GM Should Have Known OnStar Data Painted 'Incomplete Picture': Class Action

General Motors' “about-face” decision to stop selling driver data from OnStar-equipped vehicles, shortly after a March New York Times article that “exposed its deficient privacy practices,” supports the assertion that “its customers were not aware of GM’s surreptitious data collection and sharing,” alleged a class action (docket 4:24-cv-11221) Wednesday in U.S. District Court for Eastern Michigan in Flint.

GM’s “clandestine” data sharing practices had been operating “in secret” until late last year when they were first exposed by a Mozilla Foundation report, followed by a congressional inquiry and then the March 11 Times investigative report, the complaint said. The carmaker announced March 22 it would stop sharing driver data with LexisNexis and Verisk. On April 24, GM said it was discontinuing the OnStar Smart Driver program, under which it had been selling customer driving behavior to the data analytics companies, it said.

GM claimed to collect and share driver data with insurance companies only with customers’ “express consent,” said the complaint, but the company “routinely violated its promises to customers,” and its own privacy policy and terms of service, by secretly sharing the driver data with LexisNexis and Verisk. The data analytics companies “analyzed the data to assign a driver report score, like a credit score, which it then sold to insurance companies, resulting in premium increases, inflated quotes, and insurance rejections,” alleged the complaint.

For class members who knowingly enrolled in the OnStar Smart Driver programs, GM “did not adequately disclose how driver data would be used,” said the complaint. The company didn’t obtain consent to share personal and identifiable driver behavior data with third-parties, including insurance companies, the complaint said.

On the FAQ page for the Smart Driver program, GM represented that it “would not” share driver data with insurers without customers’ express consent, the complaint said. But no terms in GM’s terms of service, privacy policy or other documents would constitute “express consent” to sell customer data to insurance companies and data brokers, the complaint said. “To the contrary,” the complaint said, “many of these documents and terms foreclose any ability for GM to surreptitiously sell this data.”

“Worse,” GM also collected driver data from class members who didn’t opt in to the Smart Driver program, alleged the complaint. Even though those customers hadn’t enrolled in the program, or had opted out, GM sent their data to data brokers such as LexisNexis or Verisk, it said.

The driver data that GM collected and sold was “flawed and was often inaccurate or incomplete,” the complaint alleged. Though GM knew that insurance companies would likely rely on the “flawed driver data” to decide whether to provide insurance, and to calculate premiums, it “sold it anyway,” it said. As a result, “millions” of GM customers who had no knowledge that their data was being sold have been harmed, the complaint alleged.

Defendants LexisNexis and Verisk obtain driver behavior from GM and OnStar and furnish it to third parties, including car insurance companies, without plaintiffs’ and class members’ consent, the complaint said. They prepared “inaccurate, flawed, and materially misleading reports” relating to plaintiffs Manuel and Kathleen Martinez of Kansas, owners of a 2023 GMC Yukon, based on driver behavior data collected by GM and OnStar without their consent, the complaint alleged.

GM sales agents put the MyGMC vehicle app on Kathleen Martinez’s phone and enrolled her in OnStar, but she never knowingly consented to having her driving behavior collected or shared with data brokers or insurance companies, the complaint said. The Martinezes didn’t have a “usage-based insurance plan” that allows an insurer to obtain driving information via an onboard device to "presumably offer potentially lower rates for good driving,” it said.

The couple shares driving on the Yukon, and much of the driving data collected and shared “is improperly and inaccurately associated with” Manuel Martinez “given that he was not the primary driver of the vehicle,” said the complaint. As a result of GM’s “wrongful and unconsented sharing of their driver data,” the Martinezes have been “deprived of the opportunity to control their own data,” alleged the complaint, and their data, after being sold and “widely dispersed, cannot be reclaimed.” The GM defendants knew or should have known that much of the driver data OnStar gathered “painted a fundamentally flawed and incomplete picture of its customers’ driving records,” the complaint said.

GM’s OnStar subscription plans -- for safety and connectivity-focused services including roadside assistance, automatic crash response, remote vehicle access, and turn-by-turn navigation -- had been available to users as an optional fee prior to 2022. In June of that year, the carmaker began including three-year, prepaid OnStar service packages as “standard mandatory options” as part of the manufacturer’s suggested retail price in Buick, Cadillacs and GMC vehicles for $1,500, the complaint said. Customers who bought those vehicles didn’t have a choice about whether their vehicle would have OnStar service, it said.

Smart Driver is a free, “optional service” GM offered that used OnStar data purportedly to “maximize” vehicles’ performance, reduce vehicles’ wear and tear and “encourage safer driving,” the complaint said. Under Smart Driver, OnStar collected and stored data collected includes the driver’s mileage; average speed; percentage of time the driver exceeds 80 miles per hour; driver’s frequency and intensity of acceleration and braking; seat belt usage; late night driving; and when and where the events occurred. GM said it was discontinuing Smart Driver due to customer feedback and that customers would be unenrolled automatically by June 26, said the complaint.

The Martinezes assert violations of the Federal Wiretap and Fair Credit Reporting acts, the Kansas Consumer Protection Act, breach of contract, invasion of privacy and unjust enrichment. They seek an order requiring defendants to delete all their driver data; to discontinue collection, recording and sharing of driving data in GM vehicles; and to implement procedures to require consent before recording, using, sharing or selling their data. They also seek liquidated and punitive damages, statutory penalties, attorneys’ fees and legal costs, plus pre- and post-judgment interest. The defendants didn’t comment.