Class Action Against General Motors LLC, OnStar LLC, LexisNexis Risk Solutions [pdf]

We are going to learn so many disturbing things that data brokers (which includes basically every large corporation) are doing in the next years.

From the complaint:

Plaintiff did not want OnStar services and so he did not push the blue button "to get started." The email provides no mention of OnStar's Smart Driver Program.

…

In or around January 2024, Plaintiff received his requested LexisNexis consumer disclosure. The report, as of December 18, 2023, had 258 recorded driving events under the "Telematics" subsection. Each driving event included trip details that show the start date, end date, start time, end time, acceleration events, hard brake events, high speed events, distance, and VIN.

…

Plaintiff had never opted into any insurance program that would have allowed his information to be shared.

Related: "Automakers are sharing consumers' driving behavior with insurance companies" - https://news.ycombinator.com/item?id=39666976

And if you own a car made in the last ~5 years, here's how to request your "Consumer Disclosure Report" from LexisNexis: https://consumer.risk.lexisnexis.com/ . According to NYT, LexisNexis receives at least some data from GM, Ford, Kia, Subaru, and Mitsubishi.

Or from Verisk, which receives data from at least GM, Hyundai, and Honda: https://fcra.verisk.com/#/

GM is trying really hard to not get my business in the future. Between the no Car Play and Android Auto support in their new EVs. Now this. I'm just tired man...

Is there a practical way to block any outgoing communication and telemetry from getting sent? Like a Little Snitch but for your car?

Leave it to data brokers and insurance companies to make the leap "ick" to outrage.

On the other hand... to all selfish, unsafe street-racing, road-hogging Cadillac XT6 drivers out there: may your insurance rates double and may you swim forever in a sea of adverse underwriting decisions.

I recently bought a Toyota because I was able to push the "SOS" button in the car and request that they disable telematics right after I bought it. I don't know whether they've actually stopped collecting my location information or if they can arbitrarily re-enable telematics at some time in the future for whatever reason, so I've additionally pulled a fuse that powers the transmitter. I'm mulling wrapping some components in a Faraday cage just for good measure.

The ability to prevent the car from spying on me was near the top of my list of desired features when I was shopping for a new car. This is one of the main things keeping me from buying another EV. So far as I'm aware there is nothing on the market where I live that won't constantly spy on you with no option to disable.

This article from Mozilla is worth a read: https://foundation.mozilla.org/en/privacynotincluded/article...

Is it possible to wrap “cellular connection” module in copper mesh to cut it off from sending data?

Collecting and storing personal data needs to be exorbitantly expensive.

LexisNexis knew exactly what they were doing and probably already factored in litigation costs to the product.

Experian should have been fined out of existence when they lost all that data. The light of their funeral pyre could have warned away companies headed down the same path.

The secrecy is ick, but this is the future and there’s no stopping it.

There’s ample evidence that consumers won’t pay for privacy and as most consumers opt in to data sharing programs, the non-data-sharing cohort will get seriously adverse further raising the price of privacy. The equilibrium state is that only bad actors and a handful of privacy zealots will inhabit that pool and mainstream carriers won’t even bid it.

Telematics should be disabled, preferably by way of hard cutting the modem chip's V-in. Call me a tinfoil hat lover, but when 23andme gets bought by an insurance company, the similarities with potential insurability issues are numerous when data is available to the other without a big, shining red opt-in.

I have obtained an email from GM stating that if I am an OnStar Smart Driver subscriber, I cannot opt out of my data being shared. I believe this violates at least California privacy regulations, probably some other states, which mandate opt outs. I seriously want to rip the modem out of my car.

Nice thing is that tracking via cellular never stops working but if you are in an emergency they will not call emergency services for you if you don't pay the subscription.

Clearly your data are more important than you

lmfao this is why my newest car is from 1999. Computers ruin everything. Be warned.

We need a privacy bill of rights. The fact is that no other approach works.

Has Subaru been doing this as well with their STARLINK?

I understand that my opinion on this matter may be controversial, but I feel compelled to share my experiences. In the past five years, I've noticed a significant increase in aggressive driving. I've been the victim of two hit-and-run incidents where I was rear-ended, and the drivers fled the scene. In a third incident, a driver collided with the side of my car as the road curved and had the audacity to tell the police that I was at fault. In Texas, I've witnessed rampant red-light running, failure to stop at stop signs, excessive speeding (more than 15 mph over the limit), tailgating, and failure to use turn signals.

I believe that telematics could be a valuable tool in addressing this issue by scoring drivers based on their driving habits and adjusting their insurance rates accordingly. This would not only encourage safer driving practices but also ensure that responsible drivers are not unfairly penalized for the actions of aggressive drivers. In my opinion, telematics should be required for operating a vehicle on public roads.

Is there a hardware hacking forum that would teach people how to modify their rig to use the good features of such devices regardless of manufacturer but intercept and modify telemetry data to feed them realistic looking but fake data until you press a distress button and them give real location? I ask because I do not trust the legal system to ever catch up to this globally or to have any real teeth that make companies feel real pain. I've played whack-a-mole with spammers and malware distributors. This feels the same to me. Until it becomes trivial to disable such things I personally will stick with fixing up used vehicles that I know are free of loose lips.

