We extend a special thanks to our external reviewers: Andrea Amico, Founder & CEO, Privacy4Cars and Jerome Greco, Digital Forensics Supervising Attorney, The Legal Aid Society.

This report was supported in part by a grant from the Open Society Foundations and by the John D. and Catherine T. MacArthur Foundation.

EXECUTIVE SUMMARY

• New cars are surveillance on wheels, sending sensitive passenger data to carmakers and police. Cars also store enormous amounts of passenger data onboard, where police can extract it using specialized tools. We estimate that law enforcement agencies could have accessed car data hundreds of thousands of times in 2020.

• Constitutional loopholes allow access to most data on cars without a warrant. Police can access information from car-connected phones and online accounts without the warrant typically required.

• U.S. immigration agencies weaponize car data. Other law enforcement agencies are poised to follow suit if they are not already doing so.

• New legislation, enforcement of existing data protection laws, and responsible car design and data storage policies can shift car data surveillance into reverse.

I.              INTRODUCTION

The cars we drive say a lot about us, but they see even more. Modern cars collect a huge amount of data, stored indefinitely onboard and in the cloud.[1] The data tracks not just the car, but its occupants: it records our location history, phone contents (contacts, emails, texts, tweets, social media feeds), voice recordings, weight, and other biometric data.[2] If this sounds creepily expansive, it is. Car data often is collected for the benefit of manufacturers, not drivers. Our information fuels a billion-dollar industry for subscription services as well as selling drivers’ data to third parties, including law enforcement.[3] Many cars on the road feed this industry: 84 million connected cars beamed data to manufacturers and other companies in the U.S. in 2021.[4] Drivers can refuse some data collection, but saying “no” often comes at the cost of passenger safety: no data, no emergency roadside service or built-in navigation tools.[5]

For law enforcement, cars provide a rich and easily accessed source of surveillance data. Disturbingly, while cars collect much more detailed data than our cellphones, they receive fewer legal and technological protections, making them vulnerable to suspicionless searches. For instance, while the leading phone operating systems offer relatively robust cybersecurity features, most cars do not.[6] The overbroad automobile exception to the Fourth Amendment may allow law enforcement to search a car without a warrant.[7] A parallel Fourth Amendment exception for third-party data suggests that once cars beam information to an automaker or insurer, drivers lose what few privacy protections they had.[8] Federal statutes provide few additional protections,[9] and just a few states have enacted middling measures to protect car data. As a result, law enforcement agencies can co-opt car data to explore the most vulnerable details of our lives, exposing protestors, people seeking reproductive healthcare or a safe home to police harassment or prosecution.

II.            THREE KEY DATA COLLECTORS ON CARS

Modern cars generate data from innumerable sensors and onboard computers and pass that data to three key locations on a vehicle: the event data recorder, or “black box”; the telematics module, which is comparable to a modem with an associated hard drive; and the infotainment system, another hard drive where users’ smartphone data is stored.

A.    Black boxes

Event Data Recorders or “black boxes” are electronic devices that continuously monitor a vehicle so investigators can retrieve key information after an accident.[10] In 2012, 96% of all cars had a black box, and in 2015 Congress mandated them in all new automobiles.[11] Black boxes record data points from the moments before, during, and after an accident, including the state of the car pre- and post-crash, some of the driver’s actions, the severity of the crash, whether seatbelts were used and whether airbags deployed.[12] Unlike the black boxes in airplanes, automotive black boxes do not record audio.[13] Data is stored locally on the box.[14]

Black boxes exist to collect a snapshot of information that reconstructs accidents, and as such, they have a limited storage capacity. A box stores no more than thirty seconds of data at a time and continuously overwrites its storage until an “event” occurs,[15] such as rapid deceleration.[16] From that point on, the box stops overwriting its memory and stores the final set of data points for recovery.[17]

Though black boxes collect vastly less information than telematics or infotainment systems, they have been around for much longer, and over time, they have received stronger protections than other sources of car data.

