Drivers Allege General Motors, OnStar, LexisNexis Shared Personal Data Without Consent

While we all know new cars are like smart computers, helping us navigate trips, take calls, and much more, we also expect to be able to control what data they collect from us and how they share it. 

But a new lawsuit, supported by mounting research, argues that drivers are often tricked into sharing personal driving and location data with third parties without even realizing — or consenting to it — and they can be financially and emotionally hurt by the opaque schemes.

Drivers have run into issues trying to renew or get new insurance policies due to having their data used out of context against them, the lawsuit alleges, and some have had their location data shared with violent exes, as a New York Times investigation uncovered.

In the new lawsuit, a Florida driver accuses General Motors and OnStar of selling his data to LexisNexis without his consent in a “deceptive, unfair, and misleading” scheme, and one that meant his “peace of mind and privacy has been gravely invaded.”

A ‘shocking’ situation

Romeo Chicco filed the proposed class action lawsuit against General Motors LLC, OnStar LLC, and Lexisnexis Risk Solutions Inc. accusing the trio of violating privacy, trade, and credit reporting laws by trading consumer data without consent, and misleading him and others about how that was done. 

Chicco says he found out he had been a victim of the data sharing scheme when he went to get a new insurance policy and was denied by a number of providers, before getting one at double the price of what he had been previously paying. When he enquired why, he was told to check his LexisNexis report. What he saw shocked him, the lawsuit claims. 

The report said Chicco had clocked up 258 recorded driving events under the “Telematics” subsection, despite having never consented to sharing data with Lexis. 

“Each driving event included trip details that show the start date, end date, start time, end time, acceleration events, hard brake events, high speed events, distance, and VIN,” the lawsuit says, adding “notably absent from the consumer report is any context related to these driving events.”

Chicco says the “erroneous reports of derogatory and negative driving information” were taken through the illegal transfer and publication of data, constituting an invasion of privacy. When he asked Lexis why his data had been collected without his consent, the lawsuit says a representative told him to call GM, which was the beginning of his wild goose chase. 

A new car with unexpected add-ons

In 2021, Chicco bought a new 2021 Cadillac XT6. The purchase agreement makes no mention of OnStar, LexisNexis, data-sharing, or anything privacy-related, the lawsuit says. Shortly after his purchase, Chicco downloaded the MyCadillac Application to his mobile device and got an email asking him to sign up for the OnStar program, which he declined to do. 

As per materials provided by the dealership, Chicco knew OnStar could only collect driving data with explicit consent and he knew from checking his account, he had not signed up for OnStar services and had, in fact, done the opposite, choosing to avoid the platform. 

But when Chicco called GM after finding out Lexis had his data, a representative told him telematics data was sent through OnStar, the lawsuit says. 

“The representative confirmed that Plaintiff did indeed have an OnStar plan attached to his vehicle and transferred Plaintiff to an OnStar representative.” Chicco felt “extremely frustrated and shocked by the entire situation” and accused the companies of “knowing, willful, and intentional” violations of his rights and privacy, the lawsuit claims.

Lack of accountability

After finding out his data had been taken without his consent, Chicco tried to get to the bottom of how that had happened and which company was to blame. Ultimately, the lawsuit argues, none of the companies took responsibility and while representatives from GM and OnStar both confirmed Chicco had not turned on data sharing, they kept deflecting his questions and referring him to other people. 

He never ended up getting an answer from any of the three companies on how his data ended up with Lexis. 

“The entire ordeal left [Chicco] hopeless and distressed because no matter who he spoke with, nobody could explain to him how his driving data had been publicly shared without his knowledge or consent,” the lawsuit argues. It claims Chicco has suffered mental anguish and emotional distress, including stress, anxiety, worry, restlessness, irritability, embarrassment, loss of sleep, shame, feelings of hopelessness, and helplessness all impacting his job and personal relationships.

A growing industry 

According to the New York Times investigation, car companies are increasingly bypassing drivers to obtain driving data and going straight to internet-connected cars to get information they can sell on to insurers. 

Sometimes the companies get consent from drivers, but the investigation found “especially troubling is that some drivers with vehicles made by G.M. say they were tracked even when they did not turn on the feature — called OnStar Smart Driver — and that their insurance rates went up as a result.”

Cornell University Law Professor Frank Pasquale said he was surprised by the scheme “because it’s not within the reasonable expectation of the average consumer, it should certainly be an industry practice to prominently disclose that is happening.”

Injuries extend beyond insurance

A separate New York Times story documents how car data sharing can be weaponized in abusive relationships, allowing for unwanted stalking and harassment. Apps that track car movements and location data can be shared in real time with exes, sometimes without victims knowing. 

The Federal Communications Commission recently sent letters to nine vehicle manufacturers, including General Motors, Toyota, Ford Motor, and Tesla, asking for more information about their connected car apps and whether the companies had processes in place to assist abuse victims, the New York Times reported.

How to stay safe

Mozilla Foundation research found that “modern cars are a privacy nightmare,” but the foundation has some steps drivers can take to protect their data from falling into the wrong hands. Like with any app, always start by limiting your privacy settings on your phone and computer. Other tips include:

• Opt out of the sale of your personal information, and other advertising and decision-making features, at GM’s website
• Opt out of any third-party sharing
• Do not give consent to tailored advertisements 
• Factory reset your car before selling or straight after buying
• Use strong passwords and two factor authentication 
• Opt out of location sharing on mobile devices

Chicco wants to represent other Florida drivers in his proposed class action lawsuit and is suing for violations of the Fair Credit Reporting Act, the Florida Deceptive And Unfair Trade Practices Act, and Florida Common-Law Invasion of Privacy.

The plaintiff and proposed class are represented by Mohammad Kazerouni and Ryan L. McBride of Kazerouni Law Group.

The GM datasharing proposed class action lawsuit is Chicco v. General Motors LLC, et al, Case No. 9:24-cv-80281-DMM, in the U.S. District Court Southern District of Florida.