14 ms·
Texas sues GM for unlawfully collecting and selling drivers' private data [pdf]
- slackfan 2y agoGood. Hopefully other states start hitting more car manufacturers with this.
- 7thaccount 2y agoYep. It's basically all of them at this point. This needs to be illegal across the board.
- PreInternet01 2y agowHaT's uP With the cApiTaLizAtioN iN this TitLe? I've spent, like, several minutes of my life trying to figure this out, and... came up blank? The title is not copied from the PDF, where such issues would be rare but not unimaginable. I also couldn't find any articles linking to this PDF with this particular title. So... a misfiring accessibility solution? Solar rays directly going for the Shift key? (P.S. Yeah, I know "Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting." -- but this seems sort-of uncommon?)
- voidUpdate 2y agoI spent a few minutes looking at it and came up blank as well :/
- AdmiralAsshat 2y agoI was perplexed as well. I even tried counting the randomly capitalized letters to see if it spelled out a secret message or something...but unless someone can tell me what 'TSGMUFLCSDVPVD' means, I think it might be a red herring.
- henning 2y agoI cracked the code, it's an anagram for "Be sure to drink your Ovaltine".
- CoastalCoder 2y agoThe hint is that the title makes you want to shoot your eye out.
- seanw444 2y agoAt first I thought it was sarcasm-case. But no, doesn't seem like that either.
- squirtle24 2y agoBest I could come up with was that they're trying to make a mockery of Texas's position on the case. But the odd capitalization isn't frequent enough to make it obvious, so I too wasted minutes of my life looking for some kind of pattern. https://en.wikipedia.org/wiki/Alternating_caps https://en.wikipedia.org/wiki/Alternating_caps
- perihelions 2y agoMalfunctioning speech-to-text tooling? Note the errant capitalization falls on start-of-syllable boundaries. Alternatively, could be an artifact of an LLM tooling, where those boundaries reflect token boundaries. Unlaw / Ful / Ly Dri / Vers Pri / Vate
- PreInternet01 2y agoWell, I'm not a native English speaker, but I'm pretty sure that in "UnlawFulLy" the capitals don't represent pronunciation stress points? Those would look more like "uNlawfullY", right?
- perihelions 2y agoYes, but stress aside, the syllables still divide as "un-law-ful-ly". (At least I believe so and Claude also agrees; that's a quorum).
- deleted 2y ago[deleted]
- jonhohle 2y agoSorry, this was a mobile autocorrect issue I didn’t notice while submitting. I took the title from the press release but had to rearrange some things to fit and apparently iOS thought it should capitalize. The title came from the AG’s office[0], but I wanted to link directly to the filing. 0 - https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-general-motors-unlawfully-collecting-drivers-private-data-and https://www.texasattorneygeneral.gov/news/releases/attorney-...
- PreInternet01 2y agoThanks for sharing the exact workflow, and sorry for potentially derailing the discussion on this! (For the record, I upvoted all substantial comments, and truly enjoyed my comment going from +4 to -2 and back again...). I've never had iOS (either the Cisco or the Apple variant) randomly apply CamelCaps, though. One more thing to look out for in the future :)
- mproud 2y agoMods, wanna fix this title please?
- altairprime 2y agoEmail them using the footer contact link, or else they might never see this comment or post.
- dang 2y agoDoNe
- kstrauser 2y agoI say this rarely, but way to go, Texas! Every state should be pursuing this against every manufacturer who does this.
- deleted 2y ago[deleted]
- AdmiralAsshat 2y agoAs they say, even a stopped clock is still right twice a day.
- RIMR 2y agoA backwards clock is right 4 times a day. A clock running at 10,000 rpm is right 14,398,560 times a day.
- n4r9 2y agoThe relevant metric is surely the proportion of time for which the clockhands are within epsilon of the correct value.
- itishappy 2y agoPretty sure this metric will be constant (provided the hands aren't perfectly synced). The frequency of confluence is proportional to the difference in rates, but the duration is inversely proportional. https://www.desmos.com/calculator/45k0rrjwo0 https://www.desmos.com/calculator/45k0rrjwo0
- Night_Thastus 2y agoSo the better way would be something like average angular distance? If it's close to correct, but just off by a second or so - then that average will be very small.
