The IT Law Wiki


Government Accountability Office, Vehicle Data Privacy: Industry and Federal Efforts Under Way but NHTSA Needs to Define Its Role (GAO-17-656) (July 28, 2017) (full-text).


The prevalence of connected vehicles — those with technology that wirelessly transmits and receives data — has raised questions about how the collection, use, and sharing of these data affect consumer privacy.

The GAO was asked to review consumer privacy issues related to connected vehicles. This report: (1) examines the types, use, and sharing of data collected by connected vehicles; (2) determines the extent to which selected automakers' privacy policies for these data align with leading practices; and (3) evaluates related federal roles and efforts, among other objectives. The GAO interviewed relevant industry associations, organizations that work on consumer privacy issues, and a non-generalizable sample of 16 automakers selected based on their U.S. passenger vehicle sales.

In addition, the GAO analyzed selected automakers' privacy policies (written notices and reported practices) against a set of leading privacy practices determined to be relevant to connected vehicles. To identify these practices, the GAO reviewed a variety of privacy frameworks developed by federal agencies and others. The GAO reviewed relevant federal statutes, regulations, and reports, and interviewed agency officials, including those from DOT, the Department of Commerce, and FTC.

The GAO recommends that NHTSA define, document, and externally communicate its roles and responsibilities related to the privacy of data generated by and collected from vehicles.