Letter Text (PDF)

Washington (December 1, 2023) – Senator Edward J. Markey (D-Mass.), a member of the Senate Commerce, Science, and Transportation Committee, sent letters to 14 car manufacturers today urging them to implement and enforce stronger privacy protections in their vehicles. Vehicles have effectively become computers on wheels, collecting vast amounts of data on drivers, passengers, and people outside the vehicles, including sensitive data such as location history, eye movements, and other health indicators. In the letter, Senator Markey also sounds the alarm on automakers’ overly-complicated and confusing privacy policies, leaving consumers in the dark about the extent of the automakers’ data collection, use, and disclosure practices.

Senator Markey’s letter follows a report from Mozilla in September, which investigated the privacy policies of 25 car brands and found that all 25 brands failed to meet minimum privacy and security standards. The researchers concluded that cars were “the official worst category of products for privacy that we have ever reviewed.”

In his letter, Senator Markey wrote, “These practices are unacceptable. Although certain data collection and sharing practices may have real benefits, consumers should not be subject to a massive data collection apparatus, with any disclosures hidden in pages-long privacy policies filled with legalese. Cars should not — and cannot — become yet another venue where privacy takes a backseat. As more and more cars become computers on wheels, automakers must implement strong privacy policies to protect users.”

The letters were sent to car manufacturers BMW, Ford, General Motors, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Nissan, Stellantis, Subaru, Tesla, Toyota, and Volkswagen.

Senator Markey requested that the 14 automakers respond to a variety of questions by December 21, 2023, including: 

• Does your company collect user data from its vehicles, including but not limited to the actions, behaviors, or personal information of any owner or user?
• Does your company provide notice to vehicle owners or users of its data practices?
• Does your company provide owners or users an opportunity to exercise consent with respect to data collection in its vehicles?
• Can all users, regardless of where they reside, request the deletion of their data? 
• Does your company take steps to anonymize user data when it is used for its own purposes, shared with service providers, or shared with non-service provider third parties? 
• Does your company have any privacy standards or contractual restrictions for the third-party software it integrates into its vehicles, such as infotainment apps or operating systems?
• Has your company ever provided to law enforcement personal information collected by a vehicle?

Senator Markey is a longtime privacy champion, including in vehicles. He has previously introduced legislation, the Security and Privacy in Your Car (SPY Car) Act, which directs the National Highway Traffic Safety Administration and the Federal Trade Commission to establish federal standards around cybersecurity and privacy in vehicles. The bill also establishes a rating system that informs consumers about how well the vehicle protects drivers’ security and privacy beyond those minimum standards.

###