- 2y ago
- deleted 2y ago[deleted]
- client4 2y agoI've been frustrated by the ability to easily disable vehicle cellular systems. In older vehicles you could simply unplug the right cable and have it disabled. In newer vehicles I've found the cellular system to be integrated with other components -- making it impossible to disable without also getting a permanent check engine light. Ideally I'd like some sort of CAM module that plugs in between the antenna system and the ECM that selectively drops telemetry packets.
- nullfield 2y agoAnd what else does it break-break, even if you do kill the antenna, more that just the annoyance of a light? Integrated GPS, because it uses cellular to “enhance” that? What other risks are there? Haven’t we seen CAN bus “hacked” over the air to shut down vehicles before? (Even ignoring the intentional ability to do so by the OEM, granted to law enforcement)
- 14 2y agoIn my opinion who cares if it breaks the car gps. I have my phone that already does this function and never needed my car to do this. I would a thousand time over delete my car gps if it meant no tracking.
- vel0city 2y agoMeanwhile I'm actually the opposite. I'd prefer for my phone to pull from the car's GPS system instead of trying to figure out its own signaling. It would probably be a lot better since it's not locked in a steel cage and in suboptimal placement.
- Bloating 2y agoSo you perfer your phone to track you rather than your car
- 14 2y agoYes. I can see turn my phone off or turn off location services or leave it at home since cell towers can track me should I really want to stay private. For example should I visit a brothel I might want that private. If I was going to a HIV clinic I might want that private. Should I be be cheating I might want that private. All made up examples but we should have the ability to remain anonymous and not have our car companies selling that information.
- randcraw 2y agoI can't imagine why this case should succeed if this same practice has long been tolerated by telcos or Facebook -- any company that provides no opt-out to collection and sale of personal info. If Texas had real guts, they'd pass a law that clearly prohibits the collection and sale of personal info without explicit opt-in. But nooooooo...
- fmajid 2y agoIt seems the TDPSA does require consent, just like California's CCPA/CPRA, Virginia's VCDPA it is based on, and the EU's GDPR.
- noselasd 2y agoAt least with Facebook you've given them consent to do so.
- runevault 2y agoExcept for the fact Facebook created shadow accounts for people without FB accounts to track them anytime they encountered embedded FB content, be it ads or otherwise, across the internet.
- deleted 2y ago[deleted]
- perfectstorm 2y agolot of these opt-in toggles are ON by default in the U.S but my previous employer's legal department made sure that it's OFF by default in EU.
- splitstud 2y ago[dead]
- fmajid 2y agoPaxton is a crook, but in this case he's fighting the good fight. Texas collected a $1.4B settlement from Meta for its facial-recognition scanning, and in this case the monetary damages to the victims are far worse in terms of higher insurance premiums. https://boingboing.net/2024/07/31/meta-to-pay-1-4bn-for-unauthorized-facial-scans-of-texas-facebook-users.html https://boingboing.net/2024/07/31/meta-to-pay-1-4bn-for-unau... He should then go after the insurance companies who used this data next, and force them to disgorge the excess profits they made from the illegal use of data, preferably with triple penalties.
- deleted 2y ago[deleted]
- warkdarrior 2y agoWhy is the insurance companies' use of this data illegal? Unless you can show discrimination against protected groups, not sure how this is illegal.
- lithos 2y agoWhy would you be allowed to use illegal data? Especially if you have the means to know if it's illegal or not. Not even Ebay/Craigslist has managed to keep itself immune from liability of vendors selling stolen items.
- deleted 2y ago[deleted]
- kube-system 2y agoDo insurance regulations prohibit it? Stolen property is a little bit different, there are laws that explicitly prohibit possession or dealing in property known to be stolen.
- shitlord 2y agoInsurance is regulated so maybe it's different, but plenty of companies rely on illegally obtained data. Websites like haveibeenpwned.com and identity theft protection services couldn't exist without hacked/stolen information. I guess the distinction is that they didn't commission it.
- ChrisArchitect 2y ago[dupe] Official release: https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-general-motors-unlawfully-collecting-drivers-private-data-and https://www.texasattorneygeneral.gov/news/releases/attorney-... (https://news.ycombinator.com/item?id=41239635 https://news.ycombinator.com/item?id=41239635)
- deleted 2y ago[deleted]
- dang 2y agoRelated press release: https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-general-motors-unlawfully-collecting-drivers-private-data-and https://www.texasattorneygeneral.gov/news/releases/attorney-....
