Connected Cars Spark First Probe By California Privacy Agency

The California Privacy Protection Agency announced Monday it’s investigating the privacy practices of vehicle manufacturers, the agency’s first probe since it gained enforcement powers on July 1.

Agency staff is specifically looking into the technologies that are connected to vehicles, which would include cars that are connected to a wireless network and those that feature capabilities such as GPS navigation or smartphone integration. Such vehicles can automatically collect location data or other personal data from drivers.

“Modern vehicles are effectively connected computers on wheels. They’re able to collect a wealth of information via built-in apps, sensors, and cameras, which can monitor people both inside and near the vehicle,” said Ashkan Soltani, the agency’s executive director, in a statement.

California has more than 35 million registered vehicles, according to the agency. A request for comment from the Alliance for Automotive Innovation Inc.—the trade group for vehicle manufacturers such as Toyota Motor Corp. and Ford Motor Co.—was not immediately returned, though its website says its members commit to the association’s privacy principles.

Policymakers have previously raised concerns over privacy issues for vehicles. The most recent example concerned allegations that workers for Tesla had shared images and videos recorded by customers’ cars. The electric vehicle manufacturer was hit with a lawsuit earlier this year over such alleged violations. There also have been similar lawsuits against Ford and Otonomo—a data broker that has partnered with car manufacturers—over allegations of improperly collecting or sharing personal information.

California lawmakers have taken notice. State Sen. Bill Dodd has sponsored a bill (S.B. 296) that would place restrictions on the collection and use of images and videos gathered by in-vehicle cameras. The Dodd legislation has no formal opposition and is in front of members of the California Assembly Appropriations Committee.

The agency’s announcement comes as the first-in-the-nation privacy entity continues to hire and ramp up its enforcement arm. The scope of its enforcement was limited by a recent court ruling to not include recent regulations promulgated by the agency until next year.

However, the privacy agency’s enforcement chief had said in a July 14 meeting that it won’t be waiting idly by for the buildup to be complete.

“We’re not waiting to begin enforcement. The enforcement division will be using our existing resources to build a foundation for bringing these cases,” said Michael Macko, the agency’s deputy director of enforcement, at the meeting.