B.    Telematics modules

Telematics modules are onboard modems that can transmit data collected by the vehicle to automakers, insurers, and telematics companies using a cellular or satellite connection.[18] A telematics system aggregates information from various sensors and systems built into vehicle. Together, these sensors describe the car’s condition (vehicle faults, diagnostics, fuel consumption, and so on) and the driver, including their location data, data about driving habits (e.g., speed, nighttime driving), and biometric data, which depending on the system could include face measurements and images, voice recordings, and weight.[19] Telematics systems may also collect data from car-connected smartphones.[20]

There are two types of telematic systems—built-in modules and aftermarket additions—both with widespread adoption.[21] Original equipment manufacturer (OEM) telematics are increasingly included in vehicles by default. Some estimate that 50% to 60% of new cars sold globally in the past two years include this module, while others believe the number is up 80% to 90% for vehicles sold in the United States.[22] Over 80% of new cars globally will have OEM telematics by 2030.[23] Every major carmaker installs its own telematics module on new cars: GM OnStar, Toyota Connected Services, Nissan Connect, Ford SYNC, Mercedes “Mercedes me connect,” and more. Vehicle owners, insurance companies, and fleet managers frequently install additional aftermarket telematics systems on vehicles to track their whereabouts and driver habits.

Deleting telematics data from cars is difficult to impossible for drivers. Vehicle sensor and telematic module data is accessible only to drivers who can and find it advisable to hack their cars. Moreover, telematics data is transmitted off cars to carmakers, insurers, and other companies in real-time or near real-time.[24] Most drivers have little control over what data is shared or how long it is stored. Of the top telematics companies, including Cambridge Mobile Telematics, Geotab, and GoFleet, most assert they can store data indefinitely and share it with whomever they wish.[25] Some insurers store telematic data for up to ten years.[26] By way of contrast, even Google, a favored source of law enforcement data, stores location data for 18 months.[27]

Drivers can avoid some data collection by refusing to use telematics services, but telematics providers force a choice.[28] Drivers can allow data collection and access telematics-enabled safety features, such as built-in navigation aids, insurance discounts, emergency services, and hands-free services, or they can refuse both.[29] Only a fraction of the collected data is needed to provide these services: giving emergency roadside help, for example, requires knowing where a driver is now, not where they have been in the past or what their favorite destinations are.

C.    Infotainment systems

Infotainment systems yield the most sensitive locally stored car data. Telematics and infotainment systems frequently share the same user interface screen and share some functions, such as navigation.[30] But as the name suggests, infotainment systems add entertainment to cars, playing music and videos, allowing calls and texts (not just emergency communications), and allowing drivers and passengers to access their smartphones’ functions through their cars.[31] Consumer Reports and IHS Markit report that 98% of new vehicles include at least one infotainment interface.[32]

From a surveillance perspective, infotainment systems are anything but fun, turning constitutionally protected phone data into vehicle data that may be searchable without a warrant. A car’s infotainment system stores highly personal data from smartphones and other mobile devices that connect to the system with USB cables or Bluetooth.[33] If you use your infotainment system to text, make a call, send email, check social media or browse the web, the system stores the content and data associated with those actions on the car.[34] Anyone who uses an infotainment system to access the car’s built-in apps, such as navigation services, shares their location history, voice commands, and any passwords they use with the car.[35] The resulting data is stored on the car’s infotainment system and shared with vehicle manufacturers, rental companies, infotainment providers, and app companies in accordance with their business policies.[36]

Like telematics systems, infotainment systems come in two varieties: OEM systems installed by carmakers on the assembly line, and add-ons that integrate smartphones into a car’s infotainment system. There are three notable smartphone integration firms: MirrorLink, Apple CarPlay, and Android Auto. The oldest system, MirrorLink, was developed by Nokia and provides software that carmakers can modify to connect smartphones to their cars.[37] Starting in 2014 and 2015, Apple CarPlay for iOS devices and Google’s Android Auto for Android devices introduced proprietary systems that link smartphones to cars. In 2020, 76% of new cars were compatible with Apple CarPlay and 69% with Android Auto.[38] From a surveillance perspective, these big tech middlemen add another layer of data sharing to the infotainment enterprise, making the information even more accessible to law enforcement.

