SB 1394: Access to connected vehicle service.
- Session Year: 2023-2024
- House: Senate
- Latest Version Date: 2024-09-27
Current Status:
Passed
(2024-09-27: Chaptered by Secretary of State. Chapter 655, Statutes of 2024.)
Introduced
In Committee
First Chamber
In Committee
Second Chamber
Enacted
What does this bill do?
The bill requires car makers and companies that run connected vehicle services to warn people inside a vehicle when someone outside has accessed its connected features or location, and to let a driver stop that outside access. It also requires those companies to provide a clear online "How to Disconnect Remote Vehicle Access" process that, after the driver gives the vehicle identification number and proof of legal possession (for example, a title or court order), will end another person’s access quickly without fees or extra approvals. The bill further requires an easy, in‑car switch to immediately disable location tracking that does not need an app, login, or notifications to the account holder.
The summary is provided by generative AI which can make mistakes. For original language, please view the details in the table below.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require, beginning on January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either connected vehicle service or connected vehicle location access, as those terms would be defined. The bill, beginning on July 1, 2025, for vehicles with connected vehicle service, would further require a covered provider to provide a process for a driver to terminate a persons access to connected vehicle service, as specified. The bill would require, beginning on January 1, 2028, a covered provider to provide, in a vehicle manufactured on or after January 1, 2028, that has connected vehicle location access, a mechanism that meets specific requirements and can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. The bill would, beginning on July 1, 2026, apply this provision to vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates, as specified. The bill would define terms for these purposes, including covered provider, which would be defined as a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. By establishing new duties on vehicle manufacturers or these entities, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would also declare the severability of its provisions.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require, beginning on January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either connected vehicle service or connected vehicle location access, as those terms would be defined. The bill, beginning on July 1, 2025, for vehicles with connected vehicle service, would further require a covered provider to provide a process for a driver to terminate a persons access to connected vehicle service, as specified. The bill would require, beginning on January 1, 2028, a covered provider to provide, in a vehicle manufactured on or after January 1, 2028, that has connected vehicle location access, a mechanism that meets specific requirements and can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. The bill would, beginning on July 1, 2026, apply this provision to vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates, as specified. The bill would define terms for these purposes, including covered provider, which would be defined as a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. By establishing new duties on vehicle manufacturers or these entities, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would also declare the severability of its provisions.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require, beginning on January 1, 2027, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either connected vehicle service or connected vehicle location access, as those terms would be defined. The bill, beginning on January July 1, 2025, for vehicles with connected vehicle service, would further require a covered provider to provide a process for a driver to terminate a persons access to connected vehicle service, as specified. The bill would require, beginning on January 1, 2026, 2028, a covered provider to provide, in a vehicle manufactured on or after January 1, 2028, that has connected vehicle location access, as specified, a mechanism that meets specific requirements and can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. The bill would, beginning on July 1, 2026, apply this provision to vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates, as specified. The bill would define terms for these purposes, including covered provider, which would be defined as a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. By establishing new duties on vehicle manufacturers or these entities, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would also declare the severability of its provisions.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require a vehicle manufacturer that offers a vehicle for sale, rent, or lease in this state that includes connected vehicle service, as defined, to: (1) ensure that the connected vehicle service can be immediately disabled for a period of at least 48 hours by a driver of the vehicle while that driver is inside the vehicle, as specified; and (2) reenable the connected vehicle service, as specified. The bill would require the driver to submit a connected vehicle service request, as defined, within 48 hours of disabling the connected vehicle service to terminate a persons access to connected vehicle service, and the request would be required to include specified documents that support that the person has committed, or allegedly committed, domestic violence against the driver or an individual in the drivers care. The bill would require the driver to submit specified documentation within 30 days of submission of the request to provide proof of legal possession of the vehicle, including a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle, as specified. The bill would require a vehicle manufacturer to terminate the persons access to connected vehicle service within one business day after the date of receiving the drivers completed request, as specified. The bill would prohibit a vehicle manufacturer from charging a fee to a driver for completing their request to terminate a persons access to connected vehicle service. The bill would require a vehicle manufacturer, among other things, to establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to connected vehicle service, as specified, and to ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations. The bill would also require a vehicle manufacturer to provide a notification inside of a vehicle that is installed with connected vehicle service that shows if the connected vehicle service is being used. By establishing new duties on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.This bill would require, beginning on January 1, 2027, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either connected vehicle service or connected vehicle location access, as those terms would be defined. The bill, beginning on January 1, 2025, for vehicles with connected vehicle service, would further require a covered provider to provide a process for a driver to terminate a persons access to connected vehicle service, as specified. The bill would require, beginning on January 1, 2026, a covered provider to provide, in a vehicle that has connected vehicle location access, as specified, a mechanism that meets specific requirements and can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. The bill would define terms for these purposes, including covered provider, which would be defined as a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. By establishing new duties on vehicle manufacturers or these entities, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would also declare the severability of its provisions.