Techdirt is off for the holiday! We'll be back with our regular posts on Saturday.
FTC Bans GM From Selling Driver Location Data For 5 Years
from the I'm-just-saying-it-would-have-been-nice-if-you-asked dept
Last year, Kashmir Hill at the New York Times published a major story confirming that automakers collect all sorts of driver behavior data then sell it to a long list of companies — without making that clear to car owners or getting consent. That includes insurance companies, which are now jacking up insurance rates if they see behavior in the dataset they don’t like.
Not surprisingly, GM was subsequently sued. Several times. Forcing it to spend much of last year going on an apology tour, which included pinky swearing that they will stop spying on their customers and selling data to data brokers and insurance companies.
Fast forward to this week, and the FTC has announced a new settlement with GM and OnStar, banning the companies from collecting and selling sensitive user location data for five years.
“G.M. monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,” outgoing FTC boss Lina Khan said of the settlement. “With this action, the F.T.C. is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”
A report last year by Mozilla highlighted how the auto industry was the absolute worst industry that the organization tracks on privacy practices, routinely over-collecting and failing to adequately protect or encrypt broad swaths of data. Not just data from the vehicle; but troves of data collected from your phone every time you sync it with your car’s infotainment and navigation systems.
This data is then sold to a massive array of dodgy and barely regulated data brokers, who aren’t particularly discerning when it comes to selling that data to all manner of equally dodgy folks, whether that’s foreign and domestic governments, stalkers, right wing anti-abortion activists, or people pretending to be law enforcement. You can see how this could prove problematic under authoritarian rule.
In the case of most automakers, they bury what passes for “informed consumer consent” deep in the bowels of some overlong privacy policy for their free initial roadside assistance services, which most users never notice. This GM settlement bars GM and OnStar from collecting this data, and requires that they allow users to request copies and the deletion of any existing data.
On one hand, this is a nice example of the positive outcomes that can happen when journalism, consumer groups (Mozilla, Consumer Reports), and regulators work together to protect consumers.
On the other hand, piecemeal temporary settlements aren’t quite as effective as passing a meaningful and consistently enforced federal privacy law, which the U.S. Congress is too corrupt to do. And after billionaires whined endlessly about Lina Khan being too mean, a key component of Trump 2.0 will be defanging regulatory independence and consumer protection, so whether this settlement even sees enforcement by the Trump FTC is an open question I’m pretty sure I know the answer to.
“Secretly collecting and sharing driver location data is a terrible practice that can cause real harm to unsuspecting consumers,” Consumer Reports Tech Policy DirectorJustin Brookman said of the settlement. “We are encouraged that the FTC is taking action under existing consumer protection law to put a stop to it. But because of ambiguity in the law, the best way to avoid these types of abuses in the future is a strong and clear comprehensive privacy law that restricts unwanted data sharing by default.”
Filed Under: automakers, consent, consumers, drivers, ftc, location data, privacy, surveillance
Companies: gm, onstar
Comments on “FTC Bans GM From Selling Driver Location Data For 5 Years”
Typical Lina Khan W. She is a national treasure.
The fine is less than $1 million. so smaller than a days profit selling the data.
'Sure rampant unchecked data collection is a problem... but not that big of one.'
Fast forward to this week, and the FTC has announced a new settlement with GM and OnStar, banning the companies from collecting and selling sensitive user location data for five years.
“G.M. monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,” outgoing FTC boss Lina Khan said of the settlement. “With this action, the F.T.C. is safeguarding Americans’ privacy and protecting people from unchecked surveillance.”
Except no, you’re really not. If you were interested in safeguarding the privacy of americans you would have made it a permanent ban, not slapped a relatively short expiration date on it.
Just imagine that logic being applied anywhere else…
‘You have been found guilty of multiple counts of breaking and entering, paired with installing surveillance cameras in the homes of your victims. As such you will be fined $100 and will be prohibited from doing either of those actions for the next five years, after which… I guess don’t get caught next time?’
Re:
This is a voluntary settlement. They don’t have the authority for a permanent ban, that’s a law issue, not so much an interest issue. (To say nothing of the timing, GM could’ve dragged this out for 4 more days)
That said, it’s better than it sounds. While the ban is only 5 years, it also requires obtaining (affirmative express) consent, letting people view/delete the data, and giving an opt-out, indefinitely. Those aren’t time limited.
Re:
Except they haven’t been “found guilty”. They’re settling. There hasn’t been a trial.
Also, illegal things are already illegal. You already can’t do breaking and entering. But a court might issue an order saying you can’t contact the victim for the next 5 years. Contacting the victim is something not generally illegal without the order. Similarly, I don’t think selling location data to consumer reporting agencies is illegal all by itself; the problem as I understand it was that they did it “without adequately notifying consumers and obtaining their affirmative consent.” But now they’re prohibited from selling that data to such agencies for 5 years.
gm
gm can easily afford a $25 billion dollar fine
SMALL DONATION
Instead of selling location information, they will just request a “Small” donation from the requesting company/agency. Problem solved. /S
Wouldn’t it be something if the punishment stops at the same desks the dollars do?
Maybe a specialty resort in Alaska for a decade or three.
Create local jobs.
Keep the bears fed.