News: 1713888008

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

GM shared our driving data with insurers without consent, lawsuit claims

(2024/04/23)


Two New Jersey drivers claim they now pay more for their car insurance because General Motors (GM) and its OnStar app snooped on their driving behavior without their consent and sent metrics to "various insurance carriers."

[1]

Chevy is discontinuing the Bolt EV and EUV after the 2023 model year, despite record shipments in the past year. The company reported revenue increases of 7.6 percent to $43 billion today, topping forecasts by $2 billion

As the [2]lawsuit [PDF], filed in Georgia on Friday, concedes, some vehicle purchasers do knowingly consent to having their personal driving habits and behavior monitored and handed on to third parties when they agree "to specific safe driving programs ... and to installing dongles in their vehicles." But the plaintiffs claim they agreed to no such thing.

Barbara Figlio and Morris D Gordin, both Chevy Bolt drivers, are proposed as representatives in a would-be class action on behalf of all people whose "personal, private driving behavior or Driver Behavior Data" was allegedly "collected by GM, through various modules located in their vehicles ... without their knowing consent to unauthorized third parties, including OnStar, LexisNexis, Verisk and various insurance carriers."

Figlio and Gordin say that, had the alleged "unauthorized intrusion" by GM's OnStar unit not occurred, they would not have incurred damages in the form of "increased insurance premiums" and difficulty in "obtaining vehicle insurance at reasonable premiums elsewhere." They also allege privacy breaches, breach of contract, and more.

OnStar, according to the suit, was founded in 1996 and produces driver assistance software for GM automobiles including Chevrolets, Buicks, Cadillacs, and GMCs.

[3]

Both drivers say they were "enrolled" in OnStar but never "knowingly agreed" to have their Driver Behavior Data "transmitted to unauthorized data brokers."

[4]

[5]

The suit adds:

Even for those that actively opted into The OnStar smart driver plan ... the software is marketed as a means of personalizing and enhancing "the driving experience" via improvements to safety, entertainment, navigation, and control of the vehicle in which the software is installed or linked. The software is not advertised as a means of invasively collecting consumer data for sale to third parties.

[6]Ford in reverse gear over AM radio removal after Congress threatens action

[7]Senate bill aims to stop Uncle Sam using facial recognition at airports

[8]YouTube accused of aiming ads at kids after promising it wouldn't do that

[9]Uncle Sam wants to know how big airlines use passenger data

The complaint also refers to the "WTF-level data collection" probe the Mozilla Foundation undertook in September 2023. The investigation is said to have [10]found that "a lot" of car companies "share and sell" data about owners, a report that prompted an investigation by US [11]Congress . The pair also cite another probe by the New York Times that the suit alleges "confirmed" what it termed "rampant privacy violations by the automobile industry generally, and GM, specifically."

Without implying the pair are bad drivers, the lawsuit raises an interesting proposition. If the claims were true, there would be some individuals' whose incredibly safe driving would be passively acting to lower the premiums.

'Out of context'

The suit claims the "risk score" is created after GM's OnStar allegedly transmits "private Driver Behavior Data to ... [consumer reporting agencies] LexisNexis and Verisk", which is "then transmitted" to insurance companies "without the driver's knowledge or consent" and is taken "out of context."

This, according to the complaint, is because the data was "surreptitiously collected," meaning it then precluded the drivers from providing a "reasonable explanation as to the various driving patterns depicted in this data, such as sudden stops." It's an interesting point. When is it an idiot doing a " [12]brake check " in a road rage incident, and when is it simply evidence that a vehicle is coming to a safe stop in a short period of time because the truck ahead of it is swinging from side to side?

Other metrics the suit alleges were recorded and transmitted without their consent include "average speed, frequency and intensity of acceleration and braking, percentage of time that the speed exceeds 80 mph" (128 kph+), as well as "late-night driving habits."

[13]

The plaintiffs are claiming GM, Onstar, LexisNexis and Veris Analytics violated the Fair Credit Reporting Act, the New Jersey Consumer Fraud Act, as well as privacy law, contract law, and consumer warranty legislation.

The suit seeks compensation, damages, and attorneys' fees. We've asked GM for comment. ®

Get our [14]Tech Resources



[1] https://regmedia.co.uk/2024/04/23/shutterstock_2350422457.jpg

[2] https://regmedia.co.uk/2024/04/23/1_24_cv_01669.pdf

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zigve6JmZXS48Gx63GVJwgAAAAg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zigve6JmZXS48Gx63GVJwgAAAAg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zigve6JmZXS48Gx63GVJwgAAAAg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2023/05/24/ford_backtracks_on_am_radio/

[7] https://www.theregister.com/2023/12/01/traveler_privacy_protection_act/

[8] https://www.theregister.com/2023/08/18/youtube_advertising_kids/

[9] https://www.theregister.com/2024/03/22/data_privacy_airlines/

[10] https://foundation.mozilla.org/en/privacynotincluded/articles/after-researching-cars-and-privacy-heres-what-keeps-us-up-at-night/

[11] https://www.markey.senate.gov/news/press-releases/senator-markey-urges-ftc-to-investigate-invasive-data-privacy-practices-of-automakers

[12] https://www.wikihow.com/Why-Do-People-Brake-Check

[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zigve6JmZXS48Gx63GVJwgAAAAg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[14] https://whitepapers.theregister.com/



cornetman

> Both drivers say they were "enrolled" in OnStar...

There's the problem right there. Once they get a foot in, they just cannot help themselves. Just don't let them in.

Re: Enrolled

Anonymous Coward

For new cars you are enrolled for one year free. With out your consent. And that might include when you buy a used car.

That is the business model Sirius radio uses. PITA to get Sirius to stop hounding you to sign up. As of a year or so ago you had to call support to get them to stop mailing you letters every week. If you tried to do it online, you had to sign into "your account"* to ask them to stop mailing you. Yes, the account you didn't create or want, you would have to make one to close it and tell them to .... off.

Apps

elsergiovolador

Manufacturers offering Apps should get slaps.

At every service visit car company offers to install a little device for free so that I can view all things about the car from the comfort of the app.

GTFO

Re: Apps

usbac

I would be careful to make sure they aren't doing it anyway, and just not telling you about it.

And now you see...

IGotOut

...why they want to ban Chinese EVs.

Can't have China collecting the data, there's no money in it for Corporate USA.

usbac

The question is, will these modern spymobiles even run if a person removes the radio unit?

I have a 2010 Chevrolet vehicle, and I removed the the RF transceiver from the OnStar radio unit. I did this soon after buying the vehicle, and I haven't had any issues in the years since.

I only use the dealership for things like recalls, and never for any other repairs. Mostly, I do my own work on my cars.

My other car is a 2013 Chrysler product, and it does not have any kind of radio unit in it. Only a GPS receiver for the nav system that is not enabled because I would not pay the ransom fee for the option.

I keep thinking I will need to buy a replacement vehicle or two before I retire, but I won't have anything that is "connected". Maybe I'm out of luck, and will have to keep these forever? Maybe some friendly car hackers will have patched software for these new cars that allow the removal of the radio transceiver?

I don't count on any government rules to stop this nonsense. It looks like the feds are actually encouraging more privacy violations with their requirements for driver monitoring.

I used to laugh when I saw retirees driving 30+ year old cars. Now I see the point.

Gene Cash

> retirees driving 30+ year old cars.

Another thing 30+ year old cars usually don't have are monthly loan payments. That's a hell of an incentive right there.

If you _really_ feel this strongly about the bug, you could
either try to increase the number of hours a day for all of
us or you could talk to my boss about hiring me as a consultant
to fix the problem for you on an emergency basis :)

- Rik van Riel explaining what to do against kernel bugs