Your GM car is probably spying on you. The Texas AG wants to change that

With advanced sensors, internal computers, large touch screens, and in some cases even data plans, some cars have more in common with the latest iPhone than a traditional vehicle.

And just like a smartphone, modern cars collect a lot of data, related to both how the car is operated and who’s behind the wheel.

Texas Attorney General Ken Paxton filed a lawsuit against General Motors and OnStar in August, alleging that the companies used deceptive tactics to coerce customers into consenting to their data being collected and sold.

GM is the American car manufacturer that owns Chevrolet, GMC, Cadillac and Buick. OnStar is a safety and security system for vehicles that provides its services as a subscription. It’s also a GM subsidiary.

Arizona personal injury attorney Marc Lamber said customers being sold OnStar's services didn't know they were signing up for their data to be stolen:

”The allegation is that all of these purported safety benefits are promoted to consumers,” he said, “when in reality they sign up for all of this as part of the onboarding process when you’re buying a car. And once you purchase the vehicle and sign up, it’s stealing your data.”

The complaint from Paxton also accuses GM and OnStar of selling the data collected by customers’ vehicles to third parties without consent. Included third parties range from car insurance companies to personal information databases and data brokers.

Lamber said that it’s currently too early to tell how the lawsuit will go:

”This is just August of this year when the suit was filed,” he said. “So in a legal sense, that’s like minutes ago.”

According to the complaint document and independent reviews, the data collection by vehicles and use by third parties is far-ranging.

Mozilla, the privacy-focused nonprofit organization behind the Firefox web browser, publishes a free guide called Privacy Not Included, which reviews various products for the data they send to the manufacturers and third parties.

The organization reviewed 25 of the most popular auto manufacturers in late 2023, and every single one received the “Privacy Not Included” warning label.

That label means that people looking for a new vehicle shouldn’t expect anything they do in the car to stay in the car.

The data collected and shared includes driving statistics like speed and braking, individual settings for the infotainment system and comfort controls, and GPS location data, among other things.

In the past, drivers could voluntarily plug a small device into the OBD port in their vehicle that would send data to insurance companies as part of a “safe driver” program to reward good driving by lowering their insurance rates.

Sky Schaudt/KJZZ

Now, almost all GM vehicles manufactured after 2015 have an onboard “telematics system” that automatically collects and sends that data back to GM.

Paxton alleges that GM packaged this data, combined with identifying information like VINs, and generated “Driving Scores” for each customer.

These Driving Scores, according to Lamber, are inaccurate at best:

”We’re trying with generic metrics to grade someone without knowing the full context, and you really can’t,” he said. “What happens if someone takes their car to the track where they’re in a safe area and permitted to [break traditional traffic rules]? What happens if someone lends their car to a family or friend, and that person drives differently than the normal operator of the car?”

GM is accused of then selling licenses to this collected data to insurance companies, which Paxton accuses of using the data to increase insurance rates and even drop or deny coverage altogether.

The complaint also alleges that by using location data from the car and a customer’s connected phone, OnStar was able to gather even more data that could be sold without gaining explicit consent from the customer.

Lamber acknowledged that with privacy concerns running this deeply, it could be tempting to buy an older vehicle without a telematics system.

But, he said it’s really not the best idea - because it also comes without the safety features that have been developed since 2015:

”If you buy an older vehicle, you may have more security in terms of not having the same privacy concerns,” he said, “but on the other hand, you’re operating a vehicle where if there is a collision, it’s less safe for you and your loved ones in the vehicle with you.”

But there are ways to find out what your car knows about you:

The Electronic Frontier Foundation, a nonprofit organization focused on advocating for privacy in the digital age, offers a guide on how to learn what data has been collected by your car, and in some cases even stop the flow of information.

EFF also offers links to request your personal information from data brokers like LexisNexis and Verisk, two organizations that have also purchased access to GM’s driving data.

Since this suit was filed in Texas on behalf of Texas drivers, Lamber said the results will likely only affect Texas — but that other states are keeping a close eye on what’s happening since this could set a precedent for the auto industry as a whole.