Insights

The attorneys general in Arkansas and Indiana are the most recent AGs to file lawsuits under their respective state laws protecting the privacy of driver data. We previously reported that the state of Texas filed a similar lawsuit. The Arkansas AG filed his lawsuit on February 26, 2025, under the Arkansas Deceptive Trade Practices Act. This action was followed by the Indiana AG's lawsuit on March 19, 2025, under the Indiana Deceptive Consumer Sales Act. Both AGs are alleging that an automobile manufacturer and a related company violated state residents' privacy rights by collecting and selling data about the driving behavior of consumers without the consumers' informed consent.

This data was allegedly collected by software and hardware installed on the vehicles (often referred to as telematics technology) and through consumers' use of mobile applications made available by the manufacturer. The data set reportedly included "the start time, end time, vehicle speed, hard braking events, hard acceleration events, high-speed driving percentage, late-night driving percentage, and total miles driven," among other data points. Additionally, the data included "location data on all drivers who activated the internet connection for their" vehicles.

The manufacturer, according to the AGs, originally marketed its telematics technology as a safety feature of its vehicles, allowing drivers to get help in an emergency. As time and technology evolved, consumers were able to access data about their vehicles and their own driving behavior. Through this technology, the manufacturer also had access to data about consumers' driving behavior and location.

The AGs allege that this data was used and sold without drivers' informed consent. In making these allegations, the AGs point to a perceived complicated onboarding process for consumers purchasing or leasing vehicles. The onboarding process, as claimed in the lawsuits, was designed to tout the benefits of the technology while obscuring how the information would be used or sold by the manufacturer and others. The Indiana AG claims, "Defendants employed deceptive 'dark patterns' ... and did not allow consumers to fully understand their privacy policies."

The complicated notices contained in the onboarding process were implemented, according to the AGs, despite the manufacturer's membership in an automotive consumer privacy alliance and its commitment to provide transparent notices with meaningful information. The AGs claim that the manufacturer did not provide transparent notices that would allow consumers to fully understand the use of their information, despite the manufacturer's promise to do so.

The heart of the AGs' allegations is the manufacturer's failure to tell consumers that their data would be sold to third-party data brokers who would then sell the data for insurance activities, including to providers to help inform how they set the rate for insurance premiums. The AGs also allege that the sale of this information was profitable for the automobile manufacturer but cost consumers. The Indiana AG quoted the California Privacy Protection Agency by noting in the lawsuit that protecting driver data is "critical."

The lawsuits seek to enjoin the manufacturer and the related entity from engaging in the practices identified and to recover civil penalties for each violation.

So, what does the road ahead look like?

The state lawsuits regarding driver data privacy are a reminder that while the Consumer Financial Protection Bureau's initiatives may be in flux, AGs are watching for opportunities to show constituents that privacy is important. States may use their unfair or deceptive acts or practices laws to hold companies to their promises, even if these are perceived promises and even if the states do not have a comprehensive consumer privacy law in effect. The drive to protect the privacy of consumer information may be commensurate with the level of sensitivity of the data and the end benefit to the company that has allegedly not upheld its disclosed privacy policies (or clearly articulated those policies, as alleged in the lawsuits described above). Thus, while the road ahead may be filled with twists and turns, it appears that state AGs are committed to staying on track with their enforcement priorities, including by protecting against what they perceive to be unfair or deceptive acts or practices.

Megan C. Nicholls is a partner in the Texas office of Hudson Cook, LLP. She can be reached at 682.350.9151 or by email at mnicholls@hudco.com.