54 votes

GM sued for sale of OnStar driving data

23 comments

  1. [4]
    kfwyre
    Link
    cc: @Akir: This might turn into that class action lawsuit you were asking about. As someone who owns a GM car (2023 Chevy Bolt) and was recently surprised to find out I was being tracked, I can...

    cc: @Akir: This might turn into that class action lawsuit you were asking about.

    As someone who owns a GM car (2023 Chevy Bolt) and was recently surprised to find out I was being tracked, I can confidently call bullshit on GM's claims in the article. Their statement:

    “GM’s OnStar Smart Driver service is optional to customers, who give their consent three times before limited data is shared with an insurance carrier through a third party. Customer benefits include learning more about their safe driving behaviors or vehicle performance that, with their consent, may be used to obtain insurance quotes. Customers can also unenroll from Smart Driver at any time.”

    • The driving behavior insights can only be shared when a customer explicitly consents through an insurance carrier to have the data shared. This is after two other consents as well, one at the time of accepting privacy terms when enrolling in OnStar, and the other at the time of consenting to and enrolling in Smart Driver.

    I can confirm that I never explicitly consented, and I definitely did not do so through my insurance carrier. I also never enrolled in OnStar -- quite the opposite, actually: I declined the hard sell!

    As part of the car buying process, the salesperson sat me in the car and said something like "in order to get your car out of kiosk mode, we have to call OnStar." He pushed the button to call the representative and they gave me their pitch about safety and security and peace of mind. I already have and am quite happy with AAA (which is significantly cheaper than OnStar), so I explicitly declined OnStar services and said I wasn't interested. The rep said I could get three months free if I simply provided my credit card number; I said no. We hung up, and that was that.

    At no point was "OnStar Smart Driver" ever mentioned to me or discussed as part of my purchase of the car.

    Thinking that maybe it was buried in one of those documents I signed at the dealership, I dredged up and went through all of the PDF copies of all the forms that I signed. No mention of "OnStar Smart Driver" at all.

    46 votes
    1. krellor
      Link Parent
      I'm really curious to see what discovery turns up related to this. Did they really make that big of a screw up that they accidently sold the data of customers who didn't consent? Did they sell it...

      I'm really curious to see what discovery turns up related to this. Did they really make that big of a screw up that they accidently sold the data of customers who didn't consent? Did they sell it on purpose, and retroactively document enrollment/consent after realizing they screwed up? Was the consent buried or accidentally excluded? Or a mix of things?

      This will be an interesting case to watch since it seems like there are a lot of folks in your shoes who never used the feature that supposedly triggered the enrollment disclaimer.

      20 votes
    2. Habituallytired
      Link Parent
      We declined the hard sell for On Star, but kept the data package for our car (it's free for a year, so we decided it's fine). We declined all the data tracking, and even went so far as to fill out...

      We declined the hard sell for On Star, but kept the data package for our car (it's free for a year, so we decided it's fine). We declined all the data tracking, and even went so far as to fill out the delete my data requests from GM's website. When we checked LexisNexis, there wasn't any data on either of us, however, I still went through and did the data removal request. My husband and I checked when I first saw the post whether we were enrolled without our consent and thankfully we weren't, but I still don't trust GM, and this put us off ever buying another GM vehicle in the future.

      There is no reason for them to have our data at all - why is a third party that isn't my insurance company directly, included in my data.

      12 votes
    3. kfwyre
      Link Parent
      Update: After making the above comment, I requested my data from LexisNexis using their online form. Two weeks later I got a letter in the mail from them. Great! I can finally see what data they...

      Update:

      After making the above comment, I requested my data from LexisNexis using their online form.

      Two weeks later I got a letter in the mail from them. Great! I can finally see what data they have on me.

      I opened the letter, and it said they could not verify my identity documentation and thus could not release any information about me. Their proposed solution? Put in another request for info, but using their online form this time.

      You know, the same online form I already used.

      So, basically they gave me the runaround.

      Some people have been successful in getting their data, however, so if anyone is curious, there are people over at r/BoltEV who have shared samples of what they see in their reports.

      8 votes
  2. Habituallytired
    Link
    Good. I hope it becomes a class action suit. My rates haven't gone up over this, but I will be participating in the class action as someone who just bought a Bolt.

