What's Happening?
General Motors (GM) has reached a major bipartisan multistate settlement totaling $220 million concerning its collection and sharing of driver data through its OnStar Smart Driver product. This settlement follows earlier investigations by the U.S. Federal
Trade Commission (FTC) and the California Office of the Attorney General. The allegations state that GM, starting in 2015, collected data on harsh braking, aggressive acceleration, time-of-day usage, and seat-belt compliance, and by 2018, precise geolocation pings every three seconds. Dealership staff were allegedly incentivized to enroll customers, often speeding through consent disclosures. The collected telemetry data, tied to individual Vehicle Identification Numbers, was reportedly shared with companies like Verisk and LexisNexis, which then sold risk scores to insurance companies, potentially leading to increased premiums for consumers. An internal glitch also reportedly kept over 370,000 drivers enrolled in data sharing despite their attempts to opt out.
Why It's Important?
This series of settlements marks a significant development in driver privacy and consumer protection, establishing a precedent for how automotive companies handle sensitive user data. The actions highlight the increasing scrutiny on data collection practices in the connected vehicle era and the potential financial and privacy implications for consumers. The FTC order includes a five-year ban on selling driver data to consumer reporting agencies, stricter than the multistate agreement, which will allow such sales with affirmative express consent after the FTC's ban expires. This indicates a growing regulatory push to ensure transparency and control over personal data. The case also underscores the complexities of state and federal privacy laws, with California's settlement focusing on the California Consumer Privacy Act, and other states incorporating their own data privacy acts. The financial penalties and injunctive terms, including data deletion and independent third-party assessments, aim to restore consumer trust and prevent future privacy misconduct.
What's Next?
GM is required to implement a documented comprehensive privacy program within 180 days, appoint a qualified chief privacy officer, and conduct data protection assessments before any new high-risk processing activities. The company must also provide annual general training for employees and specialized training for program staff, along with service-provider and third-party due diligence. Biennial independent third-party privacy assessments will be provided to the Washington attorney general, who will serve as a reporting hub for other states. The bespoke 'Affirmative Express Consent' requirements in the multistate settlements go beyond typical state privacy law opt-in consent, detailing rules against dark patterns and pre-ticked boxes. While these settlements address past issues, ongoing litigation in states like Texas, Arkansas, Indiana, Iowa, Montana, and Nebraska suggests that GM's driver privacy story is not yet fully concluded, indicating continued legal and regulatory challenges in this evolving area.
Beyond the Headlines
The GM data privacy case illuminates a broader societal challenge concerning the 'internet of things' and the pervasive collection of personal data from everyday devices. The phrase 'People bought a car, not a tracking device' encapsulates the public's growing concern about the hidden data streams generated by modern products. This incident could accelerate the development of more robust data privacy regulations across various industries, pushing for clearer consent mechanisms and greater consumer control over their digital footprints. It also raises ethical questions about the balance between technological innovation and individual privacy rights, particularly when data collection can directly impact financial aspects like insurance rates. The coordinated efforts of multiple states and federal agencies signal a unified approach to enforcing data protection, potentially leading to a more standardized and stringent regulatory landscape for data-driven businesses in the U.S.
