The story about GM sharing driving data from connected vehicles with third parties now has a third installment. The quick recap is that New York Times reporter Kashmir Hill broke the news that GM was selling driving data about specific drivers and specific trips to LexisNexis and Verisk, two companies that help auto insurance companies gauge risk. The drivers had been enrolled in a program called Smart Driver+, a driving gamification program described by GM as a way to improve one’s driving. On the back end, Smart Driver+ was noting incidents it considered hard braking, hard accelerating, swerving, and speeding. Insurers were then using these files full of incidents to raise the rates of their insured. Two weeks after the first piece ran in the NYT, GM said it had cut ties with LexisNexis, because, “Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies.” By then, a Cadillac driver in Florida who had his insurance premium doubled had already filed a lawsuit.

GM said owners had to opt in to the SmartDriver program. In the latest installment, Hill, who focuses on privacy and whose byline says she’s been writing about privacy and technology for more than 10 years, then discovered the Chevrolet Bolt she and her husband bought in December 2023 had also been enrolled in Smart Driver+ even though she didn’t remember doing so. Her husband requested reports from LexisNexis and Verisk, and sure enough, he received two files that, between them, recapped incidents during nearly 300 trips taken in three months. Because the dealership listed her husband as the primary owner — despite both their names on the vehicle title — neither of the third-party companies had data on Kashmir Hill.

Hill said she and her husband checked the OnStar app to see if they were enrolled in Smart Driver; the app told them they weren’t. Then they logged into OnStar at a computer, which told them they were enrolled. GM told Hill a “small population” of owners encountered this “bug” that leads to the app showing erroneous information.

When she called the salesperson at the dealership to ask about when she supposedly opted in, the revealing nuggets emerged. He said there are three pages during the sales paperwork process that he automatically fills in with “Yes,” “Yes,” and “No,” without asking the customer. The second page signs the customer up for OnStar — the Bolt comes with Connected Access for eight years anyway — and enrolls the owner in Smart Driver. GM insisted to Hill that car buyers need to approve the terms, and a few lines on the page in question instruct the salesperson to get the buyer’s approval. The salesman said that if he doesn’t sign a buyer up for OnStar, his pay is docked, and that GM grades dealerships based on the percentage of vehicles enrolled in Connected Access. Turns out that the page that opts into OnStar is the page that opts into Smart Driver+. — so at the dealership, a new car buyer couldn’t opt into OnStar and opt out of Smart Driver+. The buyer could opt out of OnStar Connected Services, but then the owner wouldn’t get benefits like certain OTA updates or remote diagnostics.

When Hill drove to the dealership to ask more questions, she wrote, “[A] more senior salesman said they always have the customers accept the terms themselves. Maybe our salesman misspoke on the phone and my husband and I have forgotten a moment during our car purchase when we were asked to tap ‘yes’ on this screen.”  Hill admits she might have forgotten, there’s a lot of paperwork to complete to close a sale.

Even if Hill had opted in, though, the digital page in question didn’t explain how GM might use information captured by Smart Driver+ — like selling the info to third-party firms. And remember, this is information that the driver of the vehicle doesn’t see unless obtaining their report from LexisNexis or Verisk.

Two months into this, GM has ended such data sharing with LexisNexis and Verisk, is shutting down Smart Driver in all GM vehicles, and has hired a new trust and privacy offer. It’s also facing at least 10 federal lawsuits from angry owners over SmartDriver. We recommend reading the full story, which offers a lot more detail about the issue and comments from those who study privacy issues.