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require a vehicle manufacturer that offers a vehicle for sale, rent, or lease in this state that includes connected vehicle service, as defined, to: (1) ensure that the connected vehicle service can be immediately disabled for a period of at least 48 hours by a driver of the vehicle while that driver is inside the vehicle, as specified; and (2) reenable the connected vehicle service, as specified. The bill would require the driver to submit a connected vehicle service request, as defined, within 48 hours of disabling the connected vehicle service to terminate a persons access to remote vehicle technology, as defined, upon a completed request from a driver who establishes proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. connected vehicle service, and the request would be required to include specified documents that support that the person has committed, or allegedly committed, domestic violence against the driver or an individual in the drivers care. The bill would require the driver to submit specified documentation within 30 days of submission of the request to provide proof of legal possession of the vehicle, including a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle, as specified. The bill would require a vehicle manufacturer to terminate the persons access to connected vehicle service within one business day after the date of receiving the drivers completed request, as specified. The bill would prohibit a vehicle manufacturer from charging a fee to a driver for completing their request to terminate a persons access to remote vehicle technology. connected vehicle service. The bill would require a vehicle manufacturer, among other things, to establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to remote vehicle technology, connected vehicle service, as specified, and to ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations. The bill would also require a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology connected vehicle service that shows if the remote vehicle technology connected vehicle service is being used. By establishing new duties on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would also declare the severability of its provisions.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require a vehicle manufacturer to terminate a persons access to remote vehicle technology, as defined, upon a completed request from a driver who establishes proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. The bill would prohibit a vehicle manufacturer from charging a fee to a driver for completing their request to terminate a persons access to remote vehicle technology. The bill would require a vehicle manufacturer, among other things, to establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to remote vehicle technology, as specified, and to ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations. The bill would also require a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used. By establishing new duties on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require a vehicle manufacturer to terminate a persons access to remote vehicle technology, as defined, upon a completed request from a driver who establishes proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. The bill would prohibit a vehicle manufacturer from charging a fee to a driver for completing their request to terminate a persons access to remote vehicle technology. The bill would require a vehicle manufacturer, among other things, to employ dedicated staff who are trauma-informed to receive and respond to these requests. establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to remote vehicle technology, as specified, and to ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations. The bill would also require a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used. By establishing new duties on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require a vehicle manufacturer to terminate a persons access to remote vehicle technology, as defined, upon a completed request from a driver who establishes proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. The bill would prohibit a vehicle manufacturer from charging a fee to a driver for completing their request to terminate a persons access to remote vehicle technology. The bill would require a vehicle manufacturer, among other things, to employ dedicated staff who are trauma-informed to receive and respond to these requests. The bill would also require a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used. By establishing new duties on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, dating violence, sexual assault, human trafficking, and related abuse are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources, options, and meaningful support when establishing independence from an abuser, including the barriers of financial insecurity and limited access to reliable means to maintain essential connections with family, social safety networks, employers, and support services. Abuse survivors may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological and communication tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and use other means of electronically or remotely controlling the vehicle. Tracking can be viewed in real time, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access through such technologies as mobile phone wireless connectivity and location data capabilities that are manufactured into vehicles.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)According to privacy researchers and as reported in the New York Times, Modern vehicles have been called smartphones with wheels because they are internet-connected and have myriad methods of data collection, from cameras and seat weight sensors to records of how hard you brake and corner. Most drivers dont realize how much information their cars are collecting and who has access to it.
(g)Under the federal Safe Connections Act of 2022, survivors of domestic abuse are empowered to protect themselves and their loved ones by requiring telecommunications providers, upon request, to separate their mobile phone accounts from the accounts of their abusers, but the law does not extend to vehicular technology.
