Privacy Battle Over Connected Cars Takes An Interesting Turn In California

So goes California, and so typically goes the country. And the North American automotive industry along with it.

That’s possibly the case with California and its battle over data.

There is no question the automotive manufacturers want data from hundreds of sensors for a multitude of reasons ranging from warranty reduction, repair prognostics, machine learning of safety-related systems and, yes, advertising revenue. As the former CEO of Ford, Mark Fields, announced to the world in 2016, “As our vehicles become part of the Internet of things and as consumers give permission to us to collect that data, we’ll also become an information company. Our differentiator will be how we use that data to satisfy our customers in ways that they never thought possible in their lives.” In fact, it’s projected by 2023 that worldwide sales of connected vehicles will surpass 76 million units (70% globally, 90% in the United States) with a connected car market revenue of $192 billion and a Cumulative Annual Growth Rate (CAGR) of 18.1% until minimally 2028. Big money.

A fraction of that goldmine comes from insurance companies looking to manage risk and maximize profits. Data in the right hands could enable powerful behavioral reward programs for safer drivers akin to Tina Fey telling State Farm’s Mayhem, “Hey! My focus is on the road, and that’s saving me cash with DriveWise. Who’s the dummy now?” The implied message: better drivers via action-reward programs that would make B.F. Skinner proud, reduce accident claims and help all of society.

But in the wrong hands, that data can create policies that discriminate against specific demographics. “There are all sorts of ramifications for us as individuals: from unwanted marketing to the personal liberties and constitutional rights around unreasonable search and seizure, but also on our insurance rates,” states Jamie Court, President of Consumer Watchdog. “Insurance companies don’t disclose their telematics model, so we don’t know what data they are using. When they are using a rating factor, it needs to be associated with a ‘risk of loss’. In fact, Tesla
TSLA
issues its own insurance but doesn’t tell you want data they’re using. And most insurance companies rate by zip code because they want to charge poor people more because they are riskier due to defaulting on payments, getting in accidents, etc. Now we’re coming back to electronic surrogates for the previously enacted ban on using street address: geofencing and videos that can chronicle what type of house you live in, where you park and possibly even what’s your skin color. People have to realize that it’s easier for companies to use that data more than you think.”

And so Prop 24 was born in 2020: the California Privacy Rights Act (CPRA), which would preclude automakers and insurance companies from utilizing precise geolocation without the permission of the consumer (e.g., “opt in” or minimally “opt out” if unwanted). This Act, which is set to take effect in 2023, was specifically designed to thwart use cases delineated in the March 2022 Consumer Watchdog report entitled, “Connected Cars and the Threat to Your Privacy,” such as logging the neighborhoods in which you drive, whether you’ve been fired, if you’ve recently divorced, etc. “Consumers should have the right to say no to being tracked in their cars” said the report’s author, Justin Kloczko. “California’s new privacy law offers the best hope for limits on automotive surveillance if the California Privacy Protection Agency fulfills its mandate to give consumers an opt out right. Just because you subscribe to [Global Positioning System functionality] does not mean carmakers and insurance companies should have a blank check to use or sell your data for whatever they want.”

The Interesting Turn

It is not braking news that politicians sometimes talk out of both sides of their mouths. In the past five years, though, we have seen unprecedented bravado from politicians blatantly ignoring laws or constituents’ rights.

Enter California Senator, Ricardo Lara. In what appears originally as public support for the rights of car owners to avoid surveillance by insurance companies, Lara came out publicly in January on social media denouncing Musk and others saying, “Push all you want, but we won’t bend on protecting consumer data, privacy and fair rates.”

However, a 2019 recording surfaced a few months later where Lara at a podium stated support for electronic surveillance of driving habits by insurance companies. When confronted by a questioner in the audience about whether such policies violated the California Consumer Privacy Act, Lara quickly began doublespeak, joking about General Council’s presence and stating, ‘it’s something we are talking about, trying to figure out, you know, the specific nuances.”

Will the law continue forth as written and be unperturbed by waffling politicians? Will the automotive manufacturers enact one, opt-in strategy in 2023 for the continent given California’s newest law? Or will manufacturers throw money via lobbyists and lawyers to influence legislation or the courts? Will insurance companies provide transparency about which data is being used to determine rates? All good questions.

“Unfortunately, the auto and insurance industries are seeking exceptions from that law,” bemoans Court. “And that’s going to be a battle that takes place over the next eight months that really is going to determine, I think, the fate not only of privacy protections in California but, by translation, in America.”