12 ms·
General Motors Is Banned from Selling Driving Behavior Data for 5 Years
- userbinator 2y agobut it can still share anonymous data about people’s driving with third parties Most important part of this IMHO.
- deleted 2y ago[deleted]
- cameldrv 2y agoYeah and it’s simple to reidentify anonymous location traces. The simplest way is to buy cell phone location data from apps, which is generally intermittent, but even with just 5-6 location/time pairs, you’re going to be able to positively identify someone, with the small caveat that there will be some ambiguity with members of a household that share a car.
- robojunkie 2y agoIs it anonymous aggregated data or just anonymized data? Anonymized data can easily be de-anonymized, as you stated.
- johnisgood 2y agoAssuming the worst in these cases is always a good idea.
- 55555 2y agoYeah, super anonymized if only my car leaves from my house every day to go to work and comes back every night...
- robertlagrant 2y agoThat's what "aggregated" is for.
- autoexec 2y agoEven aggregated has been and can be de-anonymized
- gunian 2y agoanyone ever want to drop the guise of privacy and have the surveillance is out in the open? like real question that way they have the data and we have the data instead of we pretend they don't have the data in the name of privacy but they have the data
- gleenn 2y agoThere isn't an end to that, what is "all the data"? Someone will always want to record more data, and then sell it to someone. How do you force people to always reveal all the data they have. I think if you start peeling back the onion on what you're suggesting you will realize that it's not really possible or practical in any sense.
- mmooss 2y agoYou deter them with risk that is too high for what they gain. For example, if consumers are awarded considerable fines for violations, then they would stop.
- gunian 2y agogood point it does seem ambiguous in this context any data generated by me or any device I am using and any downstream data derived from that why wouldn't this be possible? company x gives you y data and tells you we sold it to z and so on and you just follow the chain using some unique identifier they sell the data openly and i get to see what they're selling win win legislation instead of annoying cookie banners
- impossiblefork 2y agoNo, because it'd be incredibly dangerous to me to have all these groups storing data about me and allowing them to determine my comings and goings. You may think 'we're only using it for advertising', but I don't trust you and I can't. I don't want you to obtain information about my political views, or how they differ from what I say on the internet, or who I talk to about maths, or where I buy food.
- 2y ago
- fsckboy 2y agohow about we trade, General Motors can sell our data, and Google cannot
- bryanrasmussen 2y agoAt exactly 2:14 while listening to the political oriented podcast fsckboy laughed, punched the dashboard of their car, and exclaimed "right on, that's what I've always said!"
- dismalaf 2y agoThere's literally zero evidence Google sells data. They sell targeted ads using data, not the data itself.
- add-sub-mul-div 2y agoIf they didn't leak vast data through bid requests that others could de-anonymize, the marketplace and whole ad tech ecosystem would not exist in such a profitable fashion for them. They and others depend on people not digging deeper beyond lack of direct transactions for de-anonymized data to really understand the trade.
- supriyo-biswas 2y agohttps://archive.is/PW0ng https://archive.is/PW0ng
- ripped_britches 2y agoThey were trying to warn us by naming it “Smart Driver”. Come on yall.
- jakelazaroff 2y ago> An investigation by the Federal Trade Commission determined that consumers had not been aware that the automaker was providing their driving information to data brokers. Yeah, no shit. Why on earth would I assume the company from which I bought my car is selling my information? Why are they allowed to sell this data at all? We can all acknowledge how ridiculous this is, right?
- johnnyanmac 2y agoTiktok's being banned while Meta is more or less able to do the same thing but worse. It's pretty much about who can line pockets rather than the fact that selling user data is wrong.
- pjc50 2y ago> Why on earth would I assume the company from which I bought my car is selling my information? Why are they allowed to sell this data at all? Sadly the answers are "if it's got a connected computer in it, it's selling your information" and "you're in America, so no GDPR because 'free speech' trumps privacy almost every time, except for video rental records".
- mmooss 2y agoI don't understand the FTC. Why and how did they start protecting consumer privacy? Could they have done it before? Do they have an overall systematic plan for protecting it comprehensively? Do they have a guiding principle? I'm glad they are moving forward on it, at least until Monday.