(h)It is the intent of this act to end stalking and abuse by abusive partners who can access connected vehicle service.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Connected Vehicle Service1.General Provisions28200.Unless the context requires otherwise, for purposes of this chapter, the following terms have the following meanings:
(a)Account holder means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
(b)Connected vehicle location access is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
(c)Connected vehicle service means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(d)Connected vehicle service account means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
(e)Connected vehicle service request means a request by a driver to terminate a persons access to connected vehicle service.
(f)Covered provider means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service.
28202.(a)A vehicle with connected vehicle service shall clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either of the following:
(1)Connected vehicle service.
(2)Connected vehicle location access.
(b)This section shall become operative on January 1, 2028.
28204.The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
28206.(a)This article, except Section 28202, and Article 2 (commencing with Section 28220) shall become operative on July 1, 2025, and apply to vehicles that have connected vehicle service.
(b)Article 3 (commencing with Section 28240) shall become operative as follows:
(1)On January 1, 2028, for vehicles manufactured on or after January 1, 2028, that have connected vehicle location access.
(2)On July 1, 2026, for vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates that provide for the functionality required by Article 3 (commencing with Section 28240).
(c)This chapter does not apply to vehicles owned or operated by a rental company, as defined in Section 1939.01 of the Civil Code.
28210.A covered provider or any officer, director, employee, vendor, or agent of a covered provider shall not be subject to liability for any claims deriving from an action taken in compliance with this chapter.
2.Access to Connected Vehicle Service28220.(a)A covered provider shall provide a process that includes a prominent and clearly visible link entitled HOW TO DISCONNECT REMOTE VEHICLE ACCESS on its internet website to complete both of the following transactions:
(1)Submit a connected vehicle service request.
(2)Obtain a new connected vehicle service account.
(b)A covered provider shall ensure that all communications provided pursuant to this article are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout the process for submitting a connected vehicle service request or obtaining a new connected vehicle service account.
28222.To enhance transparency and communication, the process to submit a connected vehicle service request or obtain a new connected vehicle service account shall be efficient, secure, user-friendly, and include all of the following features:
(a)Upon submission of a connected vehicle service request or request to obtain a new connected vehicle service account, the covered provider shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(b)Upon completing the review of the request, the covered provider shall inform the driver of the action taken, including, as applicable, whether a persons access to connected vehicle service has been terminated, or if additional information or proof of legal possession of the vehicle is needed. This alert shall clearly state any relevant details or further actions required from the driver to complete a successful connected vehicle service request.
(c)If a connected vehicle service request is approved, the covered provider shall provide the driver with a clear explanation and guidance on how to create their own connected vehicle service account, if applicable, to ensure that the driver can maintain control over the connected vehicle service once another persons access to connected vehicle service has been terminated.
28224.(a)A driver shall demonstrate to a covered provider the authority to terminate a persons access to connected vehicle service by providing both of the following:
(1)The vehicle identification number.
(2)Proof of legal possession of the vehicle, which may be a legal title to the vehicle, or a dissolution decree, temporary court order, or domestic violence restraining order that awards possession or exclusive use of the vehicle to the driver. A court order awarding sole possession or exclusive use of a vehicle shall take priority over a vehicle title showing joint ownership for purposes of this article.
(b)A covered provider shall not require a driver to provide any proof of legal possession other than what is required in subdivision (a) to establish the authority to terminate a persons access to connected vehicle service.
(c)A covered provider shall not require a driver to take any action to terminate a persons access to connected vehicle service other than what is set forth in this section, including, but not limited to, requiring any of the following:
(1)Payment of a fee, penalty, or other charge to complete a connected vehicle service request.
(2)Maintaining or extending the term of a connected vehicle service account.
(3)Approval by any account holder, including, but not limited to, the named account holder, of the change in access.
(4)An increase in the rate charged for the connected vehicle service.
(d)A covered provider shall terminate a persons access to connected vehicle service within two business days after the date of receiving a completed request from a driver who meets the requirements of this section.
28226.(a)If a covered provider terminated a persons access to connected vehicle service in response to a connected vehicle service request, the covered provider shall not provide to the person any data or information regarding the driver, the vehicle, or any new connected vehicle service account that was generated after that persons access to the connected vehicle service was terminated.
