General Motors Faces Lawsuits for Allegedly Sharing Driver Data With Insurers

General Motors (GM) is facing lawsuits in four U.S. states for allegedly sharing consumer data with insurers without drivers’ permission or knowledge. The sharing allegedly happened through brokers.

Plaintiffs allege GM violated privacy laws and the Fair Credit Reporting Act by relaying driving data through intermediaries, like LexisNexis and Verisk Analytics, which shared driver reports with insurance companies, according to Law.com.

“We’ve got many, many calls from customers who are very concerned about their data being transmitted to auto insurance companies,” said E. Powell Miller, founding partner of Miller Law in Michigan, in an interview with PropertyCasualty360. “There’s a lot of outrage about their private driving information ending up in an insurance company’s possession and resulting in higher automobile insurance rates.”

The technology in question

The lawsuits specifically focus on data collected through OnStar, a GM subsidiary and telematics system. A March report from The New York Times raised alarms that not all drivers knowingly participate in data sharing through OnStar and some had no idea that GM was collecting and sharing their data with insurers. Some users also reported that OnStar tracked their driving even though they never turned the system on and that their insurance rates subsequently increased.

Some users reported increases as high as 21%. Such an increase would lift the national average full-coverage monthly premium from $213 to $258, according to Insurify data.

Drivers often consent to this data sharing when signing leases or by hitting “agree” on terms and conditions for telematics apps. Some contend they never signed anything consenting to share data with third parties regarding OnStar.

OnStar’s privacy statement notes that GM may share data “with third parties for marketing activities (with necessary consents)” or when drivers choose to receive a service that authorizes data collection, like usage-based insurance. Otherwise, the OnStar policy states the system only shares “de-identified” data, which can’t be reasonably associated with a driver or vehicle, with third parties.

OnStar doesn’t name LexisNexis as a third party it shares data with.

What legislators are saying

Sen. Ed Markey (D-Mass.) sent letters to 14 automakers with questions about user data. Upon receiving their responses, he urged the Federal Trade Commission (FTC) to investigate automakers’ data privacy practices.

Christopher Smith, Ford Motors’ chief government affairs officer,  responded that “Ford does not sell connected vehicle data to data brokers,” and shared additional concerns about standardizing any third-party access to vehicle data.

All 14 U.S. auto manufacturers sent letters responding to Markey’s questions, but he called their responses “evasive and vague.”

“Based on public reporting and responses to my own inquiries into these practices, automakers face few, if any, limitations on the collection, use, and disclosure of this data,” he said in his letter to FTC Chair Lina Khan. “Consumers are often left in the dark.

“Given the serious risks to consumer privacy, I urge the Commission to use the full force of its authorities to investigate the automakers’ privacy practices and take all necessary enforcement actions to ensure that consumer privacy is protected.”

What’s next: Pursuing privacy protections

The FTC didn’t respond directly to Markey, but connected cars have been on its radar for years, according to a May 2024 blog post.

The FTC highlighted concerns in its 2013 “Internet of Things” workshop and a following 2015 report. It hosted a connected cars workshop in 2017 to “examine the consumer privacy and security issues posed by automated and connected motor vehicles.”

FTC guidance from 2018 advised consumers to wipe data when selling their cars, much like you would a phone or a laptop.

“Car manufacturers — and all businesses — should take note that the FTC will take action to protect consumers against the illegal collection, use, and disclosure of their personal data,” FTC staff wrote in the blog post.

Any driver can request their consumer disclosure report, per the Fair Credit Reporting Act.