- AndyNemmity 2y ago[flagged]
- xyst 2y agoThey don’t give a shit about privacy directly but GM was egregious in collecting this data - confusing consumers - sneakily signing up consumers to “smart driver” as part of onstar - data brokers subsequently building profiles on users and selling this data to _insurance companies_ - consumers later finding out their insurance doesn’t get renewed because of this secret driver profile that was built without their explicit consent If GM followed the rules by disclosing this directly, allowing consumers to opt out. They probably wouldn’t be in this embarrassing position. It’s in the FTC release: https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-takes-action-against-general-motors-sharing-drivers-precise-location-driving-behavior-data https://www.ftc.gov/news-events/news/press-releases/2025/01/...
- ycombinatrix 2y agoLmao. They were too cartoonish in their villainous behavior.
- mrguyorama 2y agoIt's surprising since usually nowadays that gets you a cabinet position or a seat in the House.
- deleted 2y ago[deleted]
- soco 2y ago
- Cadwhisker 2y agoNow, please do Hyundai (and others). Their in-built map's knowledge of speed limits and the speed sign recognition is so awful that any "speeding" data is guaranteed to be wildly inaccurate.
- dismalaf 2y agoI drove a new Kia as a rental... It just uses Google Auto/Apple equivalent, and just uses Google Maps, no? Or do they also have their own maps app?
- RandomBacon 2y agoI drive in a very populous urban area, and the Google Maps/Auto speed limit data is often inaccurate.
- dismalaf 2y agoNot saying it's not inaccurate, saying it's not Hyundai gathering the inaccurate info.
- Cadwhisker 2y agoHyundai has a "camera speed limit recognition" system, which can identify road signs and recognise what speed they indicate. That's all well and good, except when it picks up a sign for an off-ramp and thinks it applies to you, or when you pass a large truck/bus with a speed limit sign on the back of it and thinks that's the new speed limit. On every journey of over 2km, it gets something wrong and sounds a warning tone at you that can't be turned off. It also reads car park speed signs, which are typically "5", so you often hear a "bong bong bong bong" warning from the car in a car park.
- Cadwhisker 2y agoSome (like the Hyundai) have their own in-built maps and speed limit data (not very accurate in Australia). They can even warn about traffic build-ups because they're "connected".
- Owen1234 2y ago[dead]
- Owen1234 2y ago[dead]
- throwaway562if1 2y agoThey keep all the profits and can still sell "anonymized" data. Surely this chilling precedent will have other corporations shivering in fear.
- EVa5I7bHFq9mnYK 2y agoHow about monetary compensation? People lost real money, damages can be calculated. After all, if I installed spying software on GM's computers, and sold the extracted data to, say, Toyota, I'd face hefty fines. And spend time in prison.
- xyst 2y agoProbably a class action lawsuit in the future, if one does not already exist. Jail time? Probably not, we let health insurance companies get away with taking away critical needs from patients and delaying care in the name of delivering shareholder value. The best they get is a slap on the wrist from the government, let alone jail time.
- soco 2y agoHealth insurance abuses got a quite different slap recently.
- Tostino 2y agoAnd they are calling it 'terrorism'. What a joke our country is.
- diggan 2y agoI mean, it is. Just because you agree with it doesn't mean the label changes. And I don't necessarily hate what happened either, nor would I probably personally prosecute the guy. But lets not mince words, if you (try to) use violence against civilians for political/ideological/religious motives, that's pretty much the agree-upon definition of "terrorism".
- epgui 2y agoIt was a targeted murder, it was not terrorism.
- paul7986 2y agoMaybe this is well know and this is about auto insurance but mine just went up $50 a month because of a national database about each of our cars ... the tiniest details are recorded into it and all auto insurance companies then use to jack up your current rate. If you try to go elsewhere they point to oh you used your Allstate towing benefit a lot so it's $200 a month vs. $140 (cant get a deal from others). Jiffy Lube enters the frequency of your oil changes and the amount of miles in this database too. If you start a new temp job that's further away then usual and start to have more oil changes your insurance could / will go up cause they see you are driving more then you were. I understand entering my car's accident record into this database but I was surprised the tiniest details are entered into this database and Allstate & Jiffy Lube say they do not sell this data they just enter it into this national database...
