Nebraska AG Claims GM and OnStar Used 'Emotional Blackmail' to Gather Consumers' Data
Not only has General Motors (GM) and subsidiary OnStar unlawfully collected, processed and sold Nebraskans' sensitive data since 2015, but many residents unknowingly opted in to these data practices, Attorney General Mike Hilgers (R) alleged in a lawsuit against the companies Tuesday. The AG said GM and OnStar violated the Nebraska Consumer Protection Act and Uniform Deceptive Trade Practices Act.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
“GM made an aggressive, concerted effort to enroll purchasers of 2015 model year or newer vehicles into GM products that would collect customers’ Driving Data,” the complaint said. “GM similarly pushed customers to use its free, brandspecific mobile applications: myBuick, myCadillac, MyChevrolet, and myGMC. But GM did not accurately disclose to customers that GM treated the mere downloading of and enrollment in these applications as an 'agreement' by the customer to GM’s collection and sale of their Driving Data.”
At a press conference, Hilgers said that GM misled customers as well as third parties that purchased drivers' data, telling those purchasers consumers had consented to sell their information. Discovery continues and will hopefully determine how many Nebraskans were affected and if GM and OnStar are continuing their alleged deceptive practices, added the AG.
“Nowhere in any of their disclosures did GM tell people that this is what they were going to do,” Hilgers said. “In fact, what they instead did, oftentimes, was use emotional blackmail" to get them to hand over their data. For example, they would tell customers that sharing data was "necessary to help protect" drivers' safety and that data "would not be shared with third parties," except in "some limited circumstances," he said.
“Turned out none of that was really true,” Hilgers continued. “Looks like the real purpose of [collecting] this data was to sell [it] to insurance companies to be able to impact people's rates.”
Since around 2015, Hilgers said, GM would take customers' data and sell it to third parties, who then sold it to insurance companies. "Those insurance companies would use the data ... including how fast you were driving, how hard your stops were, where you went, whether you had your seat belt [on] ... to make decisions regarding people's insurance.”
Although the state’s comprehensive privacy law -- the Nebraska Data Privacy Act -- took effect in January 2025, a spokesperson for the AG’s office told us the suit was filed under the Consumer Protection Act and Uniform Deceptive Trade Practices Act because the primary allegations occurred prior to January. The suit is more about misleading consumers than violating data-privacy laws, the spokesperson added.
The complaint, filed in the District Court for Lancaster, Nebraska, alleged that the data included GPS direction and coordinates, driving speed, engine run time totals, amount of fuel used and driver seatbelt status information, among other data points.
This lawsuit follows several states who have filed similar complaints against GM for its collection and sale of data, starting with Texas in 2024 (see 2501160029).
Arkansas filed its suit in February (see 2502260044), followed by Indiana in March (see 2503270040). In January, the FTC also proposed a nonmonetary settlement with GM and OnStar over allegations the companies collected and sold consumers’ location data without proper consent (see 2501170068).
"We remain committed to protecting consumers' privacy and will conduct a review of the complaint," said a GM spokesperson in an emailed statement to us.