As is the case with telematics data, drivers can attempt to delete sensitive data from an infotainment system. However, most systems do not delete car data fully: deep in system memory, infotainment systems continue to store sensitive personal and identifying information.[39] Even resetting an infotainment system to its factory default settings may not delete anything until new data overwrites the system’s previous contents.[40]

D. Other data sources (e.g., biometric monitors, cameras, autonomous driving systems)

Cars are full of processors that generate data—and pass it to the systems already mentioned. Some cars contain computers that operate cameras, enable autonomous driving, or perform biometric monitoring, generating corresponding data.[41] On-car data retention for these processors varies depending on the car’s make and model and the computer’s function. All of this data, insofar as it is needed (or wanted) by carmakers or insurers, passes through the telematics module—the car’s “modem”—on its way off the car and can be considered part of the broader telematics infrastructure. Any stored information that does not touch telematics is either stored by the infotainment system, the black box, or substantially similar computer memory.

III.          HOW LAW ENFORCEMENT ACCESSES CAR DATA

Automobiles offer law enforcement a carload of personal data: location data, smartphone data, even biometric data—often without the need for a warrant.

A.    Car data on company servers

The easiest way for law enforcement to obtain car data is simply to ask for it.[42] Telematic systems communicate a range of vehicle and driver information to carmakers, insurers, and telematics companies’ remote corporate servers, and companies freely admit to sharing clients’ data with law enforcement. For example:

• General Motors OnStar shares customers’ location data and audio and video recordings with law enforcement agencies without a subpoena or warrant requirement.[43]

• Allstate offers discounts to drivers in exchange for their telematics data,[44] and shares this data with law enforcement agencies without a subpoena or warrant requirement.[45]

• FCA, the telematics and infotainment provider for Chrysler, Dodge and Jeep, and others shares users’ data with law enforcement agencies, without a subpoena or warrant requirement—and indeed, sometimes simply in response to “request[s], whether formal and informal, from law enforcement or a government authority.”[46]

Surveillance systems are opaque, and law enforcement’s access to telematics data is particularly inscrutable. Most carmakers do not disclose requests for vehicle data. By deciding to withhold transparency reports, which are standard for many consumer-facing companies,[47] vehicle makers, insurers, and others intentionally hide how many government requests they receive each year. This level of secrecy is all too common for government surveillance. U.S. police are notoriously secretive and often hide any information necessary for even minimal public oversight.[48]

Rideshare firms, which disclose the number of police requests they receive for data comparable to telematics, are the closest proxy available to illustrate the potentially astronomic scope of vehicle data surveillance.[49] Uber received nearly 5000 law enforcement requests in 2020; Lyft received slightly over 2000.[50] Together, the companies had about two million cars on the road in 2020.[51] There were roughly 84 million connected cars on the road in 2021,[52] meaning that car manufacturers, telematics companies, and insurers collected data on over 40 times more cars than Uber and Lyft. If manufacturers, telematics, and insurers received a proportional number of law enforcement requests for car data, these companies would have received over 280,000 law enforcement requests in 2020.[53] If this reasonable estimate is even roughly accurate, it is staggering: by point of comparison, Google reported receiving under 80,000 law enforcement requests for user data in the U.S. in 2020.[54] If law enforcement requests to car companies have not reached these levels to date, it is a reflection that police departments have been slow to realize the overwhelming amount of personal information made available to them via automobiles; and a warning that lawmakers and vehicle manufacturers should act before police departments do.

B.    Physical retrieval of data stored on the car

For dragnet searches, law enforcement can’t beat car companies’ server data: officers can demand data for everyone who drove to a protest, an abortion clinic, or across the U.S. border in a stretch of time. But if police have physical access to a car and want to know about its passengers, they needn’t only ask car companies for data. They can break into a car’s hard drives and access locally stored information with tools designed specifically for law enforcement.

Black box data

Police routinely retrieve black box data.[55] Texas police, for example, downloaded black box data two thirds of the time in fatal or possibly fatal crashes.[56] To access the data on black boxes, police plug a device—typically Bosch’s Crash Data Retrieval tool—into a port usually located under the steering wheel.[57] Bosch’s device works on over 90% of models year from 2016 and later.[58] The other 10% are covered by other event data retrieval tools.[59] After recognizing the retrieval device, a car’s black box generates a report[60] that gives law enforcement information about the vehicle’s speed, braking, and acceleration.[61]

Telematics, infotainment, and other computer systems

Since 2013, law enforcement agencies have been able to extract cars’ telematics and infotainment data using Berla’s Project iVe device.[62] When physically connected to a car, the device downloads a forensic copy of both the telematics and infotainment systems.[63] Berla’s May 2022 agreement with Customs and Border Protection (CBP) promises car data, including “geo-positioning data (i.e., navigation history, recent destinations, & favorite locations), call logs, contact lists, SMS messages, emails, pictures, videos and social media feeds.”[64] CBP’s vendor also describes Berla devices’ ability to extract data that predicts drivers’ “future plan[s]” and “known associates and [can] establish communication patterns between them.”[65]

