over 80 miles per hour. 

GM, meanwhile, allegedly made out handsomely from the scheme. Texas alleges the sale of data to analytics companies resulted in "millions in lump sum payments," royalty payments for the sale of licensed data to insurance companies and additional kickbacks if GM sold more than an unspecified amount of new vehicle data to telematics analytics companies per year. 

Telematics companies with access to the data include a credit agency called Verisk, which was the subject of a letter sent by a pair of Democratic senators to the Federal Trade Commission asking it to investigate GM, Honda and Hyundai for partnerships with the firm. 

Verisk also appears in the Texas lawsuit as one of the parties that compiled driver data for resale to auto insurance companies, with the Lone Star state alleging the deal between the two began in 2015. UK-based Wejo Limited, LexisNexis Risk Solutions and Jacobs Engineering Group were also in agreements with GM to receive driving data, according to the complaint. 

Permission granted?

According to the lawsuit, GM also represented to firms buying driver data that owners had consented to the collection, sale and use of their info. This would technically be correct, however, Texas argues that the way permission was granted still runs afoul of Texas' Deceptive Trade Practices Act. 

Upon purchase of a GM vehicle, buyers were allegedly pressured into signing up for a suite of connected vehicle services and apps under the OnStar brand, with some of those services eventually becoming mandatory.

"As part of this onboarding process, General Motors electronically presented customers with over fifty pages of disclosures about its OnStar products, which consisted of product descriptions and a confusing series of applicable user terms and privacy notices," the lawsuit alleged. "GM purported to disclose its privacy practices to consumers, but its disclosures were confusing and highly misleading."

The lawsuit argues that, rather than being upfront about what OnStar was planning to do with all that data, customers were instead led to believe "data collected by General Motors would be used for reasons related primarily to improve the safety, functionality, and operability of its vehicles and products.

"At no point did General Motors inform customers that its practice was to sell any of their data, much less their Driving Data," Texas alleged, adding that GM didn't disclose existing contracts to sell data, nor did it disclose that analytics companies were selling that data to insurers. 

GM, for its part, told The Register it's already made changes to comply with user privacy expectations.

"We've been in discussions with the Attorney General's office and are reviewing the complaint," a GM spokesperson told us. "We share the desire to protect consumers' privacy."

The automaker also directed us to an April press release announcing the discontinuation of OnStar Smart Driver, a service that collected data to be shown to drivers as safety reports that Texas alleges was also used to collect data to sell to third parties, as well as the termination of its partnerships with Verisk and LexisNexis.

GM said the move was made after "feedback from many customers" that made it concerned the apps and data sharing deals were damaging customer trust. The decision was made around the same time, we note, that GM was sued by vehicle owners for selling their data.

When asked about the status of its relationships with Jacobs and Wejo, unmentioned in the statement, and the rest of its suite of OnStar apps and services that weren't discontinued, GM only directed us back to the press release. 

Texas began investigating GM's misuse of customer data in June, a month before the FTC letter and two months after GM announced the discontinuation of some of the offending services. It's unclear if the state plans to file additional charges against Honda, Hyundai or other automakers.  

We've reached out to the Texas Attorney General's office for comment. ®