Driving Dystopia: Automakers Selling User Data for Pennies, Senators Ask FTC to Get Involved

While the driving masses are gradually becoming aware that automakers are using connected vehicles to sell off user data to third-party data brokers, there isn’t a lot of public information on exactly how this business is being conducted. However, headway is indeed being made.

A letter to the Federal Trade Commission has revealed that these automakers are not only selling off your personal data, they’re doing it for a pathetically small sum of money. Penned by U.S. senators Ron Wyden and Edward J. Markey, the document pertains to data broker Verisk and an earlier story that roped in several major manufacturers.

In March, General Motors, Honda Motor Co, and Hyundai Motor Group were previously criticized for having sold customer data accumulated by the telematics software equipped to modern vehicles. They, and several other automakers, were part of a New York Times report highlighting how a massive amount of consumer data had been handed to Verisk Analytics and LexisNexis’ Risk Solutions under the auspices of lowering insurance rates.

Despite previous reports indicating that just about every manufacturer does this to an egregious degree, the letter pertains specifically to GM, Honda, and Hyundai — which all sold data to Verisk before it then gave the information to insurance groups as part of risk assessment scoring.

In the document, the senators request that the Federal Trade Commission investigate the involved companies’ "disclosure of millions of Americans’" information to data brokers' and determine whether or not they’ve broken the law. It likewise hints that some businesses may have known they were in the wrong, citing that Verisk eliminated the relevant program immediately after the public was made aware of its existence.

From the letter:

Recent investigative stories published by the New York Times have raised public awareness into automakers’ sharing of data from their customers’ internet-connected cars with data brokers for subsequent resale to insurance companies. Although General Motors (GM) has been the focus of much of the news coverage, it is not the only auto manufacturer to have shared driver data. Senator Wyden’s office conducted follow-up oversight into three auto manufacturers — GM, Honda, and Hyundai — that shared data with the data broker Verisk Analytics. Each of these three automakers confirmed their disclosure of drivers’ data to Verisk, such as acceleration and braking data. GM also confirmed that it disclosed customer location data to two other companies, which it refused to name.

Verisk essentially acts as a credit agency for drivers. One of the company’s products, which it shut down in April 2024 following New York Times’ reporting, scored drivers on their safe driving habits using data from internet connected cars. Automakers shared drivers’ data with Verisk, which mined it to prepare Driving Behavior Data History Reports. Verisk sold these reports to auto insurance companies and also provided automakers with some of this information, including a driving score and safe driving suggestions, to provide to their customers. GM and Honda confirmed that they required consumers to enroll in a specific voluntary program, in which Verisk’s role was obscured, before sharing their data. Hyunda enrolled all consumers who activated their new car’s internet connection into the company’s driving score program, which included sharing their data with Verisk.

If you’re wondering how much your data is worth to these companies, Sen. Wyden's office conducted an investigation that revealed Honda was paid 26 cents per vehicle whereas Hyundai made 61 cents per car via Blue Link (see below). General Motors allegedly refused to share that information, though it was previously assumed to have transferred data of over 8 million of its own customers.

While that sounds like a paltry sum for basically every action you’ve ever taken inside your automobile, those numbers add up when the data set encompasses millions of users. Automakers are effectively attempting to create novel revenue streams by copying what social media and tech companies have been doing for years. In 2022, a study estimated that Facebook can earn up to $900 per user by selling the personal information of users to other companies. This allows it to earn billions upon billions of dollars annually.

Honda was cited as having sold information on about 97,000 cars, whereas Hyundai allegedly moved data on roughly 1.7 million vehicles over a six-year period. But these companies aren’t just selling to Verisk and Verisk likewise isn’t keeping all of that data for itself. The final tally will be exponentially larger and presumably incorporate literally every automaker that’s selling connected automobiles, followed by a chain of data brokers that then resell that information.

“Companies should not be selling Americans’ data without their consent, period,” stated the letter from Wyden and Markey. “But it is particularly insulting for automakers that are selling cars for tens of thousands of dollars to then squeeze out a few additional pennies of profit with consumers’ private data.”

Businesses frequently assert that any data sold off is anonymized. But that shouldn’t make you feel any better when the information is still being collected without your permission. We also know that algorithms exist to batch data on individual people, which are then sold off to build driver profiles that impact specific people’s insurance rates. It’s only anonymous until it’s more profitable for it not to be, which is most of the time.

Despite more people being made aware of this issue, there remains a sort of collective ignorance surrounding data collection. Whenever I have asked the employees of these companies how these decisions are made and where the borders are, nobody ever seems to know. The people working in the public relations department may have vaguely worded pre-written statements to share. But they don’t actually understand how connected vehicles operate or accumulate information or what happens to it after it has been collected.

I once asked a question about data harvesting during a manufacturer media event and it took them the better part of an hour to answer. All I wanted to know were the boundaries for data collection and sharing (including sales) were on a new fleet management system the company was trying to promote. But an answer necessitated several side conversations between the ground team that feeds journalists information, the corporate legal department, and whatever executive was available that afternoon. The takeaway was that the employees were either unaware of how data exchange functioned on the vehicles or actively trying to avoid answering questions about the topic.

Those days are probably coming to an end, however. Over the past decade, the public has become aware of how numerous industries harvest data and use connected services to maximize the profitability of their latest merchandise — often at the expense of paying customers. The collective willingness to tolerate it seems to be on the decline and this will undoubtedly carry over to the automotive sector. The right-to-repair movement has likewise taken up the fight against software-defined vehicles being used to cede the very concept of ownership while selling off the information of unwitting drivers. Lawsuits seem to be on the horizon and many drivers (myself included) are looking into how to physically disable the connected services on modern automobiles as a matter of principle. While one would lose access to many of the features associated with modern vehicles by doing this, they would regain a level of vehicular privacy that had been the status quo for over 100 years.

[Images: General Motors; Hyundai]

Become a TTAC insider. Get the latest news, features, TTAC takes, and everything else that gets to the truth about cars first by  subscribing to our newsletter.