    Good. I hope it becomes a class action suit. My rates haven't gone up over this, but I will be participating in the class action as someone who just bought a Bolt.

    30 votes
  3. [14]
    krellor
    Link
    I think that what GM is doing is wrong, and even if they have disclaimers, they are not sufficiently prominent commensurate to what they are asking the customer to consent to. Having said that, I...

    I think that what GM is doing is wrong, and even if they have disclaimers, they are not sufficiently prominent commensurate to what they are asking the customer to consent to.

    Having said that, I can't deny a little schadenfreude at the thought of aggressive drivers having a bit of a comeuppance.

    19 votes
    1. [8]
      Sodliddesu
      Link Parent
      Right? Even as outraged as I am about the tracking of my data, I'd be happy if every bad driver out there got their rates jacked up for not using their turn signals... But, the truth is, all our...

      Right? Even as outraged as I am about the tracking of my data, I'd be happy if every bad driver out there got their rates jacked up for not using their turn signals...

      But, the truth is, all our rates would go up because I share the road with them and the insurance company would just pocket all the extra.

      14 votes
      1. [7]
        krellor
        (edited )
        Link Parent
        My big question personally is the methodology used to determine risk bands for drivers based on the data. "Hard brake" could mean lots of things, and if they have a figure in newtons or stopping...

        My big question personally is the methodology used to determine risk bands for drivers based on the data. "Hard brake" could mean lots of things, and if they have a figure in newtons or stopping distance, etc, it wouldn't mean anything to me in terms of "drive feel."

        I would actually be really interested in taking a driving class that has you go through the different accelerations, breaking events, turns, etc, that bucket you at low risk, medium risk, and high risk. I'd like to know if what looks dangerous on paper feels dangerous on the road. That and I'm a huge data nerd.

        Edit: I'd also bet that they are using supervised learning using data from drivers that they know have at-fault events, and then use the model to categorize other drivers based on risk. But I'd still want to get a feel for the threshold that the model associates with higher risk.

        9 votes
        1. [4]
          Sodliddesu
          Link Parent
          The data is neat but the onboard computers aren't perfect. The 'auto brake' has more then once gone off while using the adaptive cruise and the lane departure system can't for the life of it deal...

          The data is neat but the onboard computers aren't perfect. The 'auto brake' has more then once gone off while using the adaptive cruise and the lane departure system can't for the life of it deal with roads around me. Do those count against me? What RPM range counts as "hard acceleration" when the cruise control is happy to kiss up to 3k RPM to accelerate? How does the company selling my data assess my risk level when I swerve or 'hard brake' to avoid an accident vs due to me staring at my phone?

          It's the same as the apps that track your phone usage in the car. I can't hand my phone off to my partner to change the GPS or tunes, otherwise my insurance rates go up?

          I like the idea of having all that data for me, ya know?

          10 votes
          1. krellor
            Link Parent
            Exactly, there's a big gap between theory and practice. In theory, if everyone's cars have the same rates of deviations not related to at-fault events, then it all comes out in the wash. But what...

            Exactly, there's a big gap between theory and practice. In theory, if everyone's cars have the same rates of deviations not related to at-fault events, then it all comes out in the wash.

            But what is the recourse for an outlier, whose vehicle experiences enough deviations that it impacts their score?

            This is the importance of legislation that prevents making important decisions with machine learning models that aren't explainable.

            4 votes
          2. vord
            Link Parent
            5th Element future, calling it now.

            5th Element future, calling it now.

            2 votes
          3. Habituallytired
            Link Parent
            I had my autobrake go off last week because someone pulled into my lane from a dead stop with no turn signal while they had a red light and I had a green to turn (it was at an odd intersection...

            I had my autobrake go off last week because someone pulled into my lane from a dead stop with no turn signal while they had a red light and I had a green to turn (it was at an odd intersection where the right turning lane is a different light than the straight lane. If my rate is going to go up because someone almost hit me to the point the safety measure went off in my car, that's not fair to me when I was doing everything right and the safety measure went off anyway to protect me.

            2 votes
        2. [2]
          kfwyre
          Link Parent
          Before I deleted my data, I peeked through a few of my trips. I am a very defensive driver, and I’m far from a lead foot. My friends make fun of me for driving “like the elderly,” so take the...