Berla’s technology appears to be frighteningly successful at breaking into cars and relatively easy to use. According to its maker, the device can successfully download data from the vast majority of American and European cars.[66] Users can store and access car data on the Berla mobile app or computer software.[67] Berla partners with the cellphone data extraction firm Cellebrite to optimize data to be imported to existing police databases.[68] The company hopes to eventually eliminate the need for a physical data extraction device: it aims to “build native infotainment apps to collect, store, and forward data,”[69] repurposing a car’s infotainment and telematics systems for spying.

IV.          HARMS

Harms associated with cars’ location data

Car location data may be even more accurate than location data derived from cellphones and other mobile devices.[70] The Supreme Court famously held that cellphones deserve constitutional protections because they convey an “ever-alert,” “nearly infallible,” “all-encompassing record” of a person’s “familial, political, professional, religious, and sexual associations.”[71] There is no reason car data should be more accessible to police.

Law enforcement misuses cars’ location data in two distinct ways. First, law enforcement agencies readily admit that they track the location of cars associated with persons of interest.[72] What they fail to emphasize is that Black and Indigenous People of Color (BIPOC people), immigrants, people seeking abortions, lawful protestors, Muslims, and LGBTQ+ individuals are all “persons of interest” to American police. Even as biased surveillance abuses grow, courts and legislatures have failed to keep up and constrain these tracking abuses.

In addition to targeting particular cars’ location data, law enforcement officers regularly serve geofence warrants that force Google and other tech firms to identify individuals in a particular area at a particular time.[73] These digital dragnets can reveal the locations of hundreds or thousands of people with no suspicion of wrongdoing.[74] Police have used these searches to identify those present at political events,[75] including Black Lives Matter protests.[76] When used to investigate crimes, geofence warrants have led to false arrests, among them a bicyclist whose training route circled a crime scene and an Arizona man falsely accused of murder.[77]

There’s no reason to think that geofence warrants stop or will stop with tech giants like Google. Police already send geofence requests to rideshare companies Uber and Lyft.[78] Car manufacturers, telematics companies, insurers, and their third parties (e.g. data brokers like Otonomo and Wejo) store detailed location data for vehicle tracking, service provision, marketing, and insurance purposes[79]—and may be friendlier to law enforcement causes than tech companies, who are under pressure to stop policing customers.[80] Car-based location data held by companies could easily reveal vehicles present at particular locations and specified times, where those cars started and ended the day, and vehicles that drove along particular routes. As states criminalize abortion in the wake of the Dobbs v. Jackson Women’s Health Organization ruling, we can expect prosecutors to demand automobile location data that criminalizes people seeking and providing reproductive care—including, for example, motorist information for every car that drove from abortion restrictive Indiana to reproductive healthcare clinics in Michigan. Given Immigration and Customs Enforcement’s documented use of location and license plate data to track cars,[81] its recent purchase of Berla devices,[82] and its new contract to equip immigrants with location-tracking cellphones,[83] it would be surprising if the agency is not yet routinely demanding that companies yield car data to track people moving across the U.S. border.[84]

Even municipal governments collect residents’ trip data en masse, suggesting that they may also tap car data for dragnet searches.[85] The Los Angeles Department of Transportation’s (LADOT) maintains one of the largest programs of this sort.[86] Los Angeles tracks thousands of bikes and scooters available for public rental.[87] Every one of these vehicles reports its precise location to local government agencies.[88] Police would normally require a warrant to obtain this information under state law, but LADOT does no such thing, according to federal courts.[89] New York City’s contactless payment program for subways and buses tracks public transit riders in a similar fashion.[90]

Law enforcement agencies and prosecutors can also simply purchase location data from willing sellers. The market for cellphone location data, license-plate reader data, and vehicle locator systems demonstrate law enforcement’s appetite for buying data they cannot legally (or easily) collect or compel companies to share.[91] Until its practices were exposed in May 2022, data brokerage SafeGraph sold abortion clinic visitors’ location data, apparently sourced in part from internet-connected vehicles.[92] The data was available for anti-abortion groups to purchase, as well as to government agencies gearing up to prosecute abortion-seekers and people helping them (it included data that could reveal patients’ states of origin and out-of-state hosts).[93] Another company, Otonomo, analyzes telematics data from tens of millions of vehicles and targets government clients with so-called “smart city” solutions.[94] It faces a class-action law suit for violating California drivers’ privacy rights under the California Invasion of Privacy Act.[95] Yet another company, Ulysses, collects real-time vehicle location data with plans to sell this information to the military.[96] Data brokers have discovered car-based data as a rich source of location data, and it is on the table as a new surveillance source.

