• Texas is suing GM for tracking drivers’ data – but these other car companies do the same thing (Fast Company, August 20, 2024)

  The battle for data privacy is extending into vehicles, as highlighted by a lawsuit from Texas Attorney General Ken Paxton against General Motors for allegedly selling driver data without consent. GM reportedly gathered data from 1.8 million Texan drivers since 2015 via services like OnStar Smart Driver, which it recently discontinued. However, this data was allegedly sold to third parties, influencing insurance rates negatively. GM states it is reviewing the complaint and aims to protect consumer privacy. Mozilla and a New York Times investigation have criticized the auto industry’s widespread data-sharing practices, with 84% of surveyed brands engaging in such activities. Similar concerns prompted senators Ron Wyden and Ed Markey to investigate auto data practices, finding companies like Honda and Hyundai shared driver data for minimal compensation. This growing scrutiny suggests a shift in consumer treatment, as carmakers increasingly monetize collected data, raising ethical concerns over privacy violations.

• Former Tesla Supercharging head to help Uber with EV transition (Teslarati, August 20, 2024)

  Former Tesla Senior Director of the Supercharger program, Rebecca Tinucci, has joined the Uber team as Uber’s Global Head of Sustainability in an effort to help the company in its shift to electric vehicles. “After many conversations with great people about my next steps, I was still struggling on where to land and how to be truly impactful,” stated Tinucci on LinkedIn.

  Tinucci was let go from Tesla, along with a large part of the Supercharger team, as a part of the Tesla layoffs this spring. Last year Tinucci pushed for the auto industry’s mass adoption of Tesla’s North American Charging Standard (NACS), and she oversaw the development of the V4 Supercharging software. Despite the inclusion on the Time Magazine 100 Climate List last year, Tinucci was not re-hired by Tesla. Instead, she is now focusing on helping Uber “advance clean energy efforts” with the development of its EVs and robotaxis.

• Sen. Dave Cortese looks to reintroduce legislation allowing cities to regulate robotaxis (Mountain View Voice, August 16, 2024)

  Waymo recently expanded its service ride area in the bay area to include Daly City, Broadmoor, and Colma.  As local governments do not have any say in how or where robotaxis operate, this expansion is causing concern among some city officials.

  California Senator Dave Cortese from San Jose is trying to pass legislation to allow larger cities and counties to limit the number of robotaxis on the road, set maximum fare amounts, and introduce fines for moving violations and traffic obstructions.  The bill, SB 915 received strong opposition from the autonomous vehicle industry as well as local chamber of commerce organizations.  Cortese pulled the bill from consideration after it has passed in the Senate due to proposed amendments that would take away the original intent of the bill, stripping all parts about local regulations.  He plans to reintroduce similar legislation in 2025.

• Zeekr tackles EV range anxiety with 10-minute battery charge (Automotive News Europe, August 14, 2024)

  Chinese carmaker Zeekr may have just solved range anxiety with its new lithium iron phosphate vehicle battery that is able to charge from 10% to 80% in under 11 minutes. Range anxiety, the fear that your vehicle’s battery will be depleted before reaching a charging station or your destination, has been a major concern for consumers who have been skeptical about the adoption of electric vehicles, which has resulted in the rise in popularity of hybrid vehicles. Zeekr’s new batteries will be available in the Zeekr 007 sedan, which will begin delivery in China as early as next week. 

  Zeekr, an EV-only carmaker, is a part of Geely Auto, the automobile manufacturer that also owns Volvo, Polestar, and Lotus. Zeekr currently has plans to begin sales of its vehicles in Europe, Latin America and other Asian markets in the near future.

• You’ve heard of carjacking – but what about carhacking? (Yahoo! Tech, August 10, 2024)

  In today’s digital age, smart devices permeate everyday life, including vehicles, which are now facing unique cybersecurity threats. Hackers exploit car systems using various techniques, often aided by AI. For example, AI can manipulate autonomous vehicle systems, as demonstrated by a hack that misread a speed limit, causing a Tesla Model S to dangerously accelerate.

