On February 26, 2025, Arkansas Attorney General Tim Griffin filed a lawsuit against General Motors and its subsidiary OnStar (collectively, "GM"), alleging deceptive business practices related to the collection and sale of consumers' driving data. In the absence of a comprehensive state privacy law, the lawsuit relies on the Arkansas Deceptive Trade Practices Act ("ADTPA"), asserting that GM failed to obtain consumers' "informed consent" before selling their driving data to third-party brokers, who then profiled consumers for insurance companies.
Allegations of Deceptive Practices
According to the lawsuit, GM employed misleading techniques to ensure customer enrollment in its telematics technology, enabling the collection and sale of detailed driving data, such as vehicle speed, acceleration, and braking patterns, without obtaining "informed consent." The attorney general contends that while GM provides some transparency about its telematics system, it does not adequately inform consumers about the extent, purpose, or consequences of its data collection, use and sharing practices.
Key allegations include:
- Misleading Marketing: GM allegedly promoted its telematics services as exclusively benefiting consumers, e.g., enhancing vehicle safety, functionality, and operability, while omitting any mention of its monetization of driving data or the potential financial harm to consumers, such as increased insurance premiums or coverage denials.
- Lack of Informed Consent: The lawsuit claims GM presented consumers with lengthy, cross-referencing terms of service and privacy statements that were insufficient to obtain informed consent. For example, the Attorney General contends that GM "overwhelms" the consumer with information during the onboarding process by providing 29-page user terms, a 18-page privacy statement, and links to user terms and privacy statements from other partners involved in providing the OnStar service.
- Failure to Adhere to Industry Commitments: The attorney general further argues that GM failed to uphold its commitments under the Consumer Privacy Protection Principles of the Alliance for Automotive Innovation. Specifically, the company did not provide owners with clear, meaningful, and prominent information about its collection of driving behavior data, the purposes for which it is collected, and the types of entities with which it is shared.
Broader Enforcement Trends
The Arkansas lawsuit follows a similar case brought by the Texas attorney general against GM and several other car manufacturers for allegedly collecting and selling consumer driving data without their knowledge or consent. Notably, the Texas attorney general recently launched the first-ever state privacy law enforcement action against an insurance company for allegedly failing to provide a clear and accessible privacy notice regarding the processing of sensitive consumer data.
These developments highlight increasing regulatory scrutiny on businesses that collect and monetize consumer data, reinforcing the need for companies to ensure that privacy notices and disclosures accurately reflect their data collection, use, and sharing practices and are aligned with consumer expectations. Businesses should also avoid overly complex consent mechanisms that could lead to allegations that they obscured the true nature of their data practices.
Finally, it is also worth noting that the Arkansas state legislature has been considering a comprehensive consumer data privacy bill, the Arkansas Digital Responsibility, Safety, and Trust Act (SB 258). Aligned with the attorney general's concerns in around consumer transparency, the Act explicitly states that consent does not include "an acceptance of general or broad terms of use or a similar document that contains descriptions of personal data processing along with other unrelated information" or "an agreement obtained through the use of dark patterns" (Section 4-120-103 8(c) SB 258).
Burak Haylamaz (White & Case, Staff Attorney, Los Angeles) contributed to the development of this publication.