(b)A covered provider shall ensure that all personal information provided during the process to terminate a persons access to connected vehicle service is handled with appropriate security and privacy, adhering to relevant data protection laws and regulations.
(c)A covered provider and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a driver pursuant to this article as confidential and shall comply with applicable privacy laws.
(d)A covered provider shall not share information submitted by a driver pursuant to this article with any third party without the affirmative consent of the driver, unless sharing that information is required to effectuate a connected vehicle service request.
(e)Nothing in this section shall preclude a covered provider from responding to a court order or warrant.
28228.The termination of connected vehicle service pursuant to this article shall not be deemed to impact legal ownership of a vehicle.
3.Disabling Connected Vehicle Location Access28240.If a vehicle includes connected vehicle location access, a covered provider shall provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access.
28242.A mechanism for disabling connected vehicle location access shall meet all of the following requirements:
(a)Be prominently located and easy to use.
(b)Not require access to, or use of, a remote or online application.
(c)(1)Not require account creation, a password, or login information.
(2)A vehicle manufacturer may require a driver to input a mobile number associated with the connected vehicle service account. If a vehicle manufacturer requires a driver to input a mobile number in order to disable the connected vehicle location access connection, it shall not require any further information in order to allow the driver to disable the connection, including, but not limited to, using that number as part of a two-factor authentication process that results in sending a code to the mobile number.
(d)Allow connected vehicle location access that has been disabled from inside the vehicle to be enabled only by a driver who is located inside the vehicle.
28244.Disabling the connected vehicle location access from inside the vehicle shall not result in an account holder of the connected vehicle service, vehicle manufacturer, or a third-party service provider receiving any notification related to the connected vehicle location access being disabled, including, but not limited to, an alert, email, text, or telephone call.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, dating violence, sexual assault, human trafficking, and related abuse are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources, options, and meaningful support when establishing independence from an abuser, including the barriers of financial insecurity and limited access to reliable means to maintain essential connections with family, social safety networks, employers, and support services. Abuse survivors may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological and communication tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and use other means of electronically or remotely controlling the vehicle. Tracking can be viewed in real time, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access through such technologies as mobile phone wireless connectivity and location data capabilities that are manufactured into vehicles.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)According to privacy researchers and as reported in the New York Times, Modern vehicles have been called smartphones with wheels because they are internet-connected and have myriad methods of data collection, from cameras and seat weight sensors to records of how hard you brake and corner. Most drivers dont realize how much information their cars are collecting and who has access to it.
(g)Under the federal Safe Connections Act of 2022, survivors of domestic abuse are empowered to protect themselves and their loved ones by requiring telecommunications providers, upon request, to separate their mobile phone accounts from the accounts of their abusers, but the law does not extend to vehicular technology.
(h)It is the intent of this act to end stalking and abuse by abusive partners who can access connected vehicle service.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Connected Vehicle Service1.General Provisions28200.Unless the context requires otherwise, for purposes of this chapter, the following terms have the following meanings:
(a)Account holder means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
(b)Connected vehicle location access is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
(c)Connected vehicle service means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(d)Connected vehicle service account means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
(e)Connected vehicle service request means a request by a driver to terminate a persons access to connected vehicle service.
(f)Covered provider means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service.
28202.(a)A vehicle with connected vehicle service shall clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either of the following:
(1)Connected vehicle service.
(2)Connected vehicle location access.
(b)This section shall become operative on January 1, 2028.
28204.The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
28206.(a)This article, except Section 28202, and Article 2 (commencing with Section 28220) shall become operative on July 1, 2025, and apply to vehicles that have connected vehicle service.
(b)Article 3 (commencing with Section 28240) shall become operative as follows:
(1)On January 1, 2028, for vehicles manufactured on or after January 1, 2028, that have connected vehicle location access.
(2)On July 1, 2026, for vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates that provide for the functionality required by Article 3 (commencing with Section 28240).
(c)This chapter does not apply to vehicles owned or operated by a rental company, as defined in Section 1939.01 of the Civil Code.
28210.A covered provider or any officer, director, employee, vendor, or agent of a covered provider shall not be subject to liability for any claims deriving from an action taken in compliance with this chapter.