- subsubzero 2y agoFun fact, as a owner of a GMC auto I got a innocent looking email about the discontinuation of the Onstar Smart driver service which was the service in question that violated many US laws and sent data to insurance companies without customers authorization. I hope this hits GM really hard as this type of behavior will never cease until massive amounts of money is extracted from the perpetrators(GM etc).
- crest 2y agoExecutives behind bars and multiple times the revenue from their illicit deals should work as incentive to guide the industry.
- fooqux 2y agoAnd not just massive. It needs to be an order of magnitude more than they made from those deals. Too many times companies get slapped on the wrist for an amount considerably less than they made from their illicit activities. Which I never understood. Normal people that get caught doing things like selling stolen goods have to pay a fine on top of all money they may have made from selling it. Why aren't companies treated the same?
- Scaevolus 2y agoIIRC the amounts involved were absolutely pitiful compared to the reputational damage-- they were being paid on the order of $10/car/year.
- TeMPOraL 2y agoWhat reputational damage? I know it's a number that gets calculated on cybersecurity assessment sheets, but I've never seen it being in any way connected to reality. Best I can tell, the actual reputational damage is almost universally $0. Security breaches are non-actionable oopsies - unless your product is literally preventing such breaches[0], it's going to be seen as a random event that has no bearing on customers making their purchasing decisions. After all, it could've happened to anyone, and might just as well happen to any of the competitors, and it doesn't even impact any of the subjects directly. -- [0] - And not even then - see e.g. CrowdStrike, who're busy turning the greatest security fuckup to date into a net positive event for them.
- api 2y agoDangerously invasive data like location should be subject to HIPAA-like regulations. Leak or sell without authorization? That'll be $100k per data point of unauthorized location data per user. This would convert data like that into a liability rather than an asset, which would pretty much fix the problem.
- kmeisthax 2y agoSay it with me now: "Transpose EU GDPR into US law yesterday!"
- JumpCrisscross 2y agoWe can learn from GDPR’s mistakes and do better. A single national regime and enforcer. No obligation for every complaint to result in an investigation. Fines based on gains and damages, not revenue. Liability that can be privately enforced. And a trebling of damages where noncompliance is shown to be willful.
- kmeisthax 2y agoAbsolutely yes to private right of action and treble damages. Not sure why you want "no obligation for every complaint to result in an investigation" though. That's contradictory to the private right of action. Disagree on fines based on gains and damages on their own. My understanding is that percentage of global turnover usually is a higher number than gains and damages. I'd prefer it be "the higher of either".
- JumpCrisscross 2y ago> Not sure why you want "no obligation for every complaint to result in an investigation" though It's trivial to bulldoze a European start-up by having complaints filed in a bunch of jurisdictions alleging this or that nonsense. It's nonsense, so no fines. But the mandate to investigate means this tiny start-up now has up to twenty-eight national supervisory authorities sending it demands, which can easily overwhelm a small team. > Disagree on fines based on gains and damages on their own. My understanding is that percentage of global turnover usually is a higher number than gains and damages. I'd prefer it be "the higher of either". Gains and damages contrates the discussion to the malfeasance at hand. Global-revenue fines are subject to grandstanding. That means lots of headlines and fewer fines actually paid.
- unglaublich 2y agoThe GM that discontinues Android and Carplay integrations for reasons of 'safety' and 'privacy'?
- naijaboiler 2y agoIt’s because they want to be able to collect and monetize that data by themselves
- blackeyeblitzar 2y agoThey also should be looking at other brands who did this - like Subaru, Hyundai/Kia, Mitsubishi, etc. I recall that Subaru in particular did not revise their location sharing policy when articles came out earlier this year about how these companies resell data to brokers like Lexis Nexis or Verisk. If you get a new Subaru with a Sirius XM radio for example, something that gets forced onto many or all configuration of cars (not sure), by default there is an option selected for sharing your location data with them. That might be true for any brand that shoves satellite radio into your vehicle. But you also are giving them authorization to do whatever they want with such data when you sign up for convenience services like the ability to lock/unlock/remote start the car from your phone. The fine print for those digital services includes giving your consent from what I read.
- downrightmike 2y agoWe should just have full data-autonomy enshrined in law. This starts that path.