  Connected vehicles present hackers with new avenues of attack, especially through Vehicle to Grid (V2G) communication, where man-in-the-middle attacks can intercept communications. EV charging stations also pose risks, potentially distributing malware for unintended purposes like bitcoin mining. Moreover, hackers can steal login information, bypassing two-factor authentication. Bluetooth systems are another vulnerability, enabling attacks like BLE relay to intercept vehicle communications. Despite these threats, car manufacturers invest in enhanced security measures, working with government and agencies to fortify cybersecurity, ensuring safer connected cars.

• DOD Needs Solutions for the Proliferation of Autonomous Vehicles, Defense Official Says (U.S. Department of Defense, August 9, 2024)

  On August 9th, Heidi Shyu, the undersecretary of defense for research and engineering, was a panelist at the National Defense Industrial Association’s 2024 Emerging Technologies for Defense Conference and Exhibition in Washington, D.C.  At the conference, she spoke about the Defense Departments need to combat the growing number of autonomous systems, including aircraft, ground vehicles, and watercraft.  There are rules and limitations in the U.S. for how the military can engage with these systems if they should become a threat. “Shyu said while there are solutions being worked now, the Defense Department is interested in having industry proffer even more options for it and the military services to consider”.  The Defense Department is looking for ideas in contested logistics, where adversaries attempt to disrupt, destroy, or defeat friendly force logistics operations. 

The Rhode Island Data Transparency and Privacy Protection Act (“the Act” or “the Rhode Island Data Privacy Act”) was signed into law on June 28, 2024, and has become the nineteenth state to enact comprehensive consumer data privacy legislation, while many other bills introduced in states such as Maine and Louisiana have gone inactive in recent months. Like other state laws, the Rhode Island Data Privacy Act does not directly address VPD, but it is implied.

• Tesla in Seattle-area crash that killed motorcyclist was using self-driving system, authorities say (AP, July 30, 2024)

  Investigators in Washington state have determined that an April crash in which a Tesla Model S hit and killed a motorcyclist about 15 miles north of Seattle was engaged in Tesla’s Full Self-Driving system at the time of the incident, according to EDR data from the vehicle. The Tesla driver told a state trooper that he was looking at his phone while Autopilot was engaged, and “the next thing he knew there was a bang and the vehicle lurched forward as it accelerated and collided with the motorcycle in front of him.”

  The death of the motorcyclist, Jeffrey Nilsen, is the second fatality in the United States involving Full Self-Driving according to investigation documents from NHTSA. The investigation is ongoing, and it currently is unclear if FSD is at fault in the fatality.

  Tesla has not commented on this recent development in the investigation, but this news comes only a week after Elon Musk stated that he expects FSD to run without human supervision by the end of 2024.

• Volkswagen And Rivian Are Teaming Up On Software In $5 Billion Deal (Inside EVs, July 29, 2024)

  On Tuesday, automakers Rivian and Volkswagen announced they are partnering to create software for their future electric vehicles.  Volkswagen has a long history of producing cars and making a profit, however they have struggled with their software.  Rivian is widely regarded for its software and user experience but lacks funding.  The money VW plans to invest does come with some strings attached.  Rivian will need to meet certain financial and technological milestones.  Volkswagen will invest an initial $1 billion with plans to invest another $4 billion in the future.  

  Rivian CEO R.J. Scaringe said during a conference call on Tuesday. “Each company will continue to separately operate their respective vehicle businesses.”

• Automakers Sold Driver Data To Insurance Companies For Next To Nothing (Jalopnik, July 26, 2024)

  Two U.S. Senators, Ron Wyden and Edward J. Markey, are urging the Federal Trade Commission (FTC) to investigate how automakers are collecting and selling driver data to insurance companies at low prices. This follows a report by The New York Times indicating General Motors, Hyundai, and Honda are involved in selling data such as acceleration patterns, braking habits, and speeding frequencies to insurance companies to assess driver risk. Highlights from the investigation revealed automakers made minimal profits from these sales, with Honda receiving 26 cents per car from Verisk, and Hyundai earning 61 cents per car. GM declined to specify exact figures, but sources confirm low millions of dollars for data on eight million cars. The senators criticize the vague and often deceptive ways drivers are informed about data collection, with some automakers still sharing location data without clear consent. This marks the third congressional appeal to the FTC to scrutinize such data practices.

