In providing these  services, connected vehicles generate, transmit, and receive various  types of data, such as a car’s location. The National Highway  Traffic Safety Administration (NHTSA) within DOT is responsible for  vehicle safety. Selected Automakers Reported Using Collected Data Primarily to Provide Services to Consumers and for Research and Development

According to the 13 selected automakers that offer connected vehicles,  they currently use data collected from connected vehicles to provide  connected vehicle services, and some use the data for research and  development and marketing. Selected Automakers Reported Sharing Data on a Limited Basis

All 13 selected automakers that offer connected vehicles said they  typically do not share collected data with unaffiliated third parties. Automakers reported obtaining consent before collecting  data from vehicles, but they offered few options besides opting in and  opting out of sharing data. Transparency: All 13 selected automakers’ written privacy notices were  readily accessible from their public websites, but based on our analysis,  none of the notices was clearly written. Focused Data Use: Most selected automakers reported limiting their data  collection, use, retention and sharing, but their policies varied. Most  written notices did not clearly identify data sharing and use practices. Selected Experts Had Concerns about Connected Vehicle Data Privacy and Automakers’ Privacy Efforts

		Selected Experts Generally Agreed Broader Privacy Concerns Applied to Connected Vehicle Data

In interviewing selected experts on privacy issues related to connected  vehicle data, we presented the experts with general privacy concerns  about the commercial collection and use of data that we had identified  from our and other federal agencies’ reports and interviews with  organizations that advocate the protection of the privacy of consumers’  data and asked the experts if these issues applied to data collected  through connected vehicles. FTC and NHTSA Have Efforts Related to Data Privacy Under Way, but NHTSA’s Role Is Unclear

		FTC and NHTSA Have Efforts and Guidance Related to Protecting Data Privacy

While no federal law expressly confers broad privacy protections for  consumers’ data and no single federal agency oversees data privacy  issues, the FTC Act gives FTC the authority to bring actions against  companies or individuals that engage in unfair or deceptive acts or  practices in or affecting commerce. NHTSA, according to agency officials, has broad authority over the safety  of passenger vehicles and may issue voluntary guidance or mandate  standards through a rulemaking process to address safety, but it does  not have the authority to regulate consumer privacy as it relates to motor  vehicles or motor vehicle data. The guidance, among other things, outlined a set of privacy  principles and recommended that automakers manufacturing automated  vehicle technologies adopt these or similar principles. However, NHTSA has not  clearly defined and communicated its roles and responsibilities related to  the privacy of connected vehicle data to stakeholders. One automaker also questioned whether  NHTSA was coordinating on data privacy issues with other relevant  federal agencies. NHTSA officials acknowledged that some  stakeholders may be uncertain whether and, if so, to what extent it has  authority to address any privacy issues with respect to motor vehicles. DOT concurred with our recommendation to define, document, and  externally communicate the agency’s roles and responsibilities in relation  to connected vehicle data privacy. The Departments of Commerce and Justice and the Federal  Communications Commission reviewed our report, but did not have any  comments. GAO staff who made key contributions to this report  are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

This report addresses the following objectives: (1) the types of data  collected by connected vehicles and transmitted to automakers and how,  if at all, selected automakers use and share these data, (2) the extent to  which selected automakers’ privacy policies for connected vehicles align  with leading practices, (3) selected experts’ views on privacy issues  related to the commercial use of data collected by connected vehicles,  and (4) federal roles and efforts related to the privacy of data collected by  connected vehicles. We asked each of the 13 automakers that offer connected vehicles a set  of additional questions to clarify its use and sharing of data and its privacy  practices. To determine the extent to which automakers’ privacy  policies reflect these leading practices, we analyzed selected automakers’  written privacy notices through a document review and reported privacy  practices related to connected vehicles based on automakers’ responses  to semi-structured interview questions. While many of these automakers offer several brands, one automaker  had different written privacy notices for its three vehicle brands sold in the  U.S. As such, we analyzed a total of 15 sets of privacy policies (their  written notices and reported privacy practices). Because of DOT’s role  in overseeing motor vehicles, we compared DOT’s efforts to reevaluate  and define key agency roles and responsibilities as new vehicle  technologies emerge with pertinent Standards for Internal Control in the  Federal Government and practices identified in our prior work on agency  collaboration.
Why GAO Did This Study