- 0xbadcafebee 2y agoThere's really no way to allow companies to have your data when they need it, and also not lose it. Even if they don't sell our data, they can just get hacked, our info gets leaked, and now everybody has it anyway. Data security should come first, then data privacy, then data autonomy. HIPAA was basically created to do this (require your consent to receive your information, then require your consent to transmit or share it, within reason) but lack of data security means our private medical data still gets leaked. So I agree we absolutely need all personal data to be treated like HIPAA (at minimum) but it's kind of pointless without improved security requirements.
- downrightmike 2y agoWe need to fine the shit out of companies that have leaks
- hondohondo 2y agoGM aka Government Motors will never learn. Will they?
- laweijfmvo 2y agoAt some point my tax dollars will be bailing out GM due to GM having to pay fines for stealing my data, so I’m just paying someone to steal my data?
- mcguire 2y agoDidn't Tesla recently move to Texas? What do they do with the data they collect?
- monkeybutlers 2y ago[dead]
- RIMR 2y agoTexas, the state whose AG said that they were entitled to private medical data about patients in other states? https://www.thestranger.com/news/2023/12/21/79315926/texas-tried-to-get-seattle-childrens-hospital-health-records-on-trans-patients https://www.thestranger.com/news/2023/12/21/79315926/texas-t... Not surprising that Texas cares more about privacy related to your property than they do privacy related to your body.
- pupumeme 2y agoThis case exemplifies a broader trend we're seeing across industries: the tension between data-driven innovation and individual privacy. On one hand, collecting and analyzing vehicle data could lead to safer cars, more efficient traffic systems, and personalized services that genuinely benefit consumers. On the other, it raises serious privacy concerns and the potential for misuse. The key issue here isn't just about GM or even the auto industry - it's about how we as a society want to balance progress with privacy. Do we want a future where every device is constantly collecting data about us, ostensibly to provide better services? Or do we draw a line and say some spaces - like our personal vehicles - should remain data-free zones?
- steelframe 2y agoWhen it came time for me to buy my most recent car I made a list of requirements. If I couldn't find a car that meet them I was resolved to not bother buying a car at all. The requirement at the top of the list was, "It doesn't spy on me." I ended up finding one that checked all the boxes once I removed its Data Communications Module (DCM) fuse.
- mixmastamyk 2y agoNot gonna share your results? Only one?
- steelframe 2y agoI guess I was just trying to keep my comment short and on-topic rather than blab on about my car. Anyway I also wanted the ability to use gasoline for road trips, a manual transmission, emergency brake activated with a cable, knobs and buttons for the controls, ability to shut off or disable the center display, AWD, hatchback, plenty of get-up-and-go, made by a manufacturer with a reputation for reliability, broad availability of parts and places where I can get it repaired, reasonable price, and relatively small size to fit in cramped spaces in the city. I ended up with a Toyota GR Corolla.
- Shocka1 2y agoDepending on the manufacturer, you won't want to take it to the dealer without factory resetting first. Infotainment connects via WiFi initiated by technicians and will upload all stored data if it's there. And that's of course if you aren't using integrated apps like Android Auto or other third party apps, which also takes the data. I was a software engineer on these systems at one time and it's one of the bullet points of why I left. It's an uphill battle. The philosophy is that it's no longer the customer's car after they buy it and drive off the lot.
- steelframe 2y agoDespite the fact that I have free oil changes with the dealership I still do my own oil changes for exactly this reason. Thanks for the reminder about the factory reset though, in case I need a warranty repair in the future.
- deleted 2y ago[deleted]
- xyst 2y agoIf every state sues GM, GM might go bankrupt. Then the American tax payers will be footing another bailout. Thus earning GM the moniker, Government Motors (again).
- Draiken 2y agoWhat's the alternative? Let them keep breaking laws because they're too big to fail? That's what makes me so angry with this stupid economic model. Once these monopolies/oligopolies are inevitably formed (after all, competition breeds monopolies), they are essentially untouchable. I don't think there's a way to fix this within the current system.
- yimmothathird 2y agoHopefully the people running the scams will eventually just get lynched
- withinboredom 2y ago> What's the alternative? Let them go out of business and everyone learns a valuable lesson: "too big to fail" is a myth.
