California Driver Privacy Measure Will Lead to Regulatory Issues

The California Assembly recently approved legislation to enhance privacy protections for drivers in the state. Senate Bill 296, proposed by Sen. Bill Dodd (D-Napa), a co-author of the California Consumer Privacy Act, will require drivers to be notified when photographs and video recordings are captured by in-vehicle cameras.

The bill will also prohibit companies from selling such data for advertising purposes. The legislation now heads to Gov. Gavin Newsom (D) for signature.

The proposed restrictions would present substantial regulatory challenges for car manufacturers. If enacted, they could also lead other states to introduce similar legislation on driver privacy and data collection.

The California legislation’s passage comes at a time of heightened concern on the privacy of automobiles. Earlier this month, Mozilla issued an attention-grabbing report, calling the modern car “a privacy nightmare.”

The report focused on several issues, including claims that cars collect too much data, reports that most automobile companies share or sell driver data, and allegations that most car companies give drivers little control over what data is collected and how it’s used.

S.B. 296 aims to solve a particular aspect of driver privacy—namely, privacy risks of photography captured by in-vehicle cameras. Until recently, photo and video capture initiated by automotive vehicles was an outward-facing issue, with in-vehicle technology limited to backup cameras and blind-spot monitoring systems.

However, the latest innovative cameras face inward to identify possible hazards such as impaired or distracted driving. Many individuals view the inside of one’s own automobile as a private space, so there’s concern that capturing recordings of conversations or other activities inside cars can invade privacy.

Consumer advocates have expressed concerns that recordings from inward-facing cameras could be valuable to advertisers and data brokers, as well as to the vehicle manufacturers who can elect to monetize this data.

Impact

To address these concerns, S.B. 296 would require manufacturers of motor vehicles that are equipped with one or more in-vehicle cameras to disclose that fact. It would also prevent any images or video recordings collected through the operation of an in-vehicle camera from being sold or used for any advertising or, subject to limited exceptions, from being shared with third parties.

Specifically, photo and/or video recordings can be shared only if the user consents and when specific requirements are met.

Recordings can be shared to improve or update the vehicle’s safety system if the recordings aren’t used for other purposes, the recipient doesn’t share or transmit the images, the recipient doesn’t retain them for longer than necessary to fulfill the purpose, and the individual receives clear and meaningful notice.

Recordings can also be shared when necessary to diagnose, service, or repair the in-vehicle camera or vehicle equipment that relies on or uses the in-vehicle camera. But again, the operator can’t use or share the images for other purposes or retain them longer than necessary.

In addition, operators may share recordings to comply with a valid verifiable consumer request pursuant to Title 1.81.5 and pursuant to a public records request.

The proposal would prohibit any recording obtained through operation of an in-vehicle camera from being downloaded, retrieved, or otherwise accessed by a person or entity other than the user without the user’s prior consent. The operator of the in-vehicle camera would also be required to provide effective mechanisms for a consumer to revoke any consent that had been provided.

Consequences

Those who violate the measure are subject to a civil penalty not to exceed $2,500 for each vehicle equipped with an in-vehicle camera sold or leased in violation of the requirements of the law.

While many states have passed or proposed comprehensive privacy laws akin to California’s CCPA, S.B. 296 appears unique in its targeting of this niche area of privacy. However, the proposal doesn’t mark the first time that concerns have been raised about the privacy of individuals in their own vehicles.

Most notably, between 2019 and 2022, some employees of Tesla reportedly shared via an internal messaging system videos and images recorded by customers’ car cameras, and in certain cases the recordings were highly invasive. As lawmakers become more aware of privacy violations occurring through in-vehicle cameras, it’s quite possible that we’ll see additional states regulate this issue.

Meanwhile, should S.B. 296 be signed into law, vehicle manufacturers will face a new regulatory challenge. The specificity of the notice requirements of the law and strict limitations on data sharing will bring new obligations to companies that already have developed compliance programs.

Further, in the world of privacy, as goes California, as goes the rest of the nation. Even if other states don’t enact similar laws, we’ll likely see residents of other states benefit from the enhanced privacy protections mandated in California, as it will likely be too challenging to implement the requirements of S.B. 296 solely within one state.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.

Author Information

Jacqueline Klosek is counsel in Goodwin Procter’s business law department and a member of its intellectual property group.

Write for Us: Author Guidelines