The prevalence of connected vehicles—those with technology that wirelessly transmits and receives data—has raised questions about how the collection, use, and sharing of these data affect consumer privacy.
GAO was asked to review consumer privacy issues related to connected vehicles. This report: (1) examines the types, use, and sharing of data collected by connected vehicles; (2) determines the extent to which selected automakers' privacy policies for these data align with leading practices; and (3) evaluates related federal roles and efforts, among other objectives. GAO interviewed relevant industry associations, organizations that work on consumer privacy issues, and a non-generalizable sample of 16 automakers selected based on their U.S. passenger vehicle sales. In addition, GAO analyzed selected automakers' privacy policies (written notices and reported practices) against a set of leading privacy practices determined to be relevant to connected vehicles. To identify these practices, GAO reviewed a variety of privacy frameworks developed by federal agencies and others. GAO reviewed relevant federal statutes, regulations, and reports, and interviewed agency officials, including those from DOT, the Department of Commerce, and FTC.

What GAO Found

Thirteen of the 16 selected automakers in GAO's review offer connected vehicles, and those 13 reported collecting, using, and sharing data from connected vehicles, such as data on a car's location and its operations (e.g., tire pressure). All 13 automakers described doing so on a relatively limited basis. For example, they reported using data to provide requested services to consumers and for research and development. None of the 13 reported sharing or selling data that could be linked to a consumer for unaffiliated third parties' use. However, as connected vehicles become more commonplace, the extent of data collection, use, and sharing will likely grow.
Automakers have taken steps, including signing onto a set of privacy principles, to address privacy issues. In comparing selected automakers' reported privacy policies to leading privacy practices, GAO found that these automakers' policies at least partially reflected each of the leading privacy practices, for example:
Transparency : All 13 selected automakers' written privacy notices were easily accessible, but none was written clearly.
Focused data use : Most selected automakers reported limiting their data collection, use, and sharing, but their written notices did not clearly identify data sharing and use practices.
Individual control : All 13 selected automakers reported obtaining explicit consumer consent before collecting data, but offered few options besides opting out of all connected vehicle services to consumers who did not want to share their data.
The Federal Trade Commission (FTC) and the Department of Transportation's (DOT) National Highway Traffic Safety Administration (NHTSA) are primarily responsible for protecting consumers and ensuring passenger vehicles' safety, respectively. FTC has the authority to protect consumer privacy and has issued reports and guidance and conducted workshops on the topic generally as well as on connected vehicles specifically. NHTSA has broad authority over the safety of passenger vehicles and considers the privacy effects and implications of its regulations and guidance. FTC and NHTSA have coordinated on privacy issues related to connected vehicles. However, NHTSA has not clearly defined its roles and responsibilities as they relate to the privacy of vehicle data. In response to emerging vehicle technologies, NHTSA included privacy requirements in a related rulemaking and included privacy expectations in voluntary guidance. Because of these actions, selected automakers and others said NHTSA's role in data privacy was unclear. NHTSA officials acknowledged that some stakeholders may be uncertain about its authority to address privacy issues. Federal standards for internal control require, among other things, that agencies define and communicate key roles and responsibilities. By clearly defining, documenting, and communicating NHTSA's roles and responsibilities in vehicle data privacy, NHTSA would be better positioned to coordinate with other federal agencies and to effectively oversee emerging vehicle technologies.

What GAO Recommends

GAO recommends that NHTSA define, document, and externally communicate its roles and responsibilities related to the privacy of data generated by and collected from vehicles. NHTSA concurred with our recommendation.