Privacy Battles: OnStar Says GM May Record Car's Use, Even if You Cancel Service

Sept. 26, 2011 — -- OnStar, the service started by General Motors to support drivers through a cell phone system in their cars, has now told customers it may collect information on their movements and driving habits -- even if they no longer subscribe to the service. The notice went out quietly; the response has been anything but.

Now that the dust has settled (a little), it's worth taking a look at this case, because observers say it illustrates the conflict over privacy, technology and what companies want you, their customers, to think of them.

OnStar installs cellular systems in vehicles which, if you pay for a service plan (starting at $18.95 a month), can give you driving directions, open the car doors if you lock yourself out, even track your car and alert local police if you are in an accident and your airbags inflate.

Sound useful to you? It has more than five million customers. But then the company sent users a routine email updating its terms of service. Buried in some legal language was this line:

"Unless the Data Connection in your Vehicle is deactivated, information about your Vehicle may continue to be collected even if you do not have a Plan."

A few lines later:

"We may ... share the information we collect with law enforcement or other public safety officials, credit card processors and/or third parties we contract with who conduct joint marketing initiatives with OnStar."

In other words, OnStar was reserving the right to collect and share information on your driving habits -- even if you decided the service was a gimmick and ended your subscription.

'Serious Concern' About Privacy

"OnStar has kicked a hornet's nest," wrote one person on Twitter who had noticed the change. The company quickly had to go into overdrive, trying to force the hornets back into the nest.

Sens. Al Franken of Minnesota and Christopher Coons of Delaware, both Democrats on the Senate Judiciary Committee, wrote to express their "serious concern" with the changes.

"OnStar's assurances that it will protect its customers by 'anonymizing' precise GPS records of their location are undermined by a broad body of research showing that it is extraordinarily difficult to successfully anonymize highly personal data like location," they said.

Sen. Charles Schumer (D.-N.Y.) weighed in too, announcing Sunday he would call on the Federal Trade Commission to investigate what he called "one of the most brazen invasions of privacy in recent memory."

OnStar went into apology mode.

"Not a whole lot has changed," said Adam Denison, a spokesman for OnStar, in a conversation with ABC News. "If people call in to cancel their service, we will inform them we will maintain the cellular connection, but they can disconnect at any time."

Might the company sell the data to others, such as insurance companies?

"No, we're not doing it now, nor do we have any plans to do so," said Denison.

What if a government agency were to call, asking for data on a driver's behavior?

"If a state highway department would call," he said, "we could share data anonymously."

So the police can't ask to see if I've ever driven 20 mph over the speed limit? Denison sent a statement from Joanne Finnorn, the firm's vice president for subscriber services:

"We are always very specific about with whom we share customers' personal information, and how they will use it," said Finnorn. "We have never sold any personally identifiable information to any third party."

It concluded, "We apologize for creating any confusion about our Terms and Conditions. We want to make sure we are as clear with our customers as possible, but it's apparent that we have failed to do this."

Despite the company's assurances, this is another thorny case in which people have been monitored by a large company -- in this case, one that can tell where and how fast they drive -- and it may be possible for law enforcement agencies or others to subpoena them to get it.

Want Police Tracking You? How About Marketers?

"Interconnected cars are a good thing, but a society with constant surveillance is not a good thing," said Justin Brookman, director of the consumer privacy project at the Center for Democracy & Technology in Washington.

Brock Meeks, a colleague of Brookman's, pointed out that police can conceivably subpoena OnStar data without asking a judge's permission. They can track someone, he said, without having to show any suspicion of wrongdoing.

Legal cases have gone back and forth on whether that should be allowed. The Supreme Court has agreed to hear a case, United States v. Jones, that could help settle whether police may use GPS to track people without a warrant approved by a judge.

There's another part of this. Brookman said marketers in the future might be very interested in OnStar's data. If you regularly drive past a particular store, would you want the store sending you advertisements? What if those promotions are for lingerie or expensive cars? How would you feel if your spouse saw them?

Franken and Coons said, "We believe that OnStar's actions underscore the urgent need for prompt congressional action to enact privacy laws that protect private, sensitive information like location."

One major factor that protects consumers, though, is consumer anger, said Brookman.

"It's not just consumers who are worried about privacy," he said. "Companies are concerned that people will be freaked out and stop trusting their products."

That apparently includes OnStar.

"You have a right to be confident your information is kept secure and to understand our privacy practices," it said in its email.

After the backlash, OnStar's Brynn Guster tweeted, "You can opt out by calling 1-888-4ONSTAR."