After Minnesota Governor Tim Walz signed the Minnesota Consumer Data Privacy Act (“MCDPA”) on May 24, 2024, Minnesota became the eighteenth state to enact comprehensive consumer data privacy legislation. The MCDPA will go into effect on July 31, 2025. While the conditions of the Act most similarly reflect the Connecticut and Virginia consumer data privacy law models, the MCDPA also applies to technology providers under Minnesota’s education data laws, such as entities that provide technology to schools. As with other state privacy laws, the MCDPA does not directly address VPD, but it is implicated.

As recently reported by the New York Times and other media outlets, Kenn Dahl, a 65-year-old owner of a software company near Seattle, saw his car insurance premiums skyrocket by 21 percent in 2022. When he questioned his insurance agent about the sudden increase, he was told that his “LexisNexis report” may have played a significant role in this hike.

LexisNexis, a global data broker headquartered in New York, has a division named “Risk Solutions” that caters specifically to the auto insurance industry. Traditionally, it has tracked car accidents and traffic tickets. However, upon Dahl’s request, LexisNexis sent him a consumer disclosure report, as mandated by the Fair Credit Reporting Act. What Dahl found inside was over 130 pages documenting the specifics of every trip he or his wife made in their vehicle over the previous six months. This data included 640 trips with details of dates, start and end times, distances driven, and incidents of speeding, hard braking, or sharp accelerations.

The report revealed that General Motors (GM), the manufacturer of his Chevy Bolt, provided these trip details. LexisNexis had analyzed this driving data to create a risk score, which it intentionally marketed to insurers for the purpose of providing more personalized insurance coverage. According to industry watchdogs, the case of Kenn Dahl underscores the need for transparency and consumer understanding regarding data collection and its impact on insurance rates.

GM is not alone in sharing driving behavior data. Numerous automakers contribute to LexisNexis’s “Telematics Exchange,” which pools consumer-approved connected car data for subsequent sale. Despite some companies asserting they share only limited data, the interconnectedness of modern vehicles means that more comprehensive data sharing is feasible.

The New Face of Insurance Monitoring

In recent years, insurance companies have introduced incentives for drivers to install monitoring devices in their cars or download smartphone apps to track driving behavior—such as driving distance, cornering speed, braking intensity, and adherence to speed limits. However, a patent application by Ford Motor revealed that drivers are often hesitant to join these programs. Accordingly, it appears that car manufacturers have stepped in to fill this void collecting data directly from internet-connected vehicles, frequently without the driver’s explicit consent or even knowledge.

Among the various automakers, Kia, Mitsubishi, and Hyundai have “Driving Score,” Honda and Acura have “Driver Feedback,” and GM has “OnStar Smart Driver,” all of which, until recently, collected and shared data to third parties. While some drivers may choose to activate these features, others might unknowingly agree to data sharing through complex privacy policies and fine print that are seldom fully read or understood. Omri Ben-Shahar, a law professor at the University of Chicago, supports usage-based insurance for its potential to improve driving safety. However, he criticized the “stealth enrollment” in data collection programs, stressing that drivers were unfairly surprised by the scope of subsequent data collection.

Many drivers, especially those with GM vehicles equipped with OnStar Smart Driver, often unknowingly enroll in data sharing services at the dealership, where salespeople can receive bonuses for enrolling customers in the services.

Automakers argue that the main purpose of these driver feedback programs is to promote safer driving habits. However, Mozilla researcher Jen Caltrider reviewed privacy policies for over 25 car brands last year and labeled cars as “a privacy nightmare.” She highlighted that drivers have little understanding of what they consent to regarding data collection, as privacy policies are often filled with incomprehensible legalese.

Addressing Privacy Concerns

In December, the Alliance for Automotive Innovation issued a statement emphasizing that cars are not spying on drivers but are instead focused on safety. Yet, the statement did not tackle the sale of data. It suggested that manufacturers are complying with privacy principles enforceable by the Federal Trade Commission (FTC) and called for a unified federal standard to address privacy concerns.

