Consumer Reports writes with a “support if amended” position on SB 346. For over 80 years, Consumer Reports has worked with consumers for truth, transparency, and fairness in the marketplace. We are strong proponents of public policy that protects consumer safety and bolsters consumers’ privacy. This bill would provide important privacy protections, by prohibiting sensitive information collected through in-vehicle cameras from being shared, sold, or used for advertising purposes, and requires consumers’ consent for retaining the data outside of the vehicle.
Consumer Reports expects that new cars will increasingly come equipped with in-vehicle cameras that can monitor the driver and alert them when they appear to have stopped paying attention to the road, offering key safety protections. Among other potential uses, an effective camera-based direct driver monitoring system is an essential safeguard for active driving assistance, and Consumer Reports is urging automakers to include such a system in any vehicle with this capability. The Cadillac Super Cruise active driving assistance system, for example, can slow or stop the car if the driver does not respond—and even call for help. Camera-based systems are more effective than hands-on-wheel warnings, because the driver can become disengaged even if their hands are on the wheel.
However, in-vehicle cameras also raise privacy concerns. Not only are video recordings inherently sensitive, but they can be used and monetized in ways that consumers may not expect—such as for location-based promotions or in-car marketing. This information could also be made public without the consumers’ consent or knowledge—as Tesla has done on numerous occasions.
Existing protections over this data are not enough. Voluntary industry guidelines, which most manufacturers have agreed to, direct companies to provide notice to consumers about their data collection practices, and to provide access to certain data—but do not give consumers control over how this data is used and shared. The California Consumer Privacy Act gives consumers the right to stop the sale of their personal information—but those protections only apply after the consumer takes action. That means that by default, companies can share and sell that information freely. Further, Consumer Reports research has shown that consumers have had difficulty opting out of the sale of their information. This bill takes a better approach, by simply prohibiting companies from engaging in privacy-invasive behaviors like selling sensitive data to third parties.
However, we request several amendments to ensure that the bill supports critical work to enhance auto safety and improve active driving assistance systems. The manufacturer should be able to share the data with third parties, with the consumer’s permission, if necessary to improve the safety system or for purposes of diagnosing, servicing, or repairing the vehicle or equipment. Within the context of this exemption, minimum amounts of data should be shared, the data should be destroyed after use, and should not be further shared or transmitted by the receiving entity. And language should be added to ensure that consumers cannot be charged a different price for declining to share data. Further, language should be added to clarify that the CCPA’s authorized agent provision would still apply.
In addition, certain exemptions in the federal Driver Privacy Act should be incorporated into the bill, including to ensure that companies cannot use California law to prevent access to the data by federal crash investigators at the Department of Transportation and the National Transportation Safety Board, which is authorized currently under federal law. Specifically, the bill should permit a manufacturer to share recordings when:
- A court or other judicial or administrative authority having jurisdiction authorizes the retrieval of the data and, to the extent that there is retrieved data, the data is subject to the standards for admission into evidence required by that court or other administrative authority;
- The data is retrieved pursuant to an investigation or inspection authorized under section 1131(a) or 30166 of title 49, United States Code, and the personally identifiable information of an owner or a lessee of the vehicle and the vehicle identification number is not disclosed in connection with the retrieved data, except that the vehicle identification number may be disclosed to the certifying manufacturer; or
- The data is retrieved for the purpose of determining the need for, or facilitating, emergency medical response in response to a motor vehicle crash.
With these amendments, the bill would provide consumers with important privacy protections and would help to support the continued development and deployment of key vehicle safety features. We look forward to working with you to ensure these protections for consumers.