2.Access to Connected Vehicle Service28220.(a)A covered provider shall provide a process that includes a prominent and clearly visible link entitled HOW TO DISCONNECT REMOTE VEHICLE ACCESS on its internet website to complete both of the following transactions:
(1)Submit a connected vehicle service request.
(2)Obtain a new connected vehicle service account.
(b)A covered provider shall ensure that all communications provided pursuant to this article are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout the process for submitting a connected vehicle service request or obtaining a new connected vehicle service account.
28222.To enhance transparency and communication, the process to submit a connected vehicle service request or obtain a new connected vehicle service account shall be efficient, secure, user-friendly, and include all of the following features:
(a)Upon submission of a connected vehicle service request or request to obtain a new connected vehicle service account, the covered provider shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(b)Upon completing the review of the request, the covered provider shall inform the driver of the action taken, including, as applicable, whether a persons access to connected vehicle service has been terminated, or if additional information or proof of legal possession of the vehicle is needed. This alert shall clearly state any relevant details or further actions required from the driver to complete a successful connected vehicle service request.
(c)If a connected vehicle service request is approved, the covered provider shall provide the driver with a clear explanation and guidance on how to create their own connected vehicle service account, if applicable, to ensure that the driver can maintain control over the connected vehicle service once another persons access to connected vehicle service has been terminated.
28224.(a)A driver shall demonstrate to a covered provider the authority to terminate a persons access to connected vehicle service by providing both of the following:
(1)The vehicle identification number.
(2)Proof of legal possession of the vehicle, which may be a legal title to the vehicle, or a dissolution decree, temporary court order, or domestic violence restraining order that awards possession or exclusive use of the vehicle to the driver. A court order awarding sole possession or exclusive use of a vehicle shall take priority over a vehicle title showing joint ownership for purposes of this article.
(b)A covered provider shall not require a driver to provide any proof of legal possession other than what is required in subdivision (a) to establish the authority to terminate a persons access to connected vehicle service.
(c)A covered provider shall not require a driver to take any action to terminate a persons access to connected vehicle service other than what is set forth in this section, including, but not limited to, requiring any of the following:
(1)Payment of a fee, penalty, or other charge to complete a connected vehicle service request.
(2)Maintaining or extending the term of a connected vehicle service account.
(3)Approval by any account holder, including, but not limited to, the named account holder, of the change in access.
(4)An increase in the rate charged for the connected vehicle service.
(d)A covered provider shall terminate a persons access to connected vehicle service within two business days after the date of receiving a completed request from a driver who meets the requirements of this section.
28226.(a)If a covered provider terminated a persons access to connected vehicle service in response to a connected vehicle service request, the covered provider shall not provide to the person any data or information regarding the driver, the vehicle, or any new connected vehicle service account that was generated after that persons access to the connected vehicle service was terminated.
(b)A covered provider shall ensure that all personal information provided during the process to terminate a persons access to connected vehicle service is handled with appropriate security and privacy, adhering to relevant data protection laws and regulations.
(c)A covered provider and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a driver pursuant to this article as confidential and shall comply with applicable privacy laws.
(d)A covered provider shall not share information submitted by a driver pursuant to this article with any third party without the affirmative consent of the driver, unless sharing that information is required to effectuate a connected vehicle service request.
(e)Nothing in this section shall preclude a covered provider from responding to a court order or warrant.
28228.The termination of connected vehicle service pursuant to this article shall not be deemed to impact legal ownership of a vehicle.
3.Disabling Connected Vehicle Location Access28240.If a vehicle includes connected vehicle location access, a covered provider shall provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access.
28242.A mechanism for disabling connected vehicle location access shall meet all of the following requirements:
(a)Be prominently located and easy to use.
(b)Not require access to, or use of, a remote or online application.
(c)(1)Not require account creation, a password, or login information.
(2)A vehicle manufacturer may require a driver to input a mobile number associated with the connected vehicle service account. If a vehicle manufacturer requires a driver to input a mobile number in order to disable the connected vehicle location access connection, it shall not require any further information in order to allow the driver to disable the connection, including, but not limited to, using that number as part of a two-factor authentication process that results in sending a code to the mobile number.
(d)Allow connected vehicle location access that has been disabled from inside the vehicle to be enabled only by a driver who is located inside the vehicle.