As automakers continue to build connected cars, concerns about data privacy and the ethical use of driving data will persist. Ensuring that consumers are fully aware of and consent to data collection and sharing practices is crucial in navigating the increasingly data-driven landscape of modern automobiles. Some automakers are trying to get ahead of this potential public relations headwind. In fact, GM recently discontinued its data collection service in response to multiple class action lawsuits and vociferous criticism from privacy advocates.

A GM spokeswoman, Malorie Lucich, reiterated that the OnStar Smart Driver service is optional and offered benefits such as insights into safe driving behavior and vehicle performance, which drivers could use to obtain insurance quotes. Customers could unenroll from the service at any time. However, the reality is far from straightforward. For example, Frank Pasquale, a law professor at Cornell University, was taken aback when he realized there was no prominent disclosure about third-party access to his driving data during the enrollment process for Smart Driver. “Because it’s not within the reasonable expectation of the average consumer, it should certainly be an industry practice to prominently disclose that is happening,” he noted.

The Role of Policymakers

This issue has also caught the attention of policymakers. California’s privacy regulator is currently investigating automakers’ data collection practices. Additionally, Senator Edward Markey of Massachusetts has urged the FTC to investigate potential violations of federal laws prohibiting unfair and deceptive business practices. “The ‘internet of things’ is really intruding into the lives of all Americans,” he remarked, citing the potential downside of providing vehicle data to third parties without explicit driver consent.

The Future of Vehicle Data Collection

The integration of connectivity and data collection in modern vehicles offers both opportunities and challenges, particularly in the realm of auto insurance. While existing data collecting and sharing technologies aim to promote safer driving habits, they also introduce legitimate privacy concerns. Policymakers and regulators must balance innovation with consumer rights, ensuring that data privacy standards keep pace with technological advancements. Ultimately, fostering trust through clear disclosures and fair practices will be essential as the automotive and insurance industries continue to navigate the digital age.

Copyright Nelson Law LLC

The opinions expressed in this blog are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This blog post is for general information purposes and is not intended to be and should not be taken as legal advice.

Maryland and Nebraska have joined the ranks after signing their own respective comprehensive data privacy laws. Both the Maryland Online Data Privacy Act, effective October 1, 2025, and the Nebraska Data Privacy Act, effective January 1, 2024, resemble the other state data privacy laws. Like other states, these laws do not address vehicle performance data specifically, but it is implicated.

With the signing of the Kentucky Consumer Data Privacy Act (“the Kentucky CDPA”) on April 4, 2024 by Governor Andy Beshear, the state has become the fifteenth state in the US to enact comprehensive data privacy legislation on the state level, going into effective on January 1, 2026.  Like other states, the Kentucky CDPA does not address vehicle performance data (“VPD”) specifically, but it is implicated.

• Bipartisan data security breakthrough (The Hill, April 9, 2024)

  On Sunday evening, the House and Senate Commerce committee chairs revealed a draft of the long-awaited bipartisan data privacy bill after years of failed efforts to pass a comprehensive privacy bill on the federal level. This draft bill requires companies to disclose how they use consumer data and provide more rights to consumers over how the data is used. Currently, 15 states have signed comprehensive data privacy laws. This federal draft bill aims to preempt state law, which Republicans have been endorsing, while Democrats have been pushing for the right for consumers to seek financial damages. 

  “A federal data privacy law must do two things: it must make privacy a consumer right, and it must give consumers the ability to enforce that right,” Senate Commerce Committee Chair Maria Cantwell (D-Wash.) said in a statement. “This bipartisan agreement is the protections Americans deserve in the Information Age.”

  House Energy and Commerce Chair Cathy McMorris Rodgers (R-Wash.) stated that the bill is “the best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information.” 

• Tesla settles with Apple engineer’s family who said Autopilot caused his fatal crash (CNN Business, April 8, 2024)

  Facing a potentially large monetary judgment and significant reputational damage as it continues to promote FSD, Tesla opted to settle a high-profile case that was expected to focus on Tesla’s controversial driver-assistance technology during a wrongful death trial which was set to commence this week.  The lawsuit arose from a 2018 car crash that killed an Apple engineer after his Model X, operating on Autopilot, swerved off a highway near San Francisco.

