Automakers Sold Driver Data for Pennies, Senators Say Ron Wyden and Edward Markey urged the F.T.C. to investigate how car companies handled the data from millions of car owners.

Ron Wyden speaking to a small group of reporters around him. Sen. Ron Wyden, above, and Sen. Edward J. Markey sent a letter on Friday to Lina Khan, the head of the Federal Trade Commission.Credit…Anna Rose Layden for The New York Times Kashmir Hill By Kashmir Hill Kashmir Hill has been reporting for the last year on the privacy implications of connected cars. July 26, 2024 Updated 11:16 a.m. ET If you drive a car made by General Motors and it has an internet connection, your car’s movements and exact location are being collected and shared anonymously with a data broker. This practice, disclosed in a letter sent by Senators Ron Wyden of Oregon and Edward J. Markey of Massachusetts to the Federal Trade Commission on Friday, is yet another way in which automakers are tracking drivers, often without their knowledge. Previous reporting in The New York Times, which the letter cited, revealed how automakers including G.M., Honda and Hyundai collected information about drivers’ behavior, such as how often they slammed on the brakes, accelerated rapidly and exceeded the speed limit. It was then sold to the insurance industry, which used it to help gauge individual drivers’ riskiness. The two Democratic senators, both known for privacy advocacy, zeroed in on G.M., Honda and Hyundai because all three had made deals, The Times reported, with Verisk, an analytics company that sold the data to insurers. In the letter, the senators urged the F.T.C.’s chairwoman, Lina Khan, to investigate how the auto industry collects and shares customers’ data. One of the surprising findings of an investigation by Mr. Wyden’s office was just how little the automakers made from selling driving data. According to the letter, Verisk paid Honda $25,920 over four years for information about 97,000 cars, or 26 cents per car. Hyundai was paid just over $1 million, or 61 cents per car, over six years. G.M. would not reveal how much it had been paid, Mr. Wyden’s office said. People familiar with G.M.’s program previously told The Times that driving behavior data had been shared from more than eight million cars, with the company making an amount in the low millions of dollars from the sale. G.M. also previously shared data with LexisNexis Risk Solutions. “Companies should not be selling Americans’ data without their consent, period,” the letter from Senators Wyden and Markey stated. “But it is particularly insulting for automakers that are selling cars for tens of thousands of dollars to then squeeze out a few additional pennies of profit with consumers’ private data.” Hyundai enrolled any car with an internet connection in the data sharing, the letter said. G.M. and Honda customers had to opt in to be included, but Mr. Wyden called the enrollment process “deceptive.” The sharing of driver behavior data stopped after The Times reported on it in March. Verisk shut down its “data exchange” for driving behavior in April. A spokesman for Honda, Chris Martin, said that Verisk had provided a driving score service to its customers, and that “no identifiable consumer information was shared with any insurance company” without customers’ opt-in. Hyundai also provided a driving score service. Ira Gabriel, a company spokesman, said the terms and conditions of its Bluelink connected car service had informed customers that data would be shared with Verisk when they activated Bluelink at the dealership. Verisk shared the data with insurance companies only with a customer’s consent, Mr. Gabriel said. “Verisk paid Hyundai for potential future earnings from customers who affirmatively opted into the insurance feature,” he said in a statement. Image Silver skyscrapers rise above a river with a blue sky in the background. The Detroit headquarters of General Motors, which does not seek customer consent for sharing anonymized location information, the senators’ letter said. Credit…Rebecca Cook/Reuters While G.M. has stopped selling personally identifying information about driver behavior to data brokers, it still shares anonymized location information from its cars with a company that Mr. Wyden’s office said G.M. had declined to identify. According to the letter to the F.T.C., G.M. told the office that it did not seek consent from customers to share the location of their cars, and that the only way to opt out “was by disabling the car’s internet connection entirely.” “As is common business practice, we share de-identified data not associated with specific drivers or vehicles with select partners to enhance city infrastructure and road safety for pedestrians, cyclists and drivers,” a G.M. spokeswoman, Malorie Lucich, said. Previously, G.M. shared cars’ locations with a British data broker, Wejo, in which G.M. had an investment. Wejo filed for bankruptcy last year. Matt Bialuk, who was an executive at Wejo, said that the company had gotten the precise location of about 10 million G.M. cars up to every one to three seconds, but that the data did not include identifying details about the driver. The data was useful for universities and state transportation departments, he said. “You can see braking, bottlenecks, route optimizations,” Mr. Bialuk said. “There are tons of use cases. This is how to create smart roads.” He added: “We could see windshield wipers are on. Windshield wipers tell a huge story in vehicles.” FTC @FTC · Follow Concerned about what information your car collects and how it’s used?

Tell the FTC at https://ReportFraud.ftc.gov. Click “Report now” then choose “Something else” to tell your story. #connectedcars #privacy 1:41 PM · Mar 21, 2024 23 Reply Copy link Read 2 replies This is at least the third letter the F.T.C. has received from Congress asking it to investigate the collection of data from Americans’ cars. In March, the F.T.C., which is responsible for policing unfair and deceptive business practices, solicited reports from consumers about the issue, but an agency spokeswoman said she couldn’t comment on whether the agency is investigating. Privacy Concerns about Connected Cars

Your Car Is Tracking You. Abusive Partners May Be, Too. Dec. 31, 2023

How G.M. Tricked Millions of Drivers Into Being Spied On (Including Me) April 23, 2024

Automakers Are Sharing Consumers’ Driving Behavior With Insurance Companies March 11, 2024

‘Smartphones on Wheels’ Draw Attention From Regulators April 30, 2024 A correction was made on July 26, 2024: Because of an editing error, an earlier version of this story misattributed who paid for driving data. Hyundai was paid for its data, it did not pay for it. When we learn of a mistake, we acknowledge it with a correction. If you spot an error, please let us know at nytnews@nytimes.com.Learn more Kashmir Hill writes about technology and how it is changing people’s everyday lives with a particular focus on privacy. She has been covering technology for more than a decade.