GM Customers Sue for Privacy Violations After Tracked Data Causes Insurance Rates to Soar

Though OnStar “ostensibly provides” Wi-Fi and location information for emergency services in case of an accident, customers were not aware the subscription in-vehicle security and communications service was “tracking data points about their driving” and sending it to their auto insurance companies to justify a rate increase, said a privacy class action (docket 2:24-cv-10804) Friday in U.S. District Court for Eastern Michigan in Detroit.

Larry Reed, a Michigan resident, and Darnell McCoy of California allege OnStar and parent company General Motors “deliberately buried the true function of the OnStar product, because such tracking and selling of data is enormously unpopular with GM customers and the general public.”

Reed, a retired GM employee, has owned and leased many GM vehicles in his life, including a 2022 Chevrolet Silverado with OnStar capability. Reed renewed his subscription after first leasing the car but at no time was aware that OnStar was “tracking his driving telematics.” If he had known that was happening, he would not have activated the product or paid for a subscription, the complaint said. Reed’s auto insurer notified him in December of a “sharp increase” in his insurance premium; when he followed up, he learned of a LexisNexis report listing over 260 telematics driving events involving acceleration, hard braking, start and end times, and vehicle identification number, it said.

McCoy, owner of a GMC Acadia, uses the myGMC app on his mobile phone, which allows him to start the vehicle remotely among other functions, the complaint said. He didn’t knowingly consent to be tracked, but he observed after downloading the app that he received notifications when he accelerated or braked suddenly, it said. After a “significant increase” in his car insurance in April 2023, McCoy switched auto insurers, it said.

After an article about the practice appeared in The New York Times March 11, GM announced March 22 that it had “stopped the practice of sharing driving telematics data” with third-party data brokers LexisNexis Risk Solutions and Verisk, a program that included over 8 million vehicles, the complaint said. The announcement that the carmaker stopped the practice suggests an acknowledgment by GM and OnStar that they “in fact did not have the requisite legal consent by their customers for this data sharing practice,” it said.

GM launched OnStar with Motorola Automotive in 1996 as a “safety product” that used telematics to connect drivers to a call center that notified emergency responders if drivers’ airbags deployed, the complaint noted. Over time, OnStar added features that relied on GPS location services, including remote diagnostic capabilities, which allowed vehicle issues to be diagnosed by experts from a distance. OnStar added vehicle health reports and turn-by-turn directions after deploying 4G LTE in vehicles in 2014, and by 2020, GM had over 1 million OnStar Wi-fi subscriptions, it said.

Separate from the car apps, GM provided information services and “collected driver data” via driver’s cellphones; it made its OnStar Guardian app available to any driver in the U.S. in 2021, the complaint said. OnStar Guardian uses a phone’s accelerometer and GPS receiver to provide additional OnStar services, such as automatic crash notification, even in non-GM vehicles.

“What GM customers gain in connectivity, GM gains in highly personal data,” said the complaint. Because the carmaker can benefit from sharing driver data with “third-party brokers,” it’s “motivated to enroll drivers in its information services even when customers have not consented,” it said.

The complaint cited a 2015 industry analysis, which said a barrier to success of the connected car market was consumer reluctance “to pay the extra costs associated with embedded connectivity and instead use their smartphones as a solution for their in-car connectivity needs.” The report said carmakers were turning to smartphone integration “to satisfy customer demand for connectivity."

In 2022, GM “forced customers” to pay for a three-year OnStar and connected services plan by including the cost of the services in the manufacturer’s suggested retail price on some vehicles, “even if customers did not want to use the subscription service,” the complaint said. By “bombarding drivers with information services in their cars and on their phones, GM and OnStar have made it likely that drivers will unknowingly enroll in a data collecting, information service,” said the complaint.

The data provided by connected cars "is impacting the car insurance industry,” said the complaint, noting that predictive-modeling and machine learning, plus real-time data streaming of driving speed, routes and time “are changing how insurers do business." Early insurer adopters are transitioning from being pure insurance policy providers “to becoming insurance service hybrids” that depend on driver data collected from customers, it said.

Data gathered via an onboard diagnostics device allows an insurer to perform “further personal and regional risk assessments,” the complaint said. The industry is testing telematics devices that transmit vehicle and driver data through wide-area networks to use that data to create “driver risk profiles,” it said. The March 11 Times article said insurance companies “admit they have relied on driver data to raise the cost of car insurance or deny coverage altogether,” the complaint said.

GM and OnStar worked together to profit from customers’ driving telematics “without their express consent,” the complaint said. GM collected their data by equipping cars with OnStar capabilities and providing OnStar connected services through the Guardian or GM-branded apps, it said. The defendants make their connected services and data collecting practices “nearly unavoidable for customers,” it said.

The defendants ensure customers’ cars are capable of data harvesting in two ways, it said. GM cars come with OnStar-capable hardware and software, “making the transmission of customers’ telematics driving data the default,” the complaint said. Also, GM and OnStar advertise the safety and convenience features of their apps, such as the myChevrolet app, “but obfuscate the true nature of the connected services that flow from customers’ use of the mobile apps,” it said.

GM and OnStar coordinate to make default data harvesting “part of the back drop” in a way that “avoids raising customers’ attention” since such practices are unpopular at best and, “at worst, repugnant to them,” the complaint said. Drivers are often unaware their driving data “is being harvested and shared and/or sold to third parties because GM and OnStar designed it that way,” it said.

The defendants’ agreements don’t adequately disclose how the companies collect and share customers’ driving data with third parties, the complaint said. A sentence in OnStar’s privacy statement says it may “share data with third parties ... where you have elected to receive a service from them and/or authorized them to request data from GM (for example, financial organizations who offer financing for the purchase or lease of GM vehicles or usage based insurance providers)." But the sentence is “buried in a ‘drop down’ that a user must toggle to reveal from “its default hidden status” and “provides no basis for the conduct at issue," it said.

The plaintiffs didn’t elect to receive any service from LexisNexis Risk Solutions, “let alone a service in which LexisNexis compiles their every driving move and provides that report to their car insurance providers against Plaintiffs’ interest,” the complaint said. The OnStar privacy statement allows it to share data with third parties only “where the driver has elected to receive a service” from those third parties, it said. “Bound by its own terms then, GM cannot, through OnStar or otherwise, share data with LexisNexis and car insurance providers from which Plaintiffs never elected to receive services,” it said.

Reed and McCoy bring claims of invasion of privacy, and violations of California's Unfair Competition Act and Michigan's Consumer Protection Act. They request awards of actual, statutory and punitive damages; pre- and post-judgment interest; and attorneys’ fees and costs. GM didn't comment.