California Privacy Protection Agency Announces Investigation Into Connected Vehicles

In one of its first enforcement actions as an independent regulatory authority, the California Privacy Protection Agency (CPPA) has announced a “review” (i.e., enforcement sweep) of the privacy practices of connected vehicle manufacturers and related technologies. 

Recognizing that modern connected vehicles are basically computers on wheels and that such vehicles have the ability to collect a significant amount of personal information through apps, sensors, cameras, and other technology, the CPPA is investigating how connected vehicle manufacturers comply with the California Privacy Rights Act (CPRA) and other privacy-related California laws under its purview. 

The data collection practices of connected cars has its own challenges – while the owner and maybe even a specific driver of the car may have an opportunity to read and review a privacy notice, this may not be realistic for occasional drivers and for passengers – each of which also have some data collected. Some cars even record video of the surrounding area, which may pick up the images of individuals simply walking past the vehicle that may also be considered personal information under the CPRA. It will be interesting to see where the CPPA draws the line on such issues, and if it offers any guidance on how to comply with the CPRA for non-drivers. 

The California Privacy Protection Agency’s (CPPA) Enforcement Division today announced a review of data privacy practices by connected vehicle (CV) manufacturers and related CV technologies. These vehicles are embedded with several features including location sharing, web-based entertainment, smartphone integration, and cameras. Data privacy considerations are critical because these vehicles often automatically gather consumers’ locations, personal preferences, and details about their daily lives.

View referenced article