GM Secretly Sold California Drivers' Data, Agrees to Pay $12.75M In Privacy Settlement (ca.gov) 41
"General Motors sold the data of California drivers without their knowledge or consent," says California's attorney general, "and despite numerous statements reassuring drivers that it would not do so."
In 2024, The New York Times "reported that automakers including GM were sharing information about their customers' driving behavior with insurance companies," remembers TechCrunch, "and that some customers were concerned that their insurance rates had gone up as a result."
Now General Motors "has reached a privacy-related settlement with a group of law enforcement agencies led by California Attorney General Rob Bonta..." The settlement announcement from Bonta's office similarly alleges that GM sold "the names, contact information, geolocation data, and driving behavior data of hundreds of thousands of Californians" to Verisk Analytics and LexisNexis Risk Solutions, which are both data brokers. Bonta's office further alleges that this data was collected through GM's OnStar program, and that the company made roughly $20 million from data sales.
However, Bonta's office also said the data did not lead to increased insurance prices in California, "likely because under California's insurance laws, insurers are prohibited from using driving data to set insurance rates." As part of the settlement, GM has agreed to pay $12.75 million in civil penalties and to stop selling driving data to any consumer reporting agencies for five years, Bonta's office said. GM has also agreed to delete any driver data that it still retains within 180 days (unless it obtains consent from customers), and to request that Lexis and Verisk delete that data.
"This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians," according to the attorney general's announcement. The settlement "requires General Motors to abandon these illegal practices, and underscores the importance of the data minimization in California's privacy law — companies can't just hold on to data and use it later for another purpose."
"Modern cars are rolling data collection machines," said San Francisco District Attorney Brooke Jenkins. "Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are... This case sends a strong message that law enforcement will take action when California privacy laws are not scrupulously followed."
In 2024, The New York Times "reported that automakers including GM were sharing information about their customers' driving behavior with insurance companies," remembers TechCrunch, "and that some customers were concerned that their insurance rates had gone up as a result."
Now General Motors "has reached a privacy-related settlement with a group of law enforcement agencies led by California Attorney General Rob Bonta..." The settlement announcement from Bonta's office similarly alleges that GM sold "the names, contact information, geolocation data, and driving behavior data of hundreds of thousands of Californians" to Verisk Analytics and LexisNexis Risk Solutions, which are both data brokers. Bonta's office further alleges that this data was collected through GM's OnStar program, and that the company made roughly $20 million from data sales.
However, Bonta's office also said the data did not lead to increased insurance prices in California, "likely because under California's insurance laws, insurers are prohibited from using driving data to set insurance rates." As part of the settlement, GM has agreed to pay $12.75 million in civil penalties and to stop selling driving data to any consumer reporting agencies for five years, Bonta's office said. GM has also agreed to delete any driver data that it still retains within 180 days (unless it obtains consent from customers), and to request that Lexis and Verisk delete that data.
"This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians," according to the attorney general's announcement. The settlement "requires General Motors to abandon these illegal practices, and underscores the importance of the data minimization in California's privacy law — companies can't just hold on to data and use it later for another purpose."
"Modern cars are rolling data collection machines," said San Francisco District Attorney Brooke Jenkins. "Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are... This case sends a strong message that law enforcement will take action when California privacy laws are not scrupulously followed."
MBA strikes again (Score:3)
Re:MBA strikes again (Score:5, Insightful)
....the company made roughly $20 million from data sales.
Which means that the fine must be more than $20 Million, otherwise, what's the point?
Spend 12, make 20. Sounds like a good deal that will be repeated in the future.
Re: (Score:3)
$12.75M plus legal expenses plus future lawsuits by GM vehicle owners and other states.
Re: (Score:2)
GM could argue that that language in the EULA/TOS/lease includes wording that allows for collecting and selling that information... do the newer vehicles have a built-in cell connection for the GPS to use or do you always have to pair your phone with the infotainment system so it has data?
Same thing with cell phones, and OS installations... there's always language in there that allows for the _potential_ collection of data and selling that data to whoever.
Re: (Score:3)
A fine paid by the business will not change behaviour of managers -- who just profited (got bigger bonuses) from this. The decision makers need life changing fines or prison time. Managers in other companies will see this, decide that they do not want the same and so behave.
Re: (Score:1)
Re: (Score:2)
We are missing a HUGE point. It is illegal for insurance companies to use this data to adjust their pricing.
So why would the insurance companies be buying this data?
Time to start investigations on when they received the data and when their customers started receiving increases in insurance rates.
Operating Expenses (Score:3)
GM has agreed to pay $12.75 million in civil penalties
That is called a transaction fee. Is this intended to be a deterrent, or just a concern that the government isn't getting their cut?
Re: (Score:2)
That is called a transaction fee. Is this intended to be a deterrent, or just a concern that the government isn't getting their cut?
You've both asked, and answered, your own question.
Re: (Score:2)
the company made roughly $20 million from data sales GM has agreed to pay $12.75 million in civil penalties That is called a transaction fee. Is this intended to be a deterrent, or just a concern that the government isn't getting their cut?
The fine was 63%, which would be a pretty stiff "transaction" fee. That said, the fine should be more than what GM earned to be a real deterrent/penalty, though I don't know what GM also paid in legal fees defending themselves...
Re: (Score:2)
This
Very odd... (Score:2)
So, we're expected to believe the insurance companies were paying GM twenty million for that data out of simple curiosity?
If they were simply doing aggregate metrics, the data wouldn't have involved the driver's names. That's a thing one should definitely not be including when one has already been telling the victims it won't be shared.
It seems more to me like the data brokers were interested in paying GM a bit of money because to the data broker it "would be cool" if their customers could literally purcha
Hey GM (Score:1)
Hey GM, fuck you and the rolling data collection machine you rode in on.
