{"id":6233,"date":"2025-04-03T05:41:00","date_gmt":"2025-04-03T10:41:00","guid":{"rendered":"https:\/\/trustarc.com\/?post_type=resource&p=6233"},"modified":"2025-05-29T13:20:25","modified_gmt":"2025-05-29T18:20:25","slug":"drivers-data-significant-privacy-violations","status":"publish","type":"resource","link":"https:\/\/trustarc.com\/resource\/drivers-data-significant-privacy-violations\/","title":{"rendered":"Why Hitting a Goldmine of Driver\u2019s Data May Lead to Significant Violations"},"content":{"rendered":"\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t\tArticles<\/strong>\n\t\t\t\t\t\t\t\t\t\t

Why Hitting a Goldmine of Driver\u2019s Data May Lead to Significant Violations<\/h1>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\n\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\"\"\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\tConnie Lam<\/strong>\n\t\t\t\t\t\t\t\t\t\t\t\tPrivacy Knowledge Researcher<\/span>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/a>\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

As society becomes technologically more advanced, so do our cars. Nowadays, car manufacturers are developing vehicles that connect to the Internet and mobile devices (e.g., cell phones), providing convenience and an intuitive driver experience.<\/p>\n

Cars are becoming \u201csmarter\u201d as they connect with internet-enabled devices and features. We can spontaneously ask the car\u2019s navigation system to find an alternative route to avoid heavy traffic based on its geolocation data or request to make a call to the doctor\u2019s office by allowing the car to access the phone\u2019s contact list.<\/p>\n

The convenience of using personal data on the road can come in handy, but there is a risk that the car may be eavesdropping or spying on our data inside the cabin and passing the data to the car manufacturer and other third parties without our knowledge. This article will dive into recent U.S. enforcement and investigative trends on driver\u2019s data and explore what laws are currently in place or are in the pipeline to protect driver\u2019s data.<\/p>\n

Driver\u2019s data are sold to insurance companies to set rates<\/h2>\n

Driver\u2019s data usually includes precise geolocation and driving behavior data (e.g., hard braking and acceleration), which can be gathered via your mobile phone when connected to the car and if certain app trackers are installed. Such data is desirable to car manufacturers and insurance companies, but irresponsible data practices can land them in hot water.<\/p>\n

The Texas Attorney General (AG) sued Allstate and its subsidiary Arity<\/a> for aggregating and selling access to a massive database of 45 million Americas\u2019 driving behavioral and geolocation data that were obtained via Arity\u2019s software development kit (SDK) embedded in driver\u2019s mobile devices and by purchasing driving behavior data from other car manufacturers without the driver\u2019s knowledge or consent, triggering the enforcement of the first data privacy action<\/strong> under the states\u2019 Data Privacy and Security Act (TDPSA)<\/a>. Access to the database was available to third parties, such as car insurers, who used the data to raise insurance rates.<\/p>\n

Texas is not letting car manufacturers off the hook<\/a>. The AG has sent several notices of inquiry to Ford, Hyundai Motor America, Toyota Motor North America, and Fiat Chrysler Automobiles U.S., demanding information about their data collection and sharing practices involving consumer and driving behavior data. Notably, the AG issued a warning to Kia America after the company allegedly deceived consumers into enrolling in its insurance savings program but failed to inform them that their driver\u2019s behavior data would be shared with third parties to determine insurance rates.<\/p>\n

Another prominent case involved the Federal Trade Commission (FTC) proposing an order against General Motors (GM) and its subsidiary OnStar<\/a> for non-compliance with the FTC Act. GM allegedly used deceptive enrollment practices to persuade consumers to sign up for its OnStar-connected vehicle service and the OnStar Smart Driver feature. However, the company failed to obtain consumer\u2019s consent<\/a> and disclose that their precise geolocation and driving behavior data would be collected and sold to third parties.<\/p>\n

Specifically, consumer reporting agencies used such data to establish consumer credit reports and shared them with insurance companies to set rates. Both parties are prohibited from sharing any geolocation or driver behavior data with third parties for five years, must obtain consent before collecting connected driver\u2019s behavior data, and must establish a mechanism to allow consumers to limit data collection and opt out of the collection of geolocation and driving behavior data.<\/p>\n

Driving behavior data can be sensitive personal data<\/a><\/strong> since it is often associated with precise geolocation data, so it is paramount to comply with state consumer privacy protection laws<\/a> and other applicable laws.<\/p>\n

In-vehicle video footage and vehicle tracking can be driver\u2019s data<\/h2>\n

Last year, California was on top of protecting driver data beyond behavior data and precise geolocation data. Footage of activities within a vehicle may constitute driver data, and this practice must be brought to the driver’s attention.<\/p>\n

Effective January 1, 2024<\/a>, car manufacturers and dealerships in California have an obligation to notify consumers that a vehicle is equipped with one or more in-vehicle cameras in the owner’s manual before selling or leasing a vehicle. They must also provide a separate disclosure form for consumers to sign, acknowledging the cameras. Footage from the cameras cannot be used for advertising purposes or shared with third parties without consent and can only be disclosed for service repairs. Additionally, manufacturers and dealerships must provide consumers with the means to withdraw their consent to recording.<\/p>\n

California is also paying legislative attention to rental car companies. Effective January 1, 2025<\/a>, California removed the sunset date of January 1, 2028, to indefinitely extend current laws that govern rental car companies’ activation of surveillance trackers in rental cars if not returned within a specific period. The new law shortened the time, from 72 to 24 hours, that a rental company must wait after the contracted or extended return date before activating surveillance trackers in the car, establishes conditions when it is permissible to access driving behavior data (in this context, data relating to the renter\u2019s use of the rental vehicle) obtained from the technology, and sets out record retention requirements of 12 months after the activation of the technology.<\/p>\n

More legislation about location data are on the way<\/h2>\n

Some bills broadly govern the use of consumer precise geolocation data, but they could still apply to driver\u2019s behavior data involving location data. Practice due diligence to consider all applicable laws before collecting, processing, and disclosing location data.<\/p>\n