28244.Disabling the connected vehicle location access from inside the vehicle shall not result in an account holder of the connected vehicle service, vehicle manufacturer, or a third-party service provider receiving any notification related to the connected vehicle location access being disabled, including, but not limited to, an alert, email, text, or telephone call.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, dating violence, sexual assault, human trafficking, and related abuse are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources, options, and meaningful support when establishing independence from an abuser, including the barriers of financial insecurity and limited access to reliable means to maintain essential connections with family, social safety networks, employers, and support services. Abuse survivors may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological and communication tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and use other means of electronically or remotely controlling the vehicle. Tracking can be viewed in real time, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access through such technologies as mobile phone wireless connectivity and location data capabilities that are manufactured into vehicles.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)According to privacy researchers and as reported in the New York Times, Modern vehicles have been called smartphones with wheels because they are internet-connected and have myriad methods of data collection, from cameras and seat weight sensors to records of how hard you brake and corner. Most drivers dont realize how much information their cars are collecting and who has access to it.
(g)Under the federal Safe Connections Act of 2022, survivors of domestic abuse are empowered to protect themselves and their loved ones by requiring telecommunications providers, upon request, to separate their mobile phone accounts from the accounts of their abusers, but the law does not extend to vehicular technology.
(h)It is the intent of this act to end stalking and abuse by abusive partners who can access connected vehicle service.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Connected Vehicle Service1.General Provisions28200.Unless the context requires otherwise, for purposes of this chapter, the following terms have the following meanings:
(a)Account holder means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
(b)Connected vehicle location access is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
(c)Connected vehicle service means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(d)Connected vehicle service account means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
(e)Connected vehicle service request means a request by a driver to terminate a persons access to connected vehicle service.
(f)Covered provider means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service.
28202.(a)A vehicle with connected vehicle service shall clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either of the following:
(1)Connected vehicle service.
(2)Connected vehicle location access.
(b)This section shall become operative on January 1, 2027. 2028.
28204.The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
28206.(a)This article, except Section 28202, and Article 2 (commencing with Section 28220) shall become operative on January July 1, 2025, and apply to vehicles that have connected vehicle service.
(b)Article 3 (commencing with Section 28240) shall become operative on January 1, 2026, and applies to vehicles manufactured on or after January 1, 2026, that have connected vehicle location access. Article 3 (commencing with Section 28240) also applies to vehicles manufactured prior to January 1, 2026, that have connected vehicle location access, and have the capability to receive software updates to disable connected vehicle location access.(b)Article 3 (commencing with Section 28240) shall become operative as follows:
(1)On January 1, 2028, for vehicles manufactured on or after January 1, 2028, that have connected vehicle location access.
(2)On July 1, 2026, for vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates that provide for the functionality required by Article 3 (commencing with Section 28240).
(c)This chapter does not apply to vehicles owned or operated by a rental company, as defined in Section 1939.01 of the Civil Code.
28210.A covered provider or any officer, director, employee, vendor, or agent of a covered provider shall not be subject to liability for any claims deriving from an action taken in compliance with this chapter.
2.Access to Connected Vehicle Service28220.(a)A covered provider shall provide a process that includes a prominent and clearly visible link entitled HOW TO DISCONNECT REMOTE VEHICLE ACCESS on its internet website to complete both of the following transactions:
(1)Submit a connected vehicle service request.
(2)Obtain a new connected vehicle service account.
(b)A covered provider shall ensure that all communications provided pursuant to this article are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout the process for submitting a connected vehicle service request or obtaining a new connected vehicle service account.
28222.To enhance transparency and communication, the process to submit a connected vehicle service request or obtain a new connected vehicle service account shall be efficient, secure, user-friendly, and include all of the following features:
(a)Upon submission of a connected vehicle service request or request to obtain a new connected vehicle service account, the covered provider shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(b)Upon completing the review of the request, the covered provider shall inform the driver of the action taken, including, as applicable, whether a persons access to connected vehicle service has been terminated, or if additional information or proof of legal possession of the vehicle is needed. This alert shall clearly state any relevant details or further actions required from the driver to complete a successful connected vehicle service request.
(c)If a connected vehicle service request is approved, the covered provider shall provide the driver with a clear explanation and guidance on how to create their own connected vehicle service account, if applicable, to ensure that the driver can maintain control over the connected vehicle service once another persons access to connected vehicle service has been terminated.
