A bill passed by the Oregon legislature seeks to protect consumer privacy via in-vehicle data collection.

Recently passed in the Senate following passage in the House in April, House Bill 3875 requires all automakers to comply with state legal protections for collected consumer data, honor requests for personal data deletion, and provide consumers with copies of their data, or stop selling it or using it for targeted advertising.

“Analysts have called cars a privacy nightmare,” said Sen. Khanh Pham (D-District 23), who co-sponsored the bill in the Senate. “Reviewers of all 25 major car brands learned carmakers are sharing or selling information they say shows the driver’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.”

In April, HB 3875 chief sponsor Rep. David Gomberg (D-District 10) told a Senate panel, “Our cars know how fast you’re driving, where you’re going, how long you stay there. They know where we work, they know whether we stop for a drink on the way home, whether we worship on the weekends, and what we do on our lunch hours.”

If signed by Gov. Tina Kotek, the new law would apply to automakers of any size and their affiliated companies.

The bill is in addition to the Oregon Consumer Privacy Act, which was passed in 2023. It entitles consumers to:

• • Get a copy of the personal and sensitive data a business has about them
  • Lists from businesses of the specific entities that received data about them
  • Opt out of a business selling, profiling, and using targeted advertising with personal information
  • Know what information a business has collected
  • Edit any inaccuracies in the data
  • Delete personal and sensitive information that businesses have

In support of the bill, Oregon Consumer Justice cited a Consumer Reports article that states modern vehicles function as “computers on wheels” that collect and transmit personal data. The article says Consumer Reports is working to pass stronger privacy laws and petition automakers not to sell consumer data. It outlines how consumers can request limits on the use of their data and data deletion, or opt out of data sharing.

“Without strong protections, this widespread data collection poses significant privacy risks and leaves consumers vulnerable to tracking, profiling, and potential misuse of their personal information,” wrote Chris Coughlin, policy director of Oregon Consumer Justice, in her testimony. “Oregonians should have control over the personal data that their vehicles collect, just as they do for data collected from other consumer technologies. Modern vehicles are increasingly connected, gathering vast amounts of sensitive information — including location data, driving habits, biometric information, and even personal communications.

“Without clear regulations, this data can be exploited for profit or misused in ways that violate consumer privacy. This bill closes a critical gap by clarifying that all vehicle manufacturers and their affiliates must comply with Oregon’s existing data privacy laws.”

The Alliance of Automotive Innovation (Auto Innovators), which represents most automakers, opposed the bill.

In written testimony submitted in March, State Affairs Senior Director Curt Augustine said the bill would amend Oregon’s comprehensive privacy law to eliminate the volume-based exemption for small automakers and affiliates.

“As far as we can determine, there is no demonstrated need for amending the law to remove the exemption,” he wrote. “It is unclear why small automakers and their affiliates should be treated any differently than other entities under Oregon law. The rationale for the current legal exemption holds for these small automakers as it does for any other low-volume data entity.”

Images

Featured image: Oregon State Capitol Building (Credit: 4nadia/iStock)