- deleted 2y ago[deleted]
- ellen364 2y agoI'll confess I was sceptical about this but, at minimum, the database seems to exist. There's a company called Carfax that I'd never heard of. Their EU site seems to provide basic reports about the VIN, whether the car has been written off, etc. Those basic "Is this car sale a scam?" checks are common in the UK. But the site also makes a big deal about "Get the American report!" So I googled "Carfax oil change" and found people talking about the oil change history in the reports [0] In the UK it was traditionally common to keep a car log book where you recorded all maintenance and might get the garage to put their stamp on it, to prove to a future buyer that you'd looked after the car. But having a garage enter that info into some random company's database, and maybe not telling me, would be disappointing. [0] https://www.toyotanation.com/threads/oil-change-history-when-buying-used-car.1709165/ https://www.toyotanation.com/threads/oil-change-history-when...
- ksynwa 2y agoWhat I am wondering if to what extent (if any) I can protect myself as an end user from this kind of spying by just not connecting these smart devices to the internet. A while I read about smart TVs bypassing pihole-style blockers by using hardcoded IP addresses and DNS server addresses. I don't even know how smart cars work. Do they have their own SIM card or something like that? Either way there are so many ways they can subvert obstacles. For example a car could scan for unprotected WiFi networks and connect to one if found.
- lnsru 2y agoEvery new car has a SIM card. Apparently in Europe used for emergency automatic calls. But having SIM card in the car is not mandatory. All the information in other cases is saved in the car. And when you bring the car to the dealership the information is transferred over the wire in old fashioned way. Safest thing is to have an older car without much electronics, that can be repaired outside dealership network. Some cars like a Teslas have very normal cameras filming interior. Apparently to monitor the driver. But who knows.
- miohtama 2y agoYes a mobile as a government tracking device in your car is mandated in Europe.
- almostnormal 2y agoNot yet. But soon, when cars are required to transmit data about emissions.
- pjc50 2y agoWhich directive is that, and what's the point of it vs emissions point monitoring at annual inspection time?
- almostnormal 2y ago
- ascorbic 2y agoIf you're thinking that this is good (and it is), you should love the GDPR which bans this sort of thing entirely without needing an investigation beforehand.
- flakeoil 2y agoI guess GDPR is a good idea, but in practice it has limited value. I suppose all that is needed is that the user accepts (consents) by answering yes to a popup question. It can be asked over and over. If you answer yes by accident at some point you are screwed. You can maybe(?) retract your answer, but maybe you don't even know you answered yes at some point when you were stressed and had to drive somewhere, while your nav/media system asked you this question. The main problem is that this sort of thing (tracking of cars and storing the data in a central database) is considered normal by corporations and is allowed by law. Would we like to have big corporations place private detectives outside our houses and when we leave they follow our every step, take photos, record audio and track our GPS position and report all that data to the corporation in realtime? That is what they do now with their cars and phones and appliances. The reason they did not do it in the past was that it was expensive to have private detectives track each of their customers, was considered spooky and abnormal and it was probably also illegal, but now it is cheap and somehow considered normal.
- bigbacaloa 2y agoI think there is some requirement of a sort of good faith in the popups. What you describe is essentially deceptive behavior, and in a good legal system that should be seen as circumventing the law so itself actionable. Obliging clients to answer multiple popups will irritate them and drive them elsewhere. This sort of tracking is considered normal in the USA but not everywhere else.