28224.(a)A driver shall demonstrate to a covered provider the authority to terminate a persons access to connected vehicle service by providing both of the following:
(1)The vehicle identification number.
(2)Proof of legal possession of the vehicle, which may be a legal title to the vehicle, or a dissolution decree, temporary court order, or domestic violence restraining order that awards possession or exclusive use of the vehicle to the driver. A court order awarding sole possession or exclusive use of a vehicle shall take priority over a vehicle title showing joint ownership for purposes of this article.
(b)A covered provider shall not require a driver to provide any proof of legal possession other than what is required in subdivision (a) to establish the authority to terminate a persons access to connected vehicle service.
(c)A covered provider shall not require a driver to take any action to terminate a persons access to connected vehicle service other than what is set forth in this section, including, but not limited to, requiring any of the following:
(1)Payment of a fee, penalty, or other charge to complete a connected vehicle service request.
(2)Maintaining or extending the term of a connected vehicle service account.
(3)Approval by any account holder, including, but not limited to, the named account holder, of the change in access.
(4)An increase in the rate charged for the connected vehicle service.
(d)A covered provider shall terminate a persons access to connected vehicle service within two business days after the date of receiving a completed request from a driver who meets the requirements of this section.
28226.(a)If a covered provider terminated a persons access to connected vehicle service in response to a connected vehicle service request, the covered provider shall not provide to the person any data or information regarding the driver, the vehicle, or any new connected vehicle service account that was generated after that persons access to the connected vehicle service was terminated.
(b)A covered provider shall ensure that all personal information provided during the process to terminate a persons access to connected vehicle service is handled with appropriate security and privacy, adhering to relevant data protection laws and regulations.
(c)A covered provider and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a driver pursuant to this article as confidential and shall comply with applicable privacy laws.
(d)A covered provider shall not share information submitted by a driver pursuant to this article with any third party without the affirmative consent of the driver, unless sharing that information is required to effectuate a connected vehicle service request.
(e)Nothing in this section shall preclude a covered provider from responding to a court order or warrant.
28228.The termination of connected vehicle service pursuant to this article shall not be deemed to impact legal ownership of a vehicle.
3.Disabling Connected Vehicle Location Access28240.If a vehicle includes connected vehicle location access, a covered provider shall provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access.
28242.A mechanism for disabling connected vehicle location access shall meet all of the following requirements:
(a)Be prominently located and easy to use.
(b)Not require access to, or use of, a remote or online application.
(c)(1)Not require account creation, a password, or login information.
(2)A vehicle manufacturer may require a driver to input a mobile number associated with the connected vehicle service account. If a vehicle manufacturer requires a driver to input a mobile number in order to disable the connected vehicle location access connection, it shall not require any further information in order to allow the driver to disable the connection, including, but not limited to, using that number as part of a two-factor authentication process that results in sending a code to the mobile number.
(d)Allow connected vehicle location access that has been disabled from inside the vehicle to be enabled only by a driver who is located inside the vehicle.
28244.Disabling the connected vehicle location access from inside the vehicle shall not result in an account holder of the connected vehicle service, vehicle manufacturer, or a third-party service provider receiving any notification related to the connected vehicle location access being disabled, including, but not limited to, an alert, email, text, or telephone call.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, dating violence, sexual assault, and human trafficking human trafficking, and related abuse are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources resources, options, and meaningful support when establishing independence from an abuser or abuser, including the barriers of financial insecurity and limited access to reliable means to maintain essential connections with family, social safety networks, employers, and support services. Abuse survivors may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological and communication tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and use other means of electronically or remotely controlling the vehicle. Tracking can be viewed in real time, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access. access through such technologies as mobile phone wireless connectivity and location data capabilities that are manufactured into vehicles.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)According to privacy researchers and as reported in the New York Times, Modern vehicles have been called smartphones with wheels because they are internet-connected and have myriad methods of data collection, from cameras and seat weight sensors to records of how hard you brake and corner. Most drivers dont realize how much information their cars are collecting and who has access to it.
(g)Under the federal Safe Connections Act of 2022, survivors of domestic abuse are empowered to protect themselves and their loved ones by requiring telecommunications providers, upon request, to separate their mobile phone accounts from the accounts of their abusers, but the law does not extend to vehicular technology.