          Before I deleted my data, I peeked through a few of my trips. I am a very defensive driver, and I’m far from a lead foot. My friends make fun of me for driving “like the elderly,” so take the following as you will:

          My commute consistently had two hard accelerations in the same places: each was when I was entering a highway.

          Hard brakings were less consistent, but they weren’t exactly rare: maybe one or two every other trip or so.

          6 votes
          1. krellor
            Link Parent
            I would suspect that it's not the number of those events in absolute terms that is used, but I could be wrong. It is likely the association with patterns of events correlated with at-fault events...

            I would suspect that it's not the number of those events in absolute terms that is used, but I could be wrong. It is likely the association with patterns of events correlated with at-fault events that the system looks for.

            But still, if they can't explain the model, or if they are just doing some simplistic numerical method, then they shouldn't be able to use it to make decisions that adversely impact people.

            It sure sounds like the insurance companies are trying to spin things a certain way by reporting the number of events to the customers, when the number of events alone is only a part of what would correlate to at-fault events.

            4 votes
    2. [5]
      CptBluebear
      Link Parent
      Who says any of these people are aggressive drivers? In fact, who determines what is hard braking and fast acceleration? Hell, who even determines what speeding is? Road speeds change and my...

      Having said that, I can't deny a little schadenfreude at the thought of aggressive drivers having a bit of a comeuppance.

      Who says any of these people are aggressive drivers? In fact, who determines what is hard braking and fast acceleration? Hell, who even determines what speeding is? Road speeds change and my Google Maps is often lagging behind with updating the speeds to the new level. I'm not speeding, but Maps sometimes thinks I am.

      Even if hard braking is well defined, I can brake with the explicit purpose of keeping myself and everyone around me safe through the mistake of another driver. Having that count against me is absurd.

      None of this makes sense, none of this is actively stopping "aggressive" drivers in the slightest.

      11 votes
      1. Nsutdwa
        Link Parent
        Yes, where I live, there are a few junctions (new, laid down in the last five years or so) that are just awful, and have no useful merge lane. You have to accelerate hard to get up to ~100kmh in a...

        Yes, where I live, there are a few junctions (new, laid down in the last five years or so) that are just awful, and have no useful merge lane. You have to accelerate hard to get up to ~100kmh in a very short space so that you can join safely, and thh support columns of a flyover block you from having a good view of oncoming traffic, it's awful.

        Or this one, that I used to drive on regularly: https://maps.app.goo.gl/p7yzs4ccfu5NKaSM8
        I used to regularly have to cross that river going north, and I can tell you that the whole bridge on the left carrying the A683 there is new. You can see the old slip lane to the M6 marked as "NO ENTRY" and it has a gate barring access. That slip lane was awful, you had to accelerate hard to get up to motorway speed, no wonder they've built a new bridge. But if you have to drive on roads like that, "aggressive acceleration" is the safe option, it feels harsh to punish that.

        7 votes
      2. [3]
        krellor
        Link Parent
        Did I say that any one in the article or in this situation is an aggressive driver, or deserved what happened? Or did I say that the idea of aggressive drivers getting a comeuppance was...

        Did I say that any one in the article or in this situation is an aggressive driver, or deserved what happened? Or did I say that the idea of aggressive drivers getting a comeuppance was entertaining?

        I think if you read the rest of the thread you will see a good discussion about the concerns here, questions about what do these events really mean, and conjectures over the use of machine learning classification algorithms.

        2 votes
        1. [2]
          CptBluebear
          Link Parent
          No you didn't, and I knew you didn't because I saw your other replies. I latched onto that part because it made me think what aggressive drivers are in this situation. Not my intention to attack...

          No you didn't, and I knew you didn't because I saw your other replies. I latched onto that part because it made me think what aggressive drivers are in this situation.

          Not my intention to attack you, if there's frustration in my post it's toward data harvesting.

          5 votes
          1. krellor
            Link Parent
            No worries, have a great day!

            No worries, have a great day!

            3 votes
  4. kfwyre
    Link
    Follow-up to: Automakers are sharing consumers’ driving behavior with insurance companies

    Follow-up to: Automakers are sharing consumers’ driving behavior with insurance companies

    Romeo Chicco, a GM customer in Florida, has filed a federal lawsuit against General Motors and LexisNexis Risk Solutions alleging violation of privacy and consumer protection laws as a result of unauthorized sharing of his driving data. The data was allegedly shared through the GM OnStar Smart Driver program, which Chicco claims he never enrolled in. Chicco claims that the data sharing resulted in significantly elevated insurance premiums.