Why so little? (Score:5, Insightful)
Re: (Score:2)
They get a slap on the wrist with a soggy bus ticket and get told in effect "Don't get caught again"
Not rich on the other hand pirate one music track and it easily 1000 times what its retail price is
Justice may be blind, but its tacking kickbacks....
Because Donald Trump is president (Score:3, Insightful)
Basically right now and for the foreseeable future it is open season on consumers. Keep an eye on any elderly relatives you have that you care enough about to potentially be forced to bail out.
Re: (Score:2)
And I am not so sure the US deserves saving either.
So they made a profit? (Score:4, Insightful)
So let me get this straight. They sold data they shouldn't have for $20 million. They settled for $12.75 million. So they made a profit of $7.25 million. So what exactly is the incentive for them not to do this again? They don't make as much as they want if they get caught, but they still make money. This is how you encourage companies to do this, not discourage them.
Re: (Score:2)
They can continue to do what they like so long as its kept a better secret.
Its grossly unfair to punish rich people and corporations.
Re: (Score:2)
I'll assume (probably incorrectly) that they $20M was for total sales across all states. Fines aren't enough. The people running these companies need to be held accountable... and that ain't happening.
Soo, does my Chevy contain spyware? (Score:3)
Re:Soo, does my Chevy contain spyware? (Score:4, Interesting)
If you have one that has cellular connectivity and an infotainment system, espeically EV's, the only way that I have found is to track down the telematics module for your car and locate the antenna connector and put a resistor on it to disable it completely. Just disconnecting the shark fin is not enough since the wire itself or even just the connector can function enough that it can still get signal through when it is in areas with very strong signal. But then you use something like a mobile 4G/5G hotspot with true firewall capability and connect the car to that through its ability to use external wifi. Then you block access to GM and onstar sites while still letting things like google maps through for nav so that you don't brick your entire infotainment system. This is what I do on both of my GM EV's.
Every new car has it... (Score:2)
You can find a remote telematics/data collection module and remove cell modem. This is A LOT of work as these modules tend to be deep in the dash. You can dis
Security (Score:4, Interesting)
When are people going to insist that cars are owned by the owner? Security should have no component of trust. Locking out a manufacturer from a connected thing should be something that is enshrined by law. Zero trust is the gold standard worldwide and there should be no trust involved. If something is connected, the owner should be able to force verify what is being sent over that connection and should be able to do it in a way that does not tip off the device that it is being watched that would allow it to change behavior. Manufacturers are not trustworthy and never will be and the owners should always have the ability to lock them out unless there is a documented need for them to communicate with the vehicle. And that means without bricking things like navigation, EV charger finding etc. In other words, the connectivity should be 100% in control of the owner of the device up to and including the law enforced ability to load owner certs on the device and inspect all traffic in and out and block any traffic that does not work in the owners interest. For EV's especially, these things are connected to the grid for God's sake... WHY are the owners not allowed to sandbox these things and only allow them to be communicated with (other than nav or audio video streaming) when there is no documented need for it to happen? Leaving them permanently open to the internet is patently ridiculous from a security perspective. And trusting the manufacturers to do the right thing is just as ridiculous from the privacy side. Trust is not a security or privacy model. Owners should have the ability to ENFORCE it.
On Star Phone Home (Score:2)
Re: (Score:2)
In my younger and more foolish days I had a Pontiac and I opted out with wire cutters to the Surveillance module's power cables.
At the time I was actually more concerned with remote unlock hijacking than tracking but still I didn't trust GM.
All together now: WE TOLD YOU SO.
If I had to guess 20 years later doing that would disable the ECU.
Re: (Score:2)
THIS is why anybody with any brains would NEVER EVER buy a new car with this bullshit in it. I'm 76 and my car is a 13 year old 2013 and I'll keep it running till I shuffle off mortality. Even if I had Musk's wealth, I'd STILL never buy one of these rolling tattle-tales...
Thats great and all (Score:2)
So they made 20 million dollars (Score:3)
And got fined about 12 million dollars.
That is nice.
Good drivers subsidizing bad drivers (Score:2)
I gather the intent of the privacy law is to make sure that bad drivers are subsidized by good drivers. After all, you shouldn't have to pay higher insurance rates just because you're a road hazard... I guess...
Thank goodness ... (Score:2)
Pfffft... (Score:2)
Wake me up when the penalty gets into the mid hundreds-of-millions. Until then it's just a cost-of-business that already appeared - probably at well over 12 million bucks - as a line item in a budget which existed long before the penalty was assessed.
Such fines are mere theatre. It's a show that keeps the rubes entertained, while simultaneously distracting them from the financial and privacy-oriented ass raping inflicted on them daily with the tacit assent of their government and regulatory agencies.
More pe
We need a clearinghouse for disabling car modems (Score:2)
Some intrepid sould would be forever thanked if they hosted a site (offshore, safe from DMCA takedowns) with user-contributed instructions on how to remove or disable the cellular modem on popular car models.
If they want my data, they need to pay for it. By, for example, making the car free or steeply discounted. Until then, fuck off.
The obvious is missing from this conversation (Score:2)
disgorgement & liability (Score:2)
GM needs to be made to disgorge every dime they made selling that data.
They need to disclose who purchased the data and what the price was.
Every victim of this privacy violation needs legal recourse and class action seems like it would be best for the masses.
Anyone who can show significant harm should aggressively pursue all parties involved.
The only way this behavior will stop is when engaging in it brings bitter pain.
Stern words for mass privacy invasion (Score:2)
I owned one Chevy (Score:2)
Let's show them (Score:1)