When it comes to consumer protections, Texas instinctively would have ranked among the states I’d least likely expect to give a damn. The Lone Star State is attracting legions of companies because of its pro-business policies, the latest being Elon Musk’s SpaceX and his social media X business. Tesla also is headquartered in Texas.
GM also has critical operations in Texas, where it has more than 9,000 employees. The automaker builds some of its most profitable gas guzzling trucks and SUVs in suburban Dallas and has a technology innovation center in Austin. Texas accounts for 9 percent of GMC dealerships, which sell the automaker’s gargantuan trucks and SUVs.
The normally reliable Starkman instinct appears to have been mistaken. In June, Texas AG Ken Paxton announced the launch of a “major” data privacy and security initiative, establishing a team focused on aggressive enforcement of Texas’ privacy laws. The initiative, housed within the AG’s consumer protection division, is tasked with ensuring “companies respect Texans’ privacy rights and safeguard their personal data.” The team, headed by Georgetown law grad Tyler Bridegan, is poised to become among the largest legal brigades focused on enforcing privacy laws.
“Companies that collect and sell data in an unauthorized manner, harm consumers financially, or use artificial intelligence irresponsibly present risks to our citizens that we take very seriously,” Paxton thundered. “As many companies seek more and more ways to exploit data they collect about consumers, I am doubling down to protect privacy rights.”
Indications are Paxton’s warning wasn’t political posturing. Texas on Tuesday filed a damning lawsuit against GM and its OnStar subsidiary chock full of blistering allegations of wrongdoing that might surprise even those who are well familiar with GM’s ethically challenged culture under CEO Mary Barra. The lawsuit, if successful, could cause GM some serious financial pain, in addition to the dozen or so class action lawsuits also alleging the questionable behavior outlined in Paxton’s lawsuit.
The FTC also reportedly is looking into GM’s data collection practices, and Democratic Senators Ron Wyden and Edward Markey have expressed concerns. Data privacy concerns are bipartisan issues.
Paxton is seeking as much as $10,000 per violation and $250,000 for violations involving GM customers 65 years or older. The lawsuit also seeks restitution for all GM’s Texas customers who were harmed by the company’s alleged privacy wrongdoings, and that GM be required to destroy all the personal driving data it gathered. For good measure, Paxton is also seeking that GM reimburse Texas for its attorney’s fees and court costs.
According to Paxton’s lawsuit, GM has sold or leased more than 1.5 million vehicles in Texas since 2015, when GM’s alleged privacy wrongdoings started. Notably, the alleged wrongdoings began one year after Barra was named CEO and promised that GM would adhere to more ethical business practices in wake of its faulty ignition switch scandal, which was linked to 97 deaths.
Another section of Paxton lawsuit says that GM sold driving data on 1.8 million Texans, indicating he’s potentially seeking more than $18 billion in penalties. While that number is highly unlikely, Paxton recently demonstrated he can shake down big companies for significant dollars.
Paxton last month secured a record $1.4 billion settlement with Meta (formerly known as Facebook) to stop the company’s practice of capturing and using the personal biometric data of millions of Texans without legal authorization. The settlement dwarfed the $390 million settlement 40 states reached with Google in 2022.
Meta in 2023 reported $134 billion in revenues, while GM recorded $172 billion in revenues. GM has also earmarked $16 billion on stock buybacks in less than a year to enrich its shareholders, which likely would influence Paxton in settlement talks if he’s aware of the expenditures.
An email message I sent to Bridegan triggered an automated response saying he was traveling.
Paxton’s lawsuit relates to activities reported earlier this year by Kashmir Hill, an experienced New York Times technology writer specializing in privacy issues. Hill revealed that unknown to many owners of GM’s internet enabled vehicles, the automaker was amassing and selling critical data about their driving behaviors to data brokers, who in turn sold the data to insurance companies. The data was paydirt for insurance companies as it included critical information like how often and long GM owners drive, how fast they take corners, how hard they hit the brakes, and whether they speed.
Hill readily found examples of hapless GM customers whose insurance rates went up considerably because of GM’s data, but notably didn’t feature any customers whose rates went down. A few weeks after her first story was published, Hill reported that GM had stopped selling its driving data.
Paxton’s lawsuit outlines in considerable detail the lengths GM went to deceive its customers to allow the company to track their driving habits and monetize the information, making a mockery of statements made by Barra, and repeated by her PR folks, that GM takes customers’ data security and privacy “very, very seriously.”
“GM’s practice was to subject consumers who had just completed the time-consuming and stress process of buying or leasing a vehicle at a dealership to an “onboarding” process,” Paxton alleges. “To customers, the onboarding process appeared to be a mandatory pre-requisite to taking ownership of the vehicle; however, it was no more than a deceptively designed sales flow to ensure that customers would sign up for GM’s products and unwittingly be enrolled in GM’s Driving Data collection scheme.
“As part of this onboarding process, General Motors electronically presented customers with over fifty pages of disclosures . . . which consisted of product descriptions and a confusing series of applicable user terms and privacy notices.”
Paxton’s lawsuit alleges that GM entered “many agreements” to sell its customers’ driving data. The company allegedly went so far as to contractually obligate one of its driving data buyers to purchase driving data from other automakers and then kick back to GM a portion of the resulting profit. That was on top of the initial multimillion lump sum payment GM demanded from the purchasing company.
Paxton alleges that GM “profited handsomely” from its “ill-gotten data,” earning “millions” from multiple new revenue streams. Barra in 2021 boasted to Wall Street that by the end of the decade, GM would be a “platform innovator” generating as much as $25 billion from its software-enabled services, like heated seats to warm drivers’ derrieres.
GM’s driving data accumulation and sales required the co-ordination of multiple departments, including legal to compose the allegedly deceptive agreements, software services to collect the data, and possibly another group to market and sell the data. If no one raised any red flags, it would be very telling about GM’s culture and employee willingness to ignore questionable behavior.
What’s also telling is that GM thought it could get it away with its data collection practices, even after facing Congressional concerns. In their letter last month to FTC chairman Lina Khan calling for an investigation, Senators Wyden and Markey disclosed they had raised concerns with GM about the company’s data sale practices three years ago.
“Companies should not be selling Americans’ data without their consent, period,” Wyden and Markey said in their jointly signed letter. “But it is particularly insulting for automakers that are selling cars for tens of thousands of dollars to then squeeze out a few additional pennies of profit from consumers’ private data.”
Barra’s privacy scandal comes in wake of the debacle involving GM’s driverless taxi Cruise subsidiary, which ran roughshod over regulators and continued operating its vehicles despite an unidentified whistleblower warning the California Public Utilities Commission that insiders had concerns about the readiness of the self-driving car company’s technology for commercial deployment.
Cruise was forced to temporarily suspend its operations last year when one of its vehicles dragged a pedestrian 20 feet after they were hit by another vehicle. An investigation by a law firm blamed Cruise’s “culture” for the company’s regulatory problems; GM forced out the CEO and more than a half dozen employees.
Barra was chair of Cruise’s board and remains in that role, as well as serving as chair of GM’s board. Arden Hoffman, Cruise’s former chief people officer and the executive presumably responsible for the company’s culture, is now GM’s chief people officer. Bloomberg in 2022 valued Cruise at $30 billion, but the company is worth nowhere near that today.
Despite the Cruise debacle and missing all the goals and objectives she told Wall Street and the media she would achieve, Barra was awarded $28 million for her 2023 performance.
Barra could bankrupt GM and the media would still hail her as one of America’s greatest CEOs.