General Motors got in some hot water this week when a New York Times’ article reported “Automakers Are Sharing Consumers’ Driving Behavior With Insurance Companies.” Interviewees told disturbing stories about their insurance going up because of how they were driving their GM vehicles. And GM responded by pledging to stop this side hustle. But if you dig a little deeper, you find that’s far from the last way it is double dipping by selling everything it can find out about you to the highest bidder.

GM claims that this is all above board. If you have the GM app on your phone you can sign up for a sort of better driver program that sends you alerts if you are being unsafe. In the fine print it says it can turn around and sell your driving data to insurance companies. One Corvette owner complained that his rates went sky high after he took his sports car to a race track. A Cadillac owner insists he never signed up for the program, but found his driving data online and his insurance premiums doubled.

GM has declined to comment on lawsuits by drivers. But it did send a statement to the Detroit Free Press.

“As of March 20th, OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk. Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies.”

Kevin Kelly, GM spokesman

New York Times writer Kashmir Hill warned, “I think this story could be the tip of the iceberg.” When Mozilla poured through the privacy agreements of 25 different car companies, General Motors ranked horribly. Only three automakers rank worse than Chevrolet, Buick, GMC, and Cadillac for data privacy. All of these GM companies got dings for how they use your data, how they control data they’ve collected, their track record of divulging data, and the lackluster security they use to protect your personal data. Unlike other car brands, GM does not have an option for you to delete all the data it’s collected on you.

Mozilla does similar studies of products such as cellphones and computers. It was aghast at just how poorly every automaker performs on the privacy front. None of the car companies it studied met the watch group’s minimum security standards.

This is especially disturbing because modern cars could be collecting your driving data, video of you, audio of you, and preferences such as radio presets. Through apps and the car buying process, automakers could collect a ton more information on you, including data from your cellphone or personal financial information. And all the privacy policies make it clear that automakers reserve the right to sell this information to whoever they want.

So yes, GM has promised to stop selling driving data to specific brokers who we’ve discovered will sell that data to insurance companies. But there could be a ton more going on beneath the surface.

Next, learn whether the government tracks everywhere you drive, or see Kevin Kelly discuss her NYT article in the video below: