The California Privacy Protection Agency plans to review manufacturers' treatment of data collected from vehicles, including locations and images from cameras
Joseph Menn / Washington Post :
Context & Ripple Effects
The Proposition 24 vote that created the Privacy Protection Agency gave California its first dedicated privacy regulator, and the agency is now pointing its rulemaking authority at a sector privacy advocates have flagged for years: the car. The connected vehicle data marketplace — 37 companies operating largely unregulated, with estimates running into the hundreds of billions by 2030, has grown up with no dedicated oversight of what cars collect or where it flows.
The review also lands on terrain regulators have circled before: the state DMV's 2015 draft self-driving rules already raised privacy and cybersecurity questions, and reporting since has shown manufacturers using data control as leverage — locking performance and maintenance data away from consumers shapes where cars can be repaired. Camera footage has meanwhile become a law-enforcement resource, with police obtaining warrants for Waymo and Cruise driverless-car footage.
First-order effects
- Automakers selling connected vehicles in California face scrutiny of location tracking and camera imagery for the first time from an agency with CCPA enforcement power, forcing them to document collection practices and legal bases.
- Consumers gain a potential path to control over data their cars generate — extending the access-and-deletion rights model from web browsing to driving behavior.
Second-order effects
- The brokers and analytics firms in the connected-vehicle data supply chain face compliance exposure they have avoided as an 'unregulated industry,' and may need contracts and consent flows that trace back to the driver rather than the manufacturer.
- Police access to camera footage creates a collision course for the agency: privacy rules written for commercial data sharing will have to define how warrants interact with retention and disclosure practices.
Third-order effects
- If California writes binding rules, automakers face a split regulatory map alongside regimes like China's licensing requirement for 'smart cars' collecting mapping data — pushing toward region-specific data architectures rather than one global pipeline.
- The review could establish vehicles as a regulated sensor category, treating cameras and location telemetry the way emissions or safety systems are treated — a structural shift from cars as products to cars as monitored data sources.
The trend: Vehicle-generated data is moving from an unregulated gray market toward jurisdiction-by-jurisdiction licensing and consent regimes, with California's new enforcement agency positioning itself as the template-setter.