The enforcement division of the California Privacy Protection Agency (CPPA) recently announced it intends to review the privacy practices of connected vehicles. The driving force behind the review is the technologies in connected cars that raise privacy concerns. These include location sharing and smartphone integration. Connected cars often also have cameras and web-based entertainment systems. These cars—and the technologies in them—may monitor people both in the car and outside of it. For many Californians, the car is part of their daily routines. Connected vehicles can effectively becoming a constant data generator.

The CPPA, California’s independent data protection authority, was created under amendments to the CCPA. It is charged with enforcing the state’s privacy law, among other things. This is the agency’s first announcement of this kind. Its focus until now has been on rulemaking. The agency is conducting the review under the CCPA, and pointed to the fact that the law grants consumers certain rights. These include the right to delete, right to know, and the right to stop sale or sharing. Presumably the agency’s review (and likely subsequent enforcement) will not be for violations of the regulations adopted by the CPPA on March 29, 2023, which as we reported cannot be enforced until 2024.

Key among this data is the vehicle’s location. When combined with personal information and/or third-party data or mapping services, location information can unveil intricate details about a person’s preferences and habits. CPPA’s announcement implies they are looking at both the information collected about people in the connected vehicles and also information captured about other devices near the vehicle. This implies the potential for monitoring not just the driver’s information but also that of passengers and individuals nearby.

The CPPA is not the only regulator focusing on connected vehicles. Chinese regulators have expressed concerns, while the European Commission is working on regulations to ensure equitable access to vehicle data.

Putting it Into Practice: While CPPA’s enforcement regime has had a minor setback, the agency continues to move forward with its enforcement plans. Companies should keep an eye out for existing compliance issues that may be on the forefront of CPPA’s radar as they begin to show how they will wield their new authority.