New: a trial court in 1 of every 10 U.S. counties. Read the post
Court Rules
All enforcement actions
Enforcement ActionLow Risk

Texas AG Sues General Motors for Unauthorized Driving Data Sales

General MotorsAugust 13, 2024Texas Attorney General

Consumers Affected

1,500,000

Summary

Texas Attorney General Ken Paxton filed a lawsuit against General Motors for unlawfully collecting private driving data from over 1.5 million Texas drivers without consent and selling the data to third parties including insurance companies. GM allegedly deceived customers into enrolling in products like OnStar Smart Driver by falsely claiming enrollment was required to retain vehicle safety features, while concealing that enrollment authorized systematic collection and sale of detailed driving data. The action follows an investigation launched in June 2024 as part of the Texas AG’s data privacy initiative, and seeks to hold GM accountable for violating state privacy laws.

Contract Impact

In-house legal teams should review all vendor and partner agreements with automotive manufacturers, telematics providers, insurance companies, and data analytics firms to ensure explicit, informed consumer consent is obtained for any collection, use, or sale of driving, location, or vehicle telematics data. Clauses governing data sharing, third-party sales, and consumer notice must be updated to prohibit deceptive or coercive enrollment practices (such as threatening deactivation of vehicle safety features to compel consent), require clear and conspicuous disclosure of all data collection and sale activities, and ban the use of dark patterns in onboarding processes. Contracts with data buyers should include restrictions on downstream use of driving data, require verification of valid consumer consent prior to purchase, and mandate compliance with all applicable state privacy laws. Additionally, agreements involving generation of driving scores or consumer profiling should be audited to confirm they align with consent and notice requirements, and include provisions for consumer opt-out of data collection and sale.

Contract Search Terms

driving data collectionvehicle telematics data sharingthird-party data saleconsent for data collectiondriving score generationdata collection notice requirementsunauthorized data sharing with insurance companiesdark pattern enrollment practices

Violation Types

Entity Details

Entity

General Motors

Industry

Automotive

Official Sources

Source Evidence

Entity Name
"General Motors"
Event Date
"August 13, 2024"
Jurisdiction
"Texas Attorney General Ken Paxton"
Violation Types
"without their knowledge or consent"
Violation Types
"despite lengthy and convoluted disclosures, General Motors never informed its customers of its actual conduct—the systematic collection and sale of their highly detailed driving data."
Violation Types
"sold this information to several other companies, including to at least two companies for the purpose of generating “Driving Scores” about GM’s customers and selling these scores to insurance companies."

Related Enforcement Actions

CA

General Motors

$12.8M

California Attorney General Rob Bonta, along with multiple district attorneys and the California Privacy Protection Agency, announced a $12.75 million settlement with General Motors for illegally selling hundreds of thousands of Californians' location and driving data to data brokers Verisk and LexisNexis without notice or consent. The settlement includes the largest CCPA penalty to date, a five-year ban on selling driving data to consumer reporting agencies, and requirements to delete retained data and implement a robust privacy program.

CPPA

General Motors

$12.8M

CalPrivacy and the California Attorney General secured a $12.75 million settlement from General Motors for data sharing practices from connected vehicles. The settlement includes injunctive terms to change business practices.

TX

PDD Holdings, Inc. and WhaleCo Inc. (doing business as Temu)

$3.0M

Texas Attorney General Ken Paxton announced a settlement requiring Temu to protect Texans’ sensitive personal data from exposure to the Chinese Communist Party and to strengthen product-safety practices. Temu must pay Texas $3 million, comply with data-security requirements backed by a potential $8 million annual penalty, conduct annual independent product testing, and take specified action on products found to contain harmful substances.

TX

Albertsons Companies, Inc.

$773.0M

Texas Attorney General Ken Paxton announced that a multistate coalition had secured an opioid settlement with Albertsons, which would require the grocery chain to pay more than $773 million nationally once final. Texas and its political subdivisions may receive up to $57.8 million for opioid abatement; the release does not identify privacy violations.

TX

Gerber Products Company and Nestlé USA, Inc.

Texas Attorney General Ken Paxton sued Gerber Products Company and Nestlé USA, Inc., alleging that Gerber made deceptive safety and testing claims while its baby food contained dangerous levels of toxic heavy metals. The lawsuit asserts claims under the Texas Deceptive Trade Practices Act; the release does not report a settlement, monetary penalty, or court order.

TX

Rubinsky Roofing LLC

$1.5M

The Texas Attorney General obtained a judgment holding Rubinsky Roofing LLC liable for 27 violations of the Texas Deceptive Trade Practices Act, including deceptive practices involving older consumers and payment for unnecessary or unfinished repairs. The judgment requires more than $1.5 million in civil penalties, allocates at least $500,000 to consumer restitution, and permanently bars the company and its owner from the practices at issue.