Privacy & Information Security Law Blog

On June 6, 2024, the Texas Attorney General’s (“AG”) Office joined the recent swell of regulatory and judicial scrutiny into privacy issues related to connected cars, driving data and telematics, launching an investigation on the data practices of several car manufacturers. AG Ken Paxton announced that his office will probe the mass collection and sale of drivers’ personal data. The AG attributed the investigation to growing concern related to recent “widespread reporting” of allegations that car manufacturers are collecting vast amounts of driver data without the knowledge of drivers, and selling the data to third parties, including insurance companies. 

The investigation is authorized under the Texas Deceptive Trade Practices-Consumer Protection Act, and the AG is requesting documents from car manufacturers and third parties relevant to such conduct, including notices to consumers regarding their data practices. 

In several other states, agencies (including the California Privacy Protection Agency (“CPPA”)) have launched regulatory inquiries, and/or legislatures have introduced or enacted legislation related to driver data privacy. The CPPA’s inquiry, launched in July 2023, remains ongoing. At the federal level, both the Federal Communications Commission and the Federal Trade Commission have focused on the issue as well. The FCC proposed rules to help prevent stalking of abuse victims through the use of connected cars. The FTC has also highlighted that connected car data has been an area of concern for years, and is of particular relevance given recent enforcement actions related to data brokers and sensitive data, including geolocation tracking data. Several car manufacturers and data brokers have also been sued over the collection and sale of driver data.

We continue to monitor the outcomes of Texas’ and other agencies’ regulatory investigations into connected vehicles and driver data privacy, which may have far-reaching implications across various industries.