Harms associated with communications captured by cars

U.S. law enforcement agencies routinely spy on Americans’ communications in real-time and in retrospect. Car data is being tapped for both purposes: officers “bug” cars using telematics modules and hack infotainment systems to retrieve communications records comparable to those found on smartphones.

Law enforcement agencies listen to conversations happening in cars using cars’ emergency response systems and hands-free microphones, a process colloquially called “cartapping.”[97] In one case, a court ordered a telematics company to let the FBI listen into a car using its emergency assistance system.[98] The company complied for 30 days before stopping. That wasn’t enough for the FBI, who complained that the company was in contempt of court.[99]

Police also raid infotainment systems when they cannot technologically or legally access communications data from smartphones or other sources.[100] California police used this tactic to access phone data after Apple refused their request to break into an iPhone.[101] As Berla’s CEO said, “[t]he cellphone’s locked and you can’t get in it, but they’ve connected the phone to the car, so it reveals some data about the phone.”[102] “Some data” is an understatement: cars store text messages, phone records, contact lists, in-car conversations, and social media feeds, creating a record of drivers’ thoughts, behaviors, and personal, professional, religious, and political commitments and associations.[103]

What’s more, a single rental car can yield much more information than a single smartphone. One rental car in a Baltimore airport yielded personal data from 70 users who had plugged their phones into the car,[104] including, according to Berla’s founder, “[a]ll of their call logs, their contacts, and their SMS history, as well as their music preferences… some of their Facebook and Twitter things as well.”[105]  When rental car companies fail to delete customers’ phone data from rental cars they return (a routine practice that is subject to at least one class-action lawsuit[106]), they make customers’ phone data available to future renters and to law enforcement agencies or prosecutors who may search the car for totally unrelated purposes months or years later. Law enforcement calls car-breaking “digital vehicle forensics.”[107] In truth, it is violative surveillance that sidesteps legal protections on smartphone data for anyone who connects their phone to an infotainment system.

Harms associated with cars’ biometric data

Cars with telematics and infotainment systems collect source material for sensitive biometric data: photos that can be fed into facial recognition software; voice commands that can produce a driver’s voiceprint. A few cars already include built-in biometric tools, like a fingerprint scanner on some 2022 Mercedes.[108] Other tools aim to verify drivers’ identities with facial recognition,[109] scan for distraction,[110] and to measure energy levels and intoxication.[111] Already enacted federal legislation may make implementing more of these biometric monitoring systems mandatory within the next decade.[112]

Biometric technologies range from invasive to completely bogus. Worse yet, BIPOC people and people with disabilities—two groups already at risk of dangerous interactions with the police—suffer disproportionately from their mistakes and malfunctions.

Consider facial recognition, an error-prone tool that uses facial geometry to identify individuals. Facial recognition disproportionately misidentifies BIPOC people, women, young, and elderly people.[113] It struggles to identify at all anyone in poor quality images.[114] Facial recognition in cars—so-called “driver authorization” tools—could lock BIPOC drivers out of their own vehicles.[115]

Other biometric tools for cars, like attention-tracking and emotion-analyzing software, make bogus assumptions about what face and body movements convey about a person’s internal state.[116] Attention-monitoring software has flagged students with disabilities—and students who simply look away from their screens—as cheaters.[117] Emotion-analyzing tools, based on junk science, penalize women for their speech patterns and Black people for normal facial expressions.[118] Bogus biometric software could wrongly flag people for careless or tired driving, with dangerous consequences on the road.[119]

V.             LEGALITY

Law enforcement agencies can perpetrate these harms because they have easy, legal access to car data.