- Smithalicious 2y agoThat's not how the GDPR works
- microtonal 2y agoI guess GDPR is a good idea, but in practice it has limited value. I suppose all that is needed is that the user accepts (consents) by answering yes to a popup question. It can be asked over and over. If you answer yes by accident at some point you are screwed. Not allowed by the GDPR, this violates the principle of unambiguous consent: https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/gdpr-basics/legal-basis-of-consent https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gd... You can maybe(?) retract your answer, Under the GDPR, retracting consent should be as easy as giving consent. Moreover, you have the right of erasure. Even if you consented, when asked, GM should remove all your personal data: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ but maybe you don't even know you answered yes at some point when you were stressed and had to drive somewhere, while your nav/media system asked you this question. Violates both the rules that consent should be given freely. --- More broadly, selling non-anonymous data would never be allowed under the GDPR, because the third-parties would need to consent to use the data. (IANAL)
- blackeyeblitzar 2y agoFor me as a consumer, whether they’re selling it or giving it away for free or expose it via a data breach, the impact on me is the same. All three deserve fines and jail time for executives. It is strange to me that attention is given to this data but not to the leaking of medical records of literally over 100 million Americans by Change Healthcare last year (a subsidiary of United Health). Most of those victims never were customers of Change or United, but somehow their records were with this company.
- wakawaka28 2y agoPlease make an article about this on this Consumer Protection wiki: https://wiki.rossmanngroup.com/index.php/How_to_help https://wiki.rossmanngroup.com/index.php/How_to_help
- deleted 2y ago[deleted]
- rcarmo 2y agoAs an European, this is weird. Just 5 years? Why were they allowed to do this in the first place?
- nonrandomstring 2y agoYes I don't understand the "5 Years" part at all. Either it's illegal or it isn't. No judge ever says "I ban you from burgling houses for 5 years!", like after 5 years it would be okay again.
- ninalanyon 2y agoNo burglar has the resources of GM.
- 2024user 2y agoIsn't that jail time?
- robertlagrant 2y ago> Either it's illegal or it isn't. I think: it's illegal without consent. They can't do it for 5 years, even if they got consent, as a punitive measure. After that they will have to seek consent.
- diggan 2y agoImagine this: Security pentester tests someone's website before getting approval/confirmation that this is what the client (who isn't a client yet) wants. Someone reports that, and judge says "Since you didn't do the pentest the legal way, we're banning you from doing pentests for five years" After those five years, the pentester can continue doing tests, but legally. The five year ban is not the punishment for doing pentests, but for doing unauthorized pentests. The analogy here is that data collection/selling is legal, but you have to follow the rules regarding how collection happens. If you break those rules, they'll ban you for N years, after that you can do the collection/selling but following the rules.
- skywhopper 2y agoCollecting and selling the data is legal if they give you the chance to opt out. They went out of their way to avoid giving you that chance, and that’s what they got in trouble for. So the five year ban is a penalty for breaking the actual law, which is just that the consumer should have a chance to say no.
- rcMgD2BwE72F 2y agoOnce again, glad to be European (covered by GDPR, everywhere). It's funny and sad at the same time, to see Americans be happy with this yellow card when it should definitely be a red one. How do you tolerate this?
- mrweasel 2y agoThis was VW last month: https://www.bleepingcomputer.com/news/security/customer-data-from-800-000-electric-cars-and-owners-exposed-online/ https://www.bleepingcomputer.com/news/security/customer-data... Undisclosed data collection isn't unique to the US.
- microtonal 2y agoThat is about a data leak. How do you know if the data wasn't collected with(out) consent? If VW collected this data without consent, the data protection authorities or the EC are going to have a field day. (By the way, the GDPR also has ramifications for data leaks of legally collected data. E.g. there is a requirement to report this to the authorities within 72 hours after becoming aware of the breach: https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ )
- mrweasel 2y agoApparently it was disclosed well enough for it to not come as a surprise to people, including German politicians (https://www.spiegel.de/netzwelt/web/volkswagen-konzern-datenleck-wir-wissen-wo-dein-auto-steht-a-e12d33d0-97bc-493c-96d1-aa5892861027 https://www.spiegel.de/netzwelt/web/volkswagen-konzern-daten...) But fair, it's probably disclosed somewhere in a 80 page EULA for the app.
- aucisson_masque 2y agoPrivacy ? But I have nothing to hide. Everyone has something to hide, be it as simple as your driving behavior, so you don't end up over paying for insurance or even in the situation where all company refuse to insure a 'risky' profile.