    According to a report from The New York Times, Chicco was rejected by seven auto insurance companies late last year before he discovered that driving habits in his 2021 Cadillac XT6 were shared with insurers, leading to significantly higher insurance rates. The data highlighted 258 trips made over the course of six months, including instances of speeding, hard braking and acceleration, and when the trips started and ended.

    10 votes
  5. ACEmat
    Link
    These kind of articles are always kind of bittersweet. Like on the one hand, I'm happy someone is taking this crap to court, but on the other hand, of course it's some rich ass who drives like a...

    These kind of articles are always kind of bittersweet.

    Like on the one hand, I'm happy someone is taking this crap to court, but on the other hand, of course it's some rich ass who drives like a turd doing it.

    6 votes
  6. [2]
    gowestyoungman
    Link
    This data collection by GM is annoying, but at least its a pretense of an opt in program. What worries me MUCH more is that every EV being produced is not only a rolling data collection center,...

    This data collection by GM is annoying, but at least its a pretense of an opt in program. What worries me MUCH more is that every EV being produced is not only a rolling data collection center, with Over The Air communication being a standard "feature" and if its a multi camera Tesla its also a rolling surveillance center. The thought of any kind of 'freedom' or privacy in your own vehicle is absolutely gone.

    Fortunately my non connected vehicles are good enough to last another 5 years. When they're done I will buy more 'old tech' non OTA cars and will never buy a car that tracks me. Screw Big Brother, we dont need more spies in our houses, cars and on our phones.

    Old man done yelling at the cloud now.

    5 votes
    1. JackA
      Link Parent
      It's not even just EV's. I own a Mazda and recently found out they all have a designated telemetry unit phoning home as soon as they roll out of the factory. You have to call a designated number...

      It's not even just EV's. I own a Mazda and recently found out they all have a designated telemetry unit phoning home as soon as they roll out of the factory. You have to call a designated number to permanently disable it for your car and it stays activated between transfers of ownership.

      https://www.mazdausa.com/site/privacy-connectedservices :

      All of our Connected Vehicles contain an in-vehicle Telematics Control Unit (TCU), which is activated on or before the Connected Vehicle’s delivery to a Mazda Dealer, and allows us to collect and transmit certain Default Data from the Connected Vehicle. The Default Data is generated within the Connected Vehicle, collected by either the TCU or other in-vehicle system (excluding the Electronic Data Recorder (EDR)), and transmitted to us via the TCU.

      WE AUTOMATICALLY COLLECT CERTAIN DEFAULT DATA FROM THE CONNECTED VEHICLE ON AN ONGOING BASIS. ONLY WE CAN DEACTIVATE THE TCU AND DISABLE OUR COLLECTION OF ALL DEFAULT DATA. NOTE THAT THE SALE, TRANSFER, OR LEASE TERMINATION OF A CONNECTED VEHICLE WILL NOT DISABLE AUTOMATIC DEFAULT DATA COLLECTION.

      “Default Data” includes the following:

      “Driving Data”: driving behavior data, which includes the acceleration and speed at which your Connected Vehicle is driven and use of the steering and braking functions in your Connected Vehicle (Driving Data is collected for each driving trip and transmitted at each Ignition Off); and

      “Vehicle Health Data”: includes Vehicle Identification Number (VIN); odometer, fuel level, and oil life readings; Diagnostic Trouble Codes (DTCs); and data from the Connected Vehicle’s OBD system (“OBD Data”). OBD Data includes, but is not limited to, engine coolant temperature, fuel injection volume, engine Rotation Per Minute (RPM), and the status of doors, hood, trunk, and hazard lights (Vehicle Health Data is transmitted at each Ignition-Off).

      Note: Model Year 2019 – 2021 Mazda3 and Model Year 2020 – 2021 CX-30 vehicles collect geo-location coordinates of the Connected Vehicle’s latitude and longitude each time the Connected Vehicle is turned off as Default Data.

      I don't know if they're selling it (yet) like GM is here, but the amount of data collection in almost all modern cars (even in a company known for being behind the game in EV's) is insane.

      9 votes