General Motors Is Banned from Selling Driving Behavior Data for 5 Years

I do not know the year they started with all the tracking stuff but you can find an older car that does not have any tracking and spend the rest of the money making it mint.

There is no getting away from it though, we are all watched over by the machines of loving grace. You know with the new LoRaWAN and IoT everywhere scam they are rolling out there will be nothing you can do to escape the surveillance apparatus.

I am giving up. no sense in fighting it anymore. I am just a good little corporate boy toy now.

For a consumer in the US, I have no idea, but I'm guessing your question is about that since the story is US-specific?

Probably off-topic, but buying a car in 2019 in Spain, they asked me if I'm OK with data-collection during the purchase, up until car delivery, and handed me a contract to sign for "treatment of personal data". I said no, we moved on.

After buying the car (2018 Audi A3), they threw in some remote-monitoring sensor "for free" that could let me/them see metrics about the car, for "maintenance" and whatever they claimed, that they offered to install. I again said "no", but kept the device itself to pick apart at some later time.

But overall, they seem required to ask (here, EU) but no one batted an eye when I said no. The car has a SIM-card reader, but never used it, I'm guessing if I install a SIM-card the car would ask me if data collection is OK, because we'll always have the choice at least.

Electric cars seems like a no-no for now (everywhere possibly), since all of them came with a "always on connection" regardless of what I want, at least last time I checked.

Mazda won't permit me to use remote start because I refused to install their app and enable connected services. The man I worked with on the lease was extraordinarily aggressive with me. Almost demanding I install and register this app to complete lease agreement.

So now I don't have remote start and every time I turn the car on I have to select cancel on an infotainment prompt asking me to enable connected services.

The TOS specifically says driving data will be sold to 3rd parties including law enforcement and insurance companies.

In my 2018 Chevy Volt Premier it's not too difficult to disconnect the LTE module. You lose OnStar, remote start, and other "connected" features, but the car and CarPlay still work.

https://www.jamesxli.com/2024/chevy-volt-disable-cellular.ht...

- confusing consumers

- sneakily signing up consumers to “smart driver” as part of onstar

- data brokers subsequently building profiles on users and selling this data to _insurance companies_

- consumers later finding out their insurance doesn’t get renewed because of this secret driver profile that was built without their explicit consent

If GM followed the rules by disclosing this directly, allowing consumers to opt out. They probably wouldn’t be in this embarrassing position.

It’s in the FTC release: https://www.ftc.gov/news-events/news/press-releases/2025/01/...

Protecting it is difficult since the house/senate and scotus are all determined to roll back pro-consumer laws but that's not really something the FTC can fix, only voters can fix that.

Voters don't seem to see these things as important though based on how they voted most recently. They have other priorities I suppose.

Jail time? Probably not, we let health insurance companies get away with taking away critical needs from patients and delaying care in the name of delivering shareholder value. The best they get is a slap on the wrist from the government, let alone jail time.

You're going about this all wrong. Setup a company, create a landing page and do some B2B contracts for selling that data, and you too can be a "Data Broker" fully legally. But yes, approaching this as an individual is most likely illegal, you're supposed to do it as a corporation.

Either it's illegal or it isn't.

No judge ever says "I ban you from burgling houses for 5 years!", like after 5 years it would be okay again.

There's a company called Carfax that I'd never heard of. Their EU site seems to provide basic reports about the VIN, whether the car has been written off, etc. Those basic "Is this car sale a scam?" checks are common in the UK.

But the site also makes a big deal about "Get the American report!" So I googled "Carfax oil change" and found people talking about the oil change history in the reports [0]

In the UK it was traditionally common to keep a car log book where you recorded all maintenance and might get the garage to put their stamp on it, to prove to a future buyer that you'd looked after the car. But having a garage enter that info into some random company's database, and maybe not telling me, would be disappointing.

[0] https://www.toyotanation.com/threads/oil-change-history-when...

With the VW data leak I was pretty horrified that VW either doesn't understand or don't care that leaking location data isn't just privacy invading, it's potentially dangerous for victims of stalking and abuse. In the mildest cases these people may need to move, in the worst they die.

Car companies seem completely oblivious to the dangers of collecting driving data.

That's at odds with the even higher (current) goal of "Make money". As long as those are at odds, entities in the US will always favor "making more money" above "people's right to privacy".

Or, people start preferring entities that aren't strictly for-profit, but seems unlikely to happen on the short-horizon.

Sadly the answers are "if it's got a connected computer in it, it's selling your information" and "you're in America, so no GDPR because 'free speech' trumps privacy almost every time, except for video rental records".

The main problem is that this sort of thing (tracking of cars and storing the data in a central database) is considered normal by corporations and is allowed by law. Would we like to have big corporations place private detectives outside our houses and when we leave they follow our every step, take photos, record audio and track our GPS position and report all that data to the corporation in realtime? That is what they do now with their cars and phones and appliances. The reason they did not do it in the past was that it was expensive to have private detectives track each of their customers, was considered spooky and abnormal and it was probably also illegal, but now it is cheap and somehow considered normal.

If data is entered into a system, and you do not have not received permission to read it, then obtaining access to it is the crime of dataintrång, which can lead to two years imprisonment. So if you make a device and sell it to a customer and it phones home without permission and in phoning home provides you with information he has entered into it, then you've committed dataintrång and can go to prison for up to two years.

I see no reason why GPS data and other automatically entered data would not be regarded as having been entered into the device.

You may think 'we're only using it for advertising', but I don't trust you and I can't. I don't want you to obtain information about my political views, or how they differ from what I say on the internet, or who I talk to about maths, or where I buy food.

No, because I have less than zero expectation that you all <points with middle fingers at HN comment section> won't happily be complicit in something that retroactively criminalizes me or otherwise screws me (and god knows how many other people, I'm fairly unremarkable) over on the basis that doing so is X% better for Y or where X is a small value and Y is a subject that is far from an existential issue for society. Society goes off on these boondoggles from time to time, eugenics, sticking the mentally ill in prisons but with pills, etc, etc and I don't want to see that sort of stuff cranked to 11 because the public tolerated a bunch of dragnet tech that serves as a force multiplier for unaccountable decision makers.

An essay about such a society: https://web.archive.org/web/20030212145443/http%3A//www.wire...

They sell targeted ads using data, not the data itself.

Undisclosed data collection isn't unique to the US.