- Draiken 2y agoI agree with you, but this will never happen. You think anyone would like to be responsible for bankrupting GM? It's bad PR. All people will talk about is how many jobs will be lost. Here in Brazil we have a somewhat similar problem where the auto industry has been completely subsidized for over 70 years. Our factories are extremely inefficient and customers pay exorbitant amounts of money for a car. But if they remove the subsidies and import restrictions all of these industries would inevitably go bankrupt. Even though this is a good thing (these industries would not exist without these unfair advantages) nobody will ever want to be the bad guy that caused all those job losses. It's simply not solvable in my view.
- withinboredom 2y ago
- autoexec 2y agoI'm not at all surprised that GM did it. I'm surprised that Texas had a law against doing it though. It looks like it wasn't about the sale of data as much as it was about GM misrepresenting what they were doing. Still, good to see Texas standing up for consumers.
- 0xbadcafebee 2y agoFord tracks me and I'm happy about it. I even got a developer API key so I can write scripts that remotely lock and unlock my car doors, download my vehicle telemetry, etc. The "find-my-car" feature alone is worth it. As long as they don't sell my data (they don't) I'm all about it.
- ReK_ 2y agoYou sure about that? > They also say they can share your personal information with dealers (there are lots of those around for sure), social media platforms, advertising companies, joint marketing partners, SIRIUS XM radio service, law enforcement, regulatory agencies, and other government agencies. https://foundation.mozilla.org/en/privacynotincluded/ford/ https://foundation.mozilla.org/en/privacynotincluded/ford/
- 0xbadcafebee 2y agoHmm.... so, I dug into the Ford privacy notices, and they do have a very thorough explanation of everything they collect and what it's used for. It does look like the Connected Vehicle information is sold to advertisers by default, but there is an opt-out. Disappointing :/ The YOUR STATE-SPECIFIC PRIVACY RIGHTS part of the Policy links to a form to exercise Consumer Rights, but of all the form options available, Opt Out isn't on the form :( I'm calling Ford now to try to open a ticket with their marketing/data privacy department to fix that.
- Shocka1 2y agoIs this satire?
- EricE 2y agoGM is far from unique! https://www.eff.org/deeplinks/2024/03/how-figure-out-what-your-car-knows-about-you-and-opt-out-sharing-when-you-can https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...
- synergy20 2y agoWell Texas DPS (transportation dept) leaked thousands driver license info two years ago and many people paid fair price to identity theft losses. There is nobody to initiate a class action lawsuit against DPS, could Texas sue itself to play it fair and balanced? Suing GM is fine with me, how about wipe yourself clean too?
- whatever1 2y agoNot to alarm you but there are for sale all of the car driving data in the US from that emergency request service that kindly the manufacturers install in every new car they sell. Just make sure that you also pay the subscription because in an emergency it will not call 911 for you, because who cares about you if are not a revenue stream.
- RadixDLT 2y agoits about time, Toyota should be next
- resource_waste 2y agoZombie company at it again! They are like Boeing. There isnt really anything worth saving here. Do we need another fake-luxury SUV/Truck company? Not that I think Ford is better. Chrysler is more yikes than anyone. Maybe a total replacement of management? There is so much Rot.
- _fat_santa 2y agoGM makes alot of dogshit products but their sports cars are still pretty stellar. Camaro LT1, Corvette C8, Cadillac CTS-V Blackwing
- 1-6 2y agoHonest question, do Tesla drivers sign a document or press a button before they drive indicating that all their driving data will be gathered?
- 93po 2y agowhat does that have to do with this article about GM? why not just google it yourself? it's hard to believe this is a genuine question
- dminvs 2y agoTexas DPS was selling driver registration data to car warranty spammers as recently as 2022. This pearl-clutching from Abbott and Paxton is a bit amusing.
- oremolten 2y agoThis reminds me of the scene from Mr.Robot. GM / onstar likely set aside a few million in a "Rainyday" fund from the additional profit they made from this and that money sat in the market/bonds and they probably made 100x off that money what they will be fined/judgment-ed.
- wcunning 2y agoThe funny thing is that they supposedly only made a couple million from this, total. I can't remember if that was an internal discussion from when I worked there a few months ago or a news article, but I'm pretty sure of it either way. That makes the whole stupid thing just dumb.
- rockskon 2y agoI'm concerned that this practice will continue minimally abated with a mandatory inclusion in the ToS forcing you to agree to continually provide your driving data or else you don't get the car. Seems to be standard practice in tech these days to lawyer-away any meaningful notion of consent.
- PROMISE_237 2y ago[dead]