The Texas Attorney General's Office sued General Motors, alleging the automaker is illegally collecting customer driving data from 1.5 million Texans and selling the information to insurance companies without the car owners' consent.
The Texas AG began investigating several car makers in June about their collection of massive amounts of driver data from GM brand vehicles to sell to third parties, including insurance companies.
The investigation revealed that GM used technology from vehicles for model years 2015 and newer to collect, record, analyze and transmit highly detailed driving data and then sold the information to companies about its customers. Two of the third parties used the data to generate “driving scores.”
Calls for improved security for increasingly connected vehicles have grown in recent years, but GM is the first to be sued in the state of Texas.
Cars that log more than miles
Nissan North America notified customers in May that personal information of current and former employees were lost in a ransomware attack, while customer information for BMW Concessionaires in Hong Kong was compromised in a breach of a third-party contractor.
Reuters reported in 2023 that private camera recordings captured by Tesla vehicles were shared in internal messaging systems among employees of Tesla Inc., including crashes, road-rage incidents and even video of a Tesla hitting a child who was riding a bike.
Voluntary enrolment is compulsorily
The Texas AG Office said in its filing that GM deceived customers by compelling them to enroll in its products such as OnStar Smart Driver as part of the vehicle’s “onboarding” process and that their vehicle’s safety features would be deactivated if they failed to do so. By enrolling in the products, customers unknowingly agreed to have their data collected and sold.
“Our investigation revealed that General Motors has engaged in egregious business practices that violated Texans’ privacy and broke the law. We will hold them accountable,” said Attorney General Ken Paxton in an Aug. 13 statement announcing the legal action. “Companies are using invasive technology to violate the rights of our citizens in unthinkable ways. Millions of American drivers wanted to buy a car, not a comprehensive surveillance system that unlawfully records information about every drive they take and sells their data to any company willing to pay for it.”
The state’s AG office launched a data privacy and security initiative in June to aggressively enforce Texas’ privacy laws.
