Navigation-and-emergency-services company OnStar is notifying its six million account holders that it will keep a complete accounting of the speed and location of OnStar-equipped vehicles, even for drivers who discontinue monthly service. OnStar began e-mailing customers Monday about its update to the privacy policy, which grants OnStar the right to sell that GPS-derived data in an anonymized format.
Adam Denison, a spokesman for the General Motors subsidiary, said OnStar does not currently sell customer data, but it reserves that right. He said both the new and old privacy policies allow OnStar to chronicle a vehicle’s every movement and its speed, though it’s not clear where that’s stated in the old policy.
“What’s changed [is that if] you want to cancel your OnStar service, we are going to maintain a two-way connection to your vehicle unless the customer says otherwise,” Denison said in a telephone interview.
The connection will continue, he said, to make it “easier to re-enroll” in the program, which charges plans from $19 to $29 monthly for help with navigation and emergencies.
The privacy changes take effect in December, Denison said, adding that the policy reinforces the company’s right to sell anonymized data.
“We hear from organizations periodically requesting our information,” he said.
He said an example of how the data might be used would be for the Michigan Department of Transportation “to get a feel for traffic usage on a specific section of freeway.” The policy also allows the data to be used for marketing purposes by OnStar and vehicle manufacturers.
Collecting location and speed data via GPS might also create a treasure trove of data that could be used in criminal and civil cases. One could also imagine an eager police chief acquiring the data to issue speeding tickets en masse.
Jonathan Zdziarski, an Ohio forensics scientist, blogged about the new terms Tuesday. In a telephone interview, he said he was canceling his service and making sure he was being disconnected from OnStar’s network.
He said the new privacy policy goes too far.
“They added a bullet point allowing them to collect any data for any purpose,” he said.