  Although the terms of the settlement were not disclosed, Tesla’s willingness to resolve such a highly publicized case involving Autopilot marks a stark departure from its prior steadfast decision to fully litigate other similar claims across the country. “It is striking to me that Tesla decided to go this far publicly and then settle,” Bryant Walker Smith, a law professor at the University of South Carolina with expertise in autonomous vehicle law told Reuters. “What this does do, though, is it says to other attorneys, we might settle. We might not always fight it. That is the signal.”

• Gov. Andy Beshear Vetoes Self-Driving Vehicles Bill (Governing, April 8, 2024)

  Kentucky Governor, Andy Beshear, vetoed House Bill 7 last Friday, making it the second time he has vetoed an autonomous vehicle bill.  Last year he vetoed a similar bill, House Bill 135, that aimed to establish a regulatory framework for the operation of fully autonomous vehicles on public highways.

  House Bill 7 included safety precautions such as a trial period for semi-truck and other vehicles weighing more than 62,000 pounds, a human driver on board for two years after the effective date of the bill, the same legal requirements as traditional vehicles, and a safety plan submitted to the Kentucky Transportation Cabinet and the Kentucky State Police.

  Since the legislature passed the bill right before going into the veto-break period, they still have time to override the veto.  Veto overrides require a majority vote from both chambers of the state legislature. We will have to wait and see what the outcome will be as the bill overwhelmingly passed the House and narrowly passed the Senate.

• Elon Musk requires ‘FSD’ demo for every prospective Tesla buyer in North America (CNBC, March 25, 2024)

  Elon Musk, CEO of Tesla, recently sent an email to employees mandating that customers be shown how to use the Full Self-Driving (FSD) system before completing vehicle deliveries in North America. “Going forward, it is mandatory in North America to install and activate FSD V12.3.1 and take customers on a short test ride before handing over the car,” Musk wrote in an email to staffers on Monday. “Almost no one actually realizes how well (supervised) FSD actually works. I know this will slow down the delivery process, but it is nonetheless a hard requirement.” Musk also announced a one-month trial of FSD for US Tesla cars. These decisions appear squarely aimed at countering criticism from regulators and consumers that Tesla has engaged in false advertising regarding the capabilities and limitations of FSD. 

• GM, Ford will reroute Baltimore shipments after bridge collapse (Reuters, March 26, 2024)

  After the collapse of the Francis Scott Key Bridge in Baltimore on Tuesday morning, the Port of Baltimore has been closed, forcing companies like GM and Ford to reroute their vehicle shipments. The Port of Baltimore is the “busiest” automobile port in the United States, handling over 750,000 vehicles last year, according to the Maryland Port Administration.

  While General Motors stated, “We expect the situation to have minimal impact on our operations. We are working to re-route any vehicle shipments to other ports,” Ford’s Chief Financial Officer John Lawler believes the bridge collapse will have a much bigger influence, stating, “It’s going to have an impact…We’ll have to divert paths to other ports…It will probably length the supply chain a bit.”

  “[T]here will certainly be a disruption,” stated CEO of the Alliance for Automotive Innovation John Bozzella. “Baltimore is the No. 1 automobile port in the U.S., and we’re in touch with federal officials to help them understand the scale of automotive operations there.”

• New cars are now ‘the worst’ products when it comes to protecting consumer data (CNBC, March 23, 2024)

  Cars today are constantly capturing data and many consumers don’t know how their data is being used, or that it’s being used at all.  According to Counterpoint Technology Market Research, by 2030, 95% of cars sold are likely to have embedded technology which opens the door for companies to collect, share or sell data related to driver habits, and other personal information that people may not want shared.  While most car manufacturers allow customers to opt out of data sharing, it can be difficult to find out how to do so as these settings are buried within menus, and doing so often requires disabling useful or desirable features such as navigation, remote unlock and the ability to receive service-related updates.  So how do you protect your data?  Check with the manufacturer to see what your options are for opting out and be sure to periodically review your privacy settings.