Buried in the complaint is an interesting part about why he lost his original insurance carrier, they stopped writing policies in FL. The personal injury lawyers in Florida are out of control. There are also a ton of staged accident rings that nobody is doing anything about. I’m surprised any insurance carriers exist in that state anymore.

I recently requested a quote while insurance shopping, and progressive seems to have already associated driving telematics history with one of my vehicles (a 2015 Chevy product).

Request your data now:

https://consumer.risk.lexisnexis.com/request

Anyone know where VW sitting on this general topic?

Companion nytimes article for anyone interested: https://archive.ph/MVmoX

This is at least a Florida lawsuit. I'm pretty sure the practice violates California law as well.

While I dislike how little practical enforcement there is against the pervasive surveillance by ad-tech companies, this is one of the things that GDPR works wonders against:

No sane company would want to participate in such a scheme in Europe. Both the seller and the buyers would be on the hook for massive GDPR fines, and unlike a tech company where the privacy violations might be contributing 50% of the revenue and which could thus easily consider a 4% of revenue fine once every few years a (small) cost of doing business, car companies can't afford that.

General Motors had a global revenue of $172 billion, net income $10B, and the data sales are only a small part of that.

The intermediate company that's buying the data and reselling it to car manufacturers could potentially try to get away with it, because their entire business model depends on it, so they have little to lose. Just make sure to keep no money in the company because once the DPAs learn of the business the company a) has no business model because they will prohibit continued buying/selling of the data b) is likely to be bankrupted by the fine that might well exceed their entire revenue (for smaller companies, the fine isn't capped to 4% of revenue, the limit is 20M EUR).

For the insurance companies that would be buying this data I'd imagine it's even worse.

And this sort of egregious thing is something I can see DPAs actually enforcing, because it'd be much more clear cut than tech companies using non-compliant consent banners.

Edit: And I forgot the most important thing - if they don't put it into their privacy policy they're even more screwed, and if they do put it there, a customer who finds it can get it enforced by sending an e-mail (or in Germany, letter, because some DPAs don't accept e-mail) rather than finding a lawyer willing to start a class action.

OnStar is one of those features that has desperately tried to claim is somehow different than the features your phone already provides.

The complaint is for:

• Violations of the Fair Credit Reporting Act (FCRA) due to the alleged improper sharing and reporting of plaintiffs' driving data without consent, impacting their ability to secure car insurance and leading to increased rates.

• Violations of the Florida Deceptive and Unfair Trade Practices Act, accusing the defendants of engaging in deceptive practices by sharing personal driving data without the knowledge or consent of the car owners.

• Invasions of privacy under Florida common law, arguing that the defendants' actions of tracking, collecting, and sharing personal driving data without consent intrude upon the plaintiffs' private lives and are offensive.

Reading this got me cheering out loud for the plaintiff. I'm so glad to see someone taking these bastards to court.

I can relate in some small way to part of his ordeal - not with GM specifically, but I don't know how many times I've been stuck in a loop with companies who have no idea what happens to your data they hoover up and can't explain or answer even the most basic questions on that topic - and are confused as to why you are even asking.

I hope this gets its class action certification and jury trial, and I'm looking forward to kicking back with a bag of popcorn and watching the show. If he started a GoFundMe or something I'd be happy to make a substantial contribution to his legal fees.

It's long past the time bad actors like this who give you no real choice or control over the products you are buying start to be brought to justice.

In this age of cars I want dumb cars with an engine that I could optionally plug in my smart thing if I wanted.

Even Toyota has gone too smart with their in tune crap.

Give me a cockroach car that survives for 50 years. No other bells and whistles. Just some connectors for them.

I wounder if this is true for older vehicles. I have 2018 vehicle with OnStar that is definitely has cell access (I could start it remotely).

How much do they actually get for this per vehicle?

I feel like the answer to the that would explain a lot.

How we came to a stage where your iris is being monitored in your car, including mic and video recording and all your contact being uploaded as soon as you connect to the entertainment sys... and nobody gives a fuck. It's beyond my understanding.

I’m sure GM has a formula for this.

https://www.youtube.com/watch?v=SiB8GVMNJkE

But what if the automakers' solution going forward is to not make the feature optional? That the service gets baked into the price? They turn it on. They leave it on. Especially with a lease, won't they have a legal angle to protecting their property?

My concern this might become a "be careful what you wish for"?

nothing will happen until heads literally roll, everything else is just business.

Hopefully more class action lawsuits follow for other car manufacturers...

Ford knows when you break the law: https://www.businessinsider.com/ford-exec-gps-2014-1

I wonder if they also share their data or if they were trying to find customers for the data.

This is good news. I hope this serves as inspiration for future cases against app developers, Google, Microsoft, Facebook, and all who are not upfront about their data and privacy practices.

This all makes me so angry. It's so messed up.