- mrweasel 2y agoThere's also things that are private, but not necessarily deeply secret. There's also things that are completely legal, but morally questionable, at least in your social circles, and if that information was to leak out it would be harmful. With the VW data leak I was pretty horrified that VW either doesn't understand or don't care that leaking location data isn't just privacy invading, it's potentially dangerous for victims of stalking and abuse. In the mildest cases these people may need to move, in the worst they die. Car companies seem completely oblivious to the dangers of collecting driving data.
- soco 2y agoNaming this "oblivious" hides ill intent. And by that I mean, I assume they knew and know exactly the possible implications and decided to throw everybody under the bus for shareholder value. Am I wrong to assume this?
- mrweasel 2y agoHard to say. I'm sure that in some 100 page report somewhere under the list of concerns is the risk of information leaks and potential damage. Then someone decided that the company just spend $50M on "cyber" and in their summation change the text to "potential risk of data lose is offset by investments in cyber security", then they push the new 40 page up the stack. The security risk is now perceived as low, so it's removed from the executive summary and a 3 page memo on the revenue and share price benefits is created. I don't think was ever ill intent, but when it inevitably goes wrong, then yes, everyone will be thrown under the bus if it protects the stock price.
- inetknght 2y ago5 years? Why not forever? WTF, FTC?!
- pards 2y agoWhat can be done about this as a consumer looking to buy a new car? - Can I turn off data collection? - Can I corrupt data transmission and collection? - Can I charge per kb for any data collected? - Is the dealer obligated to disclose data collection? I'll be in the market for a new car in the next few years but I do not want to buy anything that tracks or collects ANY data about me. I was assuming that buying a cheap non-electric car would offer some protection but I'd love to know more.
- penjelly 2y agomany cars now have a TPU, used for connectivity and GPS, which will send telematics data when you start and stop the car. This tracking is not typically easy or possible to opt out of, in my experience.
- LeftHandPath 2y agoMy plan is to buy an old 1960-1970 280SL (or, really, any somewhat reliable vintage car) and stubbornly refuse to drive anything else.
- diggan 2y agoThere are more recent cars than going back to the 70s that doesn't force data collection on you... My car is from 2018 and has none of that stuff, and it even has buttons for all controls, no touchscreen (2018 Audi A3). I like the feel of driving classic/older cars, but I really cannot justify the safety and pollution drawbacks if I wanted to use them daily.
- tomrod 2y agoWhat do you recommend? I thought everything 2015 forward collected data.
- diggan 2y agoAs mentioned elsewhere in the subthreads somewhere here, I got a 2018 Audi A3 in 2019, wrote about the experience re data collection + that purchase here: https://news.ycombinator.com/item?id=42736918 https://news.ycombinator.com/item?id=42736918
- tomrod 2y agoThis is a great outcome. These types of data interchanges ossify innovation and lock in policy. Insurance is supposed to share risk -- there is too much noise to microsegment. "Big Brother" doesn't have to be only a government, and the outcomes of using this sort of information is solely punitive for a 3rd party forced into the interchange. The US really needs to strengthen the legal foundations for people's right to privacy.
- diggan 2y ago> The US really needs to strengthen the legal foundations for people's right to privacy. That's at odds with the even higher (current) goal of "Make money". As long as those are at odds, entities in the US will always favor "making more money" above "people's right to privacy". Or, people start preferring entities that aren't strictly for-profit, but seems unlikely to happen on the short-horizon.
- tomrod 2y agoAye, but they already made money from the consumer. Ergo this is extractive after the exchange.
- Hizonner 2y agoHow about a permanent ban from collecting it in the first place? And you can apply that to the rest of them, while you're at it. > The five-year ban prohibits G.M. from sharing information about individual drivers, but it can still share anonymous data about people’s driving with third parties, such as road safety researchers. I know Kashmir Hill knows better than to believe in the fairy tale of "anonymous data".
- shakahshakah 2y agoNot strictly on topic, but I see these articles & discussions with the focus on new car sales. What happens when the car (and its data collecting habits) is sold in the used car market? Does it still collect data, is the ownership situation "corrected" via DMV registration feeds, etc. ?
- johnea 2y agoSo, only GM is banned. Every other car maker can continue to sell collected surveillance data...
- createaccount99 2y agoGM is cooked