(f)(h)It is the intent of this act to end stalking and abuse by abusive partners who can access remote vehicle technology. connected vehicle service.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Connected Vehicle Service28200.Unless the context requires otherwise, for purposes of this chapter, the following terms have the following meanings:(a)Connected vehicle service means any capability provided by or on behalf of a motor vehicle manufacturer that enables a person to remotely obtain data from, or send commands to, a covered vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.(b)Connected vehicle service request means a request by a driver to terminate or disable a persons access to a connected vehicle service.(c)Covered connected vehicle service account means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.28202.(a)(1)A vehicle manufacturer that offers a vehicle for sale, rent, or lease in this state that includes connected vehicle service shall do each of the following:(A)Ensure that the connected vehicle service can be immediately disabled by a driver of the vehicle while that driver is inside the vehicle by a method that meets all of the following criteria:(i)The method of disabling the connected vehicle service is prominently located and easy to use and does not require access to a remote, online application.(ii)Upon its use, the method of disabling the connected vehicle service informs the driver of the requirements of subdivision (b).(iii)The method of disabling the connected vehicle service does not require a password or any login information.(iv)Upon its use, the method of disabling the connected vehicle service does not result in the connected vehicle service, vehicle manufacturer, or a third-party service provider sending to the registered or legal owner of the vehicle an email, telephone call, or any other notification related to the connected vehicle service being disabled.(v)Upon its use, the method of disabling the connected vehicle service causes the connected vehicle service to be disabled for a minimum of 48 hours and capable of being reenabled only by the vehicle manufacturer pursuant to subparagraph (B).(B)Reenable the connected vehicle service under either of the following circumstances:(i)The registered or legal owner of the vehicle notifies the manufacturer that the connected vehicle service was disabled in error and a driver has not contacted the vehicle manufacturer to provide the information required by subdivision (b) within 48 hours of the connected vehicle service being disabled.(ii)The driver has requested that the connected vehicle service be reenabled from the vehicle manufacturer.(2)(A)If, for technological reasons, a vehicle manufacturer is unable to comply with paragraph (1), the vehicle manufacturer shall create a conspicuous mechanism that is easy to use by which a driver or the drivers designated person can submit a connected vehicle service request.(B)A vehicle manufacturer shall disable the connected vehicle service within one business day after receiving a connected vehicle service request from a driver.(b)(1)A driver shall submit a connected vehicle service request to a vehicle manufacturer pursuant to subdivision (a) of Section 28208 within 48 hours of the date on which the driver used the method of disabling the connected vehicle service pursuant to subdivision (a), which shall include the vehicle identification number of the vehicle and a copy of any of the following documents that supports that a person has committed, or allegedly committed, domestic violence against the driver or an individual in the drivers care:(A)A signed affidavit from any of the following individuals acting within the scope of that persons employment:(i)A licensed medical or mental health care provider.(ii)A licensed military medical or mental health care provider.(iii)A licensed social worker.(iv)A victim services provider.(v)A licensed military victim services provider.(B)A police report.(C)A statement provided by the police, including military police, to a magistrate judge or other judge.(D)A charging document.(E)A protective or restraining order, including military protective orders.(2)Following the submission of the documentation pursuant to paragraph (1), a driver shall, within 30 days, provide proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle, and the vehicle identification number of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.(c)A vehicle manufacturer shall terminate a persons access to the connected vehicle service within one business day after the date of receiving a completed request from a driver who meets the requirements of subdivision (b). A vehicle manufacturer shall not require a driver to provide any information other than what is required in subdivision (b) to establish the ability to terminate a persons access to connected vehicle service.(d)A vehicle manufacturer shall notify a driver seeking relief under subdivision (c), in clear and accessible language, that the vehicle manufacturer may contact the driver, or the designated representative of the driver, to confirm a persons access to the connected vehicle service has been terminated.(e)This section does not authorize or require a vehicle manufacturer to verify ownership of a vehicle, the identity of a driver, or the authenticity of information that is submitted by the driver.28204.A vehicle manufacturer shall provide a notification inside of a vehicle that is installed with connected vehicle service that shows if the connected vehicle service is being used.28206.A vehicle manufacturer shall provide information on its internet website and connected vehicle service, in clear and accessible language, on the process of submitting a connected vehicle service request and obtaining a new covered connected vehicle service account.28208.(a)To enhance transