Texas Attorney General Ken Paxton has filed a lawsuit against General Motors (GM), accusing the automotive giant of unlawfully collecting and selling sensitive driving data from millions of Texas residents. The lawsuit, which was filed in the state district court of Montgomery County on Tuesday, alleges that GM engaged in "false, deceptive, and misleading" practices by harvesting detailed data from vehicles without the proper consent of drivers, and subsequently selling that information to insurance companies and data brokers.
The legal action centers on GM's use of technology installed in its vehicles from the 2015 model year onwards. This technology enabled the company to collect a broad range of driving data, including when drivers started their vehicles, their speed, seatbelt usage, distance traveled, and engine running time. According to the lawsuit, more than 1.8 million Texas residents and 14 million vehicles were affected by GM's data collection practices.
Attorney General Paxton argues that GM's actions represent a gross violation of consumer privacy rights. "Companies are using invasive technology to violate the rights of our citizens in unthinkable ways," Paxton stated. "Millions of American drivers wanted to buy a car, not a comprehensive surveillance system that unlawfully records information about every drive they take and sells their data to any company willing to pay for it."
The lawsuit further claims that GM sold this driving data to insurance firms under the pretext that consumers had given their consent-an assertion that the Texas Attorney General's Office disputes. The complaint seeks civil penalties, demands the destruction of all improperly obtained driving data, and calls for full restitution to all affected consumers.
This legal battle marks the first state enforcement action against an automaker for the sale of driver data. It comes on the heels of an investigation launched by Paxton in June, which scrutinized multiple car companies for their data collection practices. The concerns raised by the investigation were amplified by a March report from The New York Times, which revealed that GM had been sharing drivers' data with global data brokers like LexisNexis and Verisk, who in turn provided the information to insurance companies.
The lawsuit also highlights GM's partnerships with several data brokers, including Verisk, LexisNexis, British connected car startup Wejo, and Jacobs Engineering Group. These partnerships, particularly GM's 35% stake in Wejo, reportedly allowed the company to monetize the driving data of its customers, often at a loss. The Texas lawsuit suggests that these practices were not only deceptive but also detrimental to the privacy and rights of millions of Texans.
In response to the lawsuit, GM issued a statement acknowledging the discussions with the Attorney General's office and expressing a shared commitment to consumer privacy. "We've been in discussions with the Attorney General's office and are reviewing the complaint," a GM spokesperson said. "We share the desire to protect consumers' privacy."
The broader implications of this lawsuit could be far-reaching, potentially setting a precedent for how automotive companies handle consumer data in the future. The allegations against GM also echo growing concerns among lawmakers and privacy advocates about the extent to which modern vehicles collect and share data. In July, Senators Ron Wyden (D-Ore.) and Ed Markey (D-Mass.) sent a letter to Federal Trade Commission Chair Lina Khan, urging an investigation into the auto industry's data collection practices.
According to the senators' letter, the financial incentives for sharing this data are considerable. For example, Verisk reportedly paid Honda $25,920 for data collected from 97,000 cars between 2020 and 2024, amounting to just 26 cents per car. Hyundai shared data from 1.7 million vehicles with Verisk over six years for $1.04 million, or 61 cents per car. GM's Smart Driver program, a key focus of the lawsuit, generated annual revenue in the "low millions of dollars."
