Dive Brief:

• California regulators are examining how automakers and others handle data collected from internet-connected vehicles, the California Privacy Protection Agency said late last month.
• The agency’s enforcement division is investigating whether those companies are following “California law when they collect and use consumers’ data,” CPPA Executive Director Ashkan Soltani said in a statement.
• California is “playing catchup” with European regulators, who have already investigated automakers’ consumer data practices and compelled them to disclose more information, Foley & Lardner Partner Aaron Tantleff said in an email.

Dive Insight:

The “investigation comes as no surprise,” Tantleff said, given the large amount of potentially sensitive data that automakers and other companies collect from internet-connected vehicles.

“Modern vehicles are effectively connected computers on wheels. They’re able to collect a wealth of information via built-in apps, sensors, and cameras, which can monitor people both inside and near the vehicle,” Soltani said.

That data, alone or in combination with third-party data, can reveal an individual’s most personal information, including their location and travel behavior, health status and religion, Tantleff said. “The risks are endless,” going far beyond the highly detailed consumer profiles used for targeted advertising.

But he said automakers’ privacy policies are vague, hard to find and difficult to understand.

“Most people have no real insight as to what’s actually being collected and who that data is being shared with,” Tantleff said. There’s “no easy way for a consumer to limit what data is collected, how it’s used, and who it’s shared with.”

The CPPA is reviewing whether the automotive industry is complying with the California Consumer Privacy Act of 2018, which gives Californians the right to know what personal information businesses collect from them. It also empowers consumers to delete their personal data and block companies from selling or sharing it.

Some jurisdictions, including the European Union, require car manufacturers to notify consumers what data is collected and how it’s used or shared. Some also allow drivers to limit what information they provide, as well as revoke consent or turn off features connected to personal data collection, Tantleff said.