Driver Data Privacy—the Road Ahead

The attorneys general in Arkansas and Indiana are the most recent AGs to file lawsuits under their respective state laws protecting the privacy of driver data. We previously reported that the state of Texas filed a similar lawsuit. The Arkansas AG filed his lawsuit on February 26, 2025, under the Arkansas Deceptive Trade Practices Act. This action was followed by the Indiana AG's lawsuit on March 19, 2025, under the Indiana Deceptive Consumer Sales Act. Both AGs are alleging that an automobile manufacturer and a related company violated state residents' privacy rights by collecting and selling data about the driving behavior of consumers without the consumers' informed consent.

This data was allegedly collected by software and hardware installed on the vehicles (often referred to as telematics technology) and through consumers' use of mobile applications made available by the manufacturer. The data set reportedly included "the start time, end time, vehicle speed,