A. Constitutional law

The Bad News…

Cars have emerged through decades of cases as an exception to the protections Americans normally have against searches and seizures. As part of a systematic, decades-long attempt to undermine the Fourth Amendment,[120] the Supreme Court has held that law enforcement officials do not need a warrant before searching a vehicle as long as they have probable cause.[121] The court resolved during Prohibition that it was unreasonable to require law enforcement to take the time to obtain a warrant while evidence (at the time, alcohol) in a vehicle is readily mobile and could be transported to a secret location.[122] Therefore, police can go into the depths of a car, even take apart the engine, if they so choose, so long as they have probable cause to believe doing so would uncover evidence of a crime.[123] Under this line of precedent, police argue they can extract data directly from a vehicle without a warrant,[124] and some courts decline to give car data full Fourth Amendment protections.[125]

Another troubling Fourth Amendment exception, the third-party doctrine, states that law enforcement can collect information that a person shares with a third party, including a company, without a warrant.[126] The Supreme Court held that individuals do not have a reasonable expectation of privacy in such information, so law enforcement needs neither a warrant nor probable cause to access it.[127] As a result, Fourth Amendment protections arguably disappear when a car beams data to its manufacturer, telematics provider, or insurer.[128]

…And the Good News

Police search powers still have some limitations, such as needing a wiretap warrant prior to recording real-time audio in a car. Courts have held that the Fourth Amendment applies to real-time government wiretaps.[129] Cartapping is analogous to a traditional telephone wiretap and should receive the same protection.[130] Remote access to a person’s real-time telematic or infotainment data could be similarly protected. The Supreme Court found that the police may not trespass into a vehicle under the owner’s control to install a GPS tracking device without a warrant,[131] though it remains an open question whether such remote access would be permissible without such trespass.

Recent Supreme Court precedent has extended Fourth Amendment protections of digital data, though these cases have yet to be applied to car data. In Riley v. California, The Supreme Court ruled that searching a cell phone’s digital contents during an arrest is unconstitutional unless the police obtain a warrant before doing so.[132] The court reasoned that cellphones store extremely personal data, and that allowing law enforcement unfettered access to that data, even during an arrest, would be too invasive.[133] Infotainment systems download this same personal information when a driver or passenger syncs their device with the vehicle.[134] The fact that courts have yet to hold that downloading cell phone data from a car’s infotainment system requires a warrant is an intolerable double standard that the courts must address.

Similarly, in Carpenter v. U.S,[135] The Supreme Court held that people maintain a reasonable expectation of privacy in cell tower location information spanning seven or more days, thereby requiring police to obtain a warrant before accessing that data from cell phone service providers in many cases.[136] While written to have a narrow application, the reasoning behind the decision applies broadly to an expectation of privacy in location data, including automobile location information.[137] As a result, the fact that courts have not yet found a reasonable expectation of privacy regarding location data shared between cars and their manufacturers creates a logical inconsistency with Supreme Court case law that courts must immediately remedy.

At least one federal appeals court has also extended constitutional protections to email. The Sixth Circuit found that the Fourth Amendment requires the government to obtain a warrant before compelling emails because “individuals maintain a reasonable expectation of privacy in emails that are stored with, or sent or received through, a commercial Internet Service Provider.” [138] This has led to a broader “understanding that the Fourth Amendment ordinarily requires a warrant for government access to email.”[139] Courts may apply this reasoning to other forms of information in the future, including messages and other data stored on or transmitted off cars.

A few state courts are also increasingly affording protection to automobile data. In 2017, a Florida appeals court ruled that event data recorders are analogous to other electronic devices protected by the Fourth Amendment.[140] Subsequently, the highest court in Georgia found that police must obtain a warrant before physically entering a vehicle to remove its stored data.[141] While the constitutional law is still unsettled in other states, these cases show a growing trend of protecting some car data.

B.    Additional Protections for Electronic Communications

The federal Electronic Communications Privacy Act (ECPA) grants a limited degree of protection to information held by third parties,[142] but police may argue ECPA does not apply to carmakers. In JetBlue, a court reasoned that airlines that maintain websites are not “electronic communications service providers” and fall outside ECPA’s scope.[143] This same reasoning may be extended to car companies that offer connected services but outsource the data transfer function. In other words, a court might decide that ECPA only applies to the internet service provider, app developer, or wireless network that transmits data instead of the vehicle manufacturer. That does not mean ECPA never protects car data, but it does mean that the analysis is fact specific.

