In the American imagination, car keys and a driver’s license have long represented freedom, autonomy and privacy. But modern cars, which have hundreds of sensors, cameras and internet connectivity, are now potential spying machines acting in ways drivers do not completely understand.
That has lawmakers and regulators concerned.
On Tuesday, Senators Ron Wyden of Oregon and Edward J. Markey of Massachusetts sent a letter to Lina Khan, chair of the Federal Trade Commission, urging the agency to investigate automakers for sharing drivers’ location information with the police. The senators, both Democrats, say this sharing can “seriously threaten Americans’ privacy” by revealing their visits to protests, health clinics, places of worship, support groups or other sensitive places.
“As far-right politicians escalate their war on women, I’m especially concerned about cars revealing people who cross state lines to obtain an abortion,” Senator Wyden said in a statement.
Government attention to the car industry is intensifying, experts say, because of the increased technological sophistication of modern cars.
Investigators for the Government Accountability Office recently went car shopping, undercover, to see whether salespeople were overselling autonomous driving abilities. In a March report, the agency concluded that consumers don’t fully understand crash avoidance technologies and driver support systems, the improper use of which “can compromise their safety benefits and even pose a risk on the road.”
The Federal Communications Commission and California lawmakers want to prevent mobile car apps from being used for stalking and harassment. The F.C.C. has proposed regulating automakers under the Safe Connections Act — aimed, originally, at phone carriers — while California is likely to pass a law that would accomplish the same thing, requiring car companies to cut off abusers’ remote access to victims’ cars.
“No survivor of domestic violence and abuse should have to choose between giving up their car and allowing themselves to be stalked and harmed by those who can access its connectivity and data,” Jessica Rosenworcel, who leads the F.C.C., said in a statement.
Privacy regulators have opened investigations. California’s privacy regulator has been looking into data use from connected cars for nearly a year, while the F.T.C. already appears to be acting on a letter Senator Markey sent in February, urging the agency to investigate automakers’ privacy practices.
Last month, the F.T.C. solicited reports from drivers who objected to how data from their cars had been used. An investigator from the agency reached out to a man named in a New York Times article whose insurance premium increased after General Motors provided data about his driving behavior to the insurance industry. (“Since FTC investigations are nonpublic, we generally don’t comment on whether we are investigating a particular matter,” said a spokesperson for the agency.)
“To my mind, there has been far too little oversight into automakers’ privacy policies, so the more watchdogs, the better,” Senator Wyden said.
The most recent letter to the F.T.C. reveals the findings of a yearlong query of 14 automakers that Senator Wyden’s office said had jointly received more than 1,400 police requests for location information over the past two years.
Only five of the automakers — G.M., Honda, Ford, Tesla and Stellantis — required the police to get a warrant before turning over a car’s current or historical whereabouts, with Ford recently enacting that requirement. Tesla is the only automaker that tells customers about such requests, according to the letter.
“In contrast, Toyota, Nissan, Subaru, Volkswagen, BMW, Mazda, Mercedes-Benz and Kia all confirmed that they will disclose location data to U.S. government agencies in response to subpoenas, which do not require a judge’s approval,” the senators wrote to Ms. Khan. They said this violated a commitment the automakers made in a set of privacy principles they submitted to the F.T.C. a decade ago about how they would protect drivers’ sensitive data.
“This is a complex issue; automakers are committed to protecting sensitive vehicle location information,” said Brian Weiss, a spokesman for the Alliance for Automotive Innovation, a trade association. “Vehicle location information is only provided to law enforcement under specific and limited circumstances, such as when the automaker is provided a warrant or court order or in situations where there is an imminent threat of serious bodily harm or death to an individual.”
Automakers generally retain a car’s location information for years — as long as 15 years in the case of Hyundai. Of the 45 location data requests that Hyundai received in the past two years from the police, slightly more than half involved stolen vehicles, the company’s spokesman, Ira Gabriel, said.
“There’s a renewed focus on cars, and the data practices associated with them,” said Andrew Crawford, policy counsel at the Center for Democracy and Technology. He attributed this to increased consumer awareness about the components in modern cars and the fact that car data “may be going to folks that they did not contemplate, did not know about and did not want.”
At the same time, however, some regulators are pushing automakers to put more technology into cars to improve safety on the roads, which may require even more data collection.
The National Transportation Safety Board has recommended in-car systems in all new vehicles that would tell drivers to slow down when they exceed the speed limit. The National Highway Traffic Safety Administration has taken steps to require impairment-detection systems in all new vehicles that would prevent a car from operating when the driver had been drinking or using drugs.
When it comes to car safety, the conversation has changed from improving seatbelts to installing more cameras and sensors, said Adonne Washington, a lawyer at the Future of Privacy Forum who wrote a recent report on the privacy implications of proposed safety systems.
For instance, “a mandate for alcohol detection technology in vehicles creates a whole different category of information,” she said.
W. James Denvil, a partner at Hogan Lovells who has represented automakers, said the increased scrutiny from regulators was expected.
Vehicles offer “extraordinary benefits,” he said. New technologies can enhance safety and the driving experience, while data from cars can be used to improve transportation infrastructure.
“We’ve got innovative technologies and old regulations,” Mr. Denvil said. “There’s going to be some surprises and some bumps in the road.”
