Ann Arbor, MI (InvestigateTV) — With dedicated careers in the nonprofit sector, Ryan Bates and his wife never expected the first car they bought to be a high-tech electric vehicle.

“We really like the car. We love being able to charge it here at home,” Bates said.

What they didn’t know, however, was that their new 2023 Chevy Bolt EUV, with its innovative features, would also gather a wealth of information about their driving habits.

After seeing several news reports claiming that Chevy was monitoring customers who bought its cars, Bates decided to contact a data broker, LexisNexis, to ask consumer disclosure report.

That’s when Bates learned that his car dealer had signed him up for a free OnStar subscription from Chevy’s parent company, General Motors, designed to help with safety, security and in-vehicle navigation.

But Bates was unaware that the terms of use/agreement/subscription meant his vehicle would also collect his daily driving activity – something he likened to “spying”.

“I was able to call LexisNexis, put in a request for my file, and what came back was 200 pages,” Bates said. “(It shows) every time I brake a little bit, every time I accelerate a little bit fast.”

The data was collected by the OnStar program and then sold to LexisNexis.

The report revealed records of his trips via telematics data, detailing acceleration events, hard braking, high speed events, distance traveled and the vehicle’s VIN. However, he did not provide context for these incidents or what might have triggered them.

“Did I brake hard because a child ran into the street? Or am I braking hard because I’m a bad driver?” Bates asked. “Did I speed to avoid an accident on the highway or did I speed because I was irresponsible? This report says none of that.”

Bates is not only concerned with where this information is stored, but how an insurance company might use it.

“Did they give it to my insurance company? I don’t know. There’s no way to know,” Bates said.

“Who Owns Whom?”

Bates isn’t alone in pointing out a problem. InvestigateTV found that several consumers filed complaints with the Consumer Financial Protection Bureau about the leak of personal information.

One consumer stated: “LexisNexis provided incorrect information to XXXX and my auto insurance is being raised because of this. I never consented to them having my information, nor do I consent to them having information about me. They are legally required to provide the correct information when selling someone’s information and I refuse to give them personal information. I am asking that they correct this report so that my car insurance returns to the cost it should be as they are legally required to do so without any action on my part.”

Another consumer filed a similar complaint with the Ohio Attorney General’s Office.

“I requested a consumer disclosure report and the report came as a web link and password, but when I tried to download and view it, I got an error message. This is the failure to comply with my request. I requested this as a result of discovering that GM could sell my driving data to this company (LexisNexis) without my express permission. This only gets worse when the requested document throws errors when you try to view it.”

In August, Texas Attorney General Ken Paxton filed a lawsuit against General Motors for illegally collecting drivers’ private data and selling it to several companies, including insurance companies, following the launch of its own investigation into the automaker in June.

Several other class action lawsuits have also been filed. A case in Michiganwhere GM and OnStar are based, says the companies shared or sold data to third parties to “compile reports used by auto insurance companies to set rates and premiums, all without consumers’ knowledge or consent.”

In another, a a Florida man claims his insurance premiums went up after “false information” and “negative driving information” were illegally provided to insurance carriers.

So far, General Motors and OnStar have denied all claims against them. GM also announced in April that it had severed ties with LexisNexis.

“Who owns who, right? Am I the owner of the car or does the car own me? When the car is selling that much information to a data broker, it’s like I’m the product,” Bates said.

The need for a stronger consumer privacy law for car manufacturers

Investigate the TV first discovered the problem after experts and lawmakers questioned how much data the machines could collect about consumers. As technology advances, modern cars are becoming more like smartphones on wheels, equipped with sensors, cameras and GPS systems that constantly collect massive amounts of data.

In 2017, only six percent of vehicles on the road were connected to the Internet. Fast forward to 2023, and that number has grown to nearly 31%. According to a LexisNexis forecastby 2027, nearly half of US cars are expected to be connected.

Center for Auto Safety Executive Director Michael Brooks directly witnessed the transformation of the automotive landscape. For decades, his nonprofit has closely watched the auto industry and government regulations to ensure consumer protection.

Brooks pointed out that the data collected by the machines goes beyond what many consumers may realize. From keys to opening and closing doors and even activating windshield wipers, all of these actions are tracked, he warned.

“Some cars collect a thousand data points every millisecond, which means you’re collecting about a million data points per second over the course of your journey. It’s a lot of data uploaded to the company,” Brooks said.

This extensive data collection raises concerns about how this information is used and who has access to it. When it comes to privacy in these matters, Brooks argued that we need laws to protect consumers.

“Unfortunately, in America today, there are very few laws about who controls this data. Consumers don’t have a lot of rights in the law that say this is your data and you can control it,” Brooks said.

He believes, however, that if the information is not identifiable, it could be useful to keep the roads safe.

“The data that comes out of these machines, while it’s a threat to consumers in some ways to privacy, when it’s not anonymized, if it’s anonymized, it can be used for great purposes,” Brooks said.

InvestigateTV reached out to several major insurance companies across the country. Only Geico, Progressive and USAA responded, saying they collect driving data through consent-based programs to generate overall driving scores, which can affect consumers’ insurance premiums.

Senator Jeff Merkley (D-OR) introduced Car Privacy Rights Act of 2024aimed at protecting consumer automotive data and increasing transparency in data collection practices. Its legislation seeks to prevent car manufacturers and other entities from sharing or selling any data collected from consumers through their vehicles without explicit prior consent.

Merkley’s proposal includes provisions requiring automakers to simplify the process for consumers to revoke their consent to data collection. In addition, the bill requires all car manufacturers to submit annual reports to the Federal Trade Commission (FTC) detailing their consumer data privacy practices, including information about who the data is shared with and sold to.

The Biden administration recently proposed restrictions on connected vehicles with parts sourced from Russia and China. Those rules would restrict data brokers from selling data to other countries, but they don’t stop a US manufacturer from sharing and selling that information right now.

Meanwhile, Ryan Bates continues to advocate for more consumers to request their disclosure reports to find out what their car manufacturers may have collected. He urges Congress not to hold back on stronger consumer laws.

“The solution here is not to buy another car; the solution is we need laws to stop it. We need stronger consumer protections so people who go out and buy a car don’t have to worry about it spying on them,” Bates said.

Copyright 2024 Gray Media Group, Inc. All rights reserved.