Even if ECPA does apply in most cases, its strongest protections may not apply to the bulk of car data. ECPA’s precise application is fact specific, but in general, police do not need a warrant to access any data a company has stored for over 180 days, at the longest.[144] There has been progress in this area beyond ECPA, as Warshak (discussed above) effectively ended the practice of compelling access to the content of communications without a warrant.[145] Still, textually, the strongest protections in ECPA only temporarily delay government access to much vehicle data.[146]

Many states have enacted their own statutes and constitutional protections to supplement ECPA.[147] Thirteen states have adopted constitutional rights to privacy, and most states have laws regulating electronic surveillance to some extent, although they do not necessarily go beyond the protections provided by ECPA.[148] These laws have varying degrees of success in protecting car data. Notably, California’s Electronic Communications Privacy Act is broad enough to apply to communications and related data stored on automobiles and requires law enforcement to obtain a warrant before collecting that data in most cases.[149] Likewise, Michigan’s constitution requires a warrant before any government search of “electronic data.”[150] By its text, this provision appears to include data stored on or collected by vehicles.[151] Unfortunately, in some states, like Missouri, that have enacted additional constitutional protections for electronic data, courts have not extended them to cars when given a chance.[152] And while Florida has been a leader in protecting car data in some ways, it has done worse in others. One Florida court rejected a driver’s claim that a local police department violated state law when it used GPS data collected from a tracking device that a third-party owner installed on a loaner car.[153]

The Drivers Privacy Act and related state laws

Congress and state legislatures have taken action to address some vehicle computer systems. In 2015, Congress passed the Driver Privacy Act (DPA),[154] which restricts access to black box information.[155] Under the DPA, law enforcement needs a court order or administrative agency’s authorization to access a person’s black box without their consent.[156] This affords some protections to black boxes but does not always require a warrant to access their data, and leaves other, more personally revealing areas of the car—the telematics and infotainment systems—entirely open.[157] Seventeen states have enacted legislation similar to the DPA.[158] Of the seventeen, only New Jersey and Montana include a full warrant requirement for law enforcement access to black boxes.[159]

The Safeguards Rule and related state laws

The Safeguards Rule issued under the Gramm-Leach-Bliley Act (GLBA) provides protection for car data held by financial institutions, such as companies that lease or finance cars, including dealerships. The Safeguards Rule requires financial institutions to develop procedures for the disposal of customer information no more than two years after the last interaction with a customer unless the company has a valid business reason to retain the data.[160] If properly enforced, the Safeguards Rule could spur car financers to delete sensitive data that doesn’t serve an identified and defensible business purpose—making less information available to law enforcement by ensuring the data no longer exists.[161]

Similarly, thirty three states have implemented versions of a model bill regulating data stored by insurance companies that could lead to insurance companies storing less car data.[162] The National Association of Insurance Commissioners’ Model Bill 673 requires insurance companies to “implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information.”[163] Insured drivers’ information is stored on insurers’ own servers if they offer insurance discounts for telematics. In many cases, deleting this data within a reasonable time is the simplest way to comply with the Model Bill’s safeguards requirement. If properly enforced, state insurance laws could rally insurers to reduce their data and limit its availability to police.

VI.          RECOMMENDATIONS

A.    Recommendations for lawmakers

1.     Pass legislation to limit the collection, retention, and sharing of data

The collection and retention of automobile data is dangerous, even if law enforcement agencies are limited in their ability to harvest it. Not only can retained data be sold (and purchased by law enforcement—a common tactic to avoid Fourth Amendment obligations),[164] it is also vulnerable to hackers.[165]

The U.S. and states must expand on the Safeguards Rule, DPA, and other privacy statutes to ban the collection of, ban the sale of, and implement strict retention schedules for location history, communications data, and biometric information.[166] The schedules should be proportional to the data points’ sensitivity and value.[167] This would mean, at minimum, deleting nonessential communications, biometrics, and location data after every trip and giving consumers a right to delete their data from vehicles and servers.

Similarly, new laws should give motorists greater control by requiring vehicle manufacturers to obtain data subjects’ opt-in consent before collecting or distributing their information.[168] Importantly, the legislation must specify that there should be no penalty against individuals who opt out of data collection, retention, or distribution. It should also include prohibitions on bundling discrete forms of data collection under a single consent request. For instance, combining permissions to dial an emergency call system with permissions for persistent location tracking results in a broader scope of consent than is necessary to operate the calling system. Lawmakers should also recognize a driver’s right to have all non-essential data stored locally and their right to encrypt their car to prevent the unauthorized sharing and retrieval of their personal information.

Legislators must enact laws requiring police to obtain a warrant before accessing car data, whether from the car itself or from a company storing the data. The warrant must be supported by probable cause and individualized suspicion of criminal wrongdoing, be narrowly tailed, and be subject to independent oversight. States should also consider passing legislation that builds a legal firewall between transportation agencies and the police, preventing agencies from sharing personal information with law enforcement without a warrant. This creates the minimum necessary protections by bringing automobile data in line with the protections of the U.S. Constitution and creates a baseline from which lawmakers can make further improvements.

Legislatures also must prohibit law enforcement from using tools that capitalize on the sensitivity of biometric identifiers and location data, including facial recognition technology and geofence warrants. Vehicle-derived biometric data could give agencies a years-long record of every time a person blinked or glanced away from the road while driving, or even rode in the car as a passenger. This level of surveillance introduces new and serious risks to driving, including the misidentification of BIPOC drivers, the wrongful ascription of inattentiveness to drivers who experience involuntary affects and tics, and the extension of police surveillance into car interiors.

2.     Administrative rulemaking and enforcement

Administrative agencies like the Federal Trade Commission (FTC) should engage in rulemaking and enforcement actions related to car data. The FTC should use its Unfair and Deceptive Acts and Practices (UDAP) authority to levy penalties against companies that misrepresent the extent of their own privacy practices, such seeking judgments against companies that deceptively claim to comply with industry recognized privacy principles.[169] Similarly, the FTC should consider using its UDAP powers to promulgate regulations to prevent harmful surveillance practices before they occur.[170] These regulations should, at least, track the recommendations put forward in in the section above.

The Federal Communications Commission (FCC) should also consider taking up regulatory and enforcement activities targeted towards telematics companies and their network partners. To provide services, telematics companies purchase wireless network bandwidth to share data and communications,[171] and therefore, much of the telematics sector is made up by mobile virtual network operators and other telecom companies under FCC jurisdiction.[172] Telecom companies already must comply with stronger privacy rules than many other corporations.[173] The FCC could improve privacy protections for motorists by using this authority to regulate and bring enforcement actions against telematics providers and related companies.

B. Recommendations for companies

Vehicle manufacturers and other companies must amend their data policies and user interfaces to recognize the sensitivity of car data.[174] Automakers must recognize that lawful police use of car data poses a threat to drivers and passengers. Companies should voluntarily implement opt-in requirements before collecting communications, location history, and other sensitive data to be stored on the vehicle or on remote servers. Additionally, companies should not use data for any purpose out of step with reasonable consumer desires. They should also make it easier for motorists to delete data permanently. If motorists do not delete the data on their own, companies should automatically delete it when it is not necessary to retain the information.

Specifically, companies should not store data in a way where it can be used for geofence and other dragnet searches by law enforcement. As outlined in Section IV, car-based location data could easily reveal vehicles present at particular locations at specified times, where those cars started and ended the day, and vehicles that drove along particular routes. If companies refuse to store this data, they will not have anything to turn over when prosecutors demand this type of data via subpoena or search warrant, or when law enforcement tries to buy it. Companies should not store multiple, non-aggregated location records in a relational database. Data should be completely anonymized so that it cannot reasonably be used to infer information about, or otherwise be linked to a particular consumer, household, or device.  

Likewise, manufacturers should consider whether they truly need to collect and for how long to store sensitive information.[175] If they decide that such data is not necessary, or that countervailing risks to motorists outweigh the data’s value, they should build processes that prevent its storing and sharing. It is important that companies center their customers’ interests rather than their corporate interests, including the profits that could be made from selling customers’ private data.

VII. CONCLUSION

It is time to put the brakes on law enforcement’s access to car data. Some of this data is arguably pedestrian, reflecting vehicle performance and accident information, but other data is deeply private, including location history, communications, and biometric identifiers. This sensitive information deserves strong protection to keep motorists safe on the road from subversion of their constitutional rights and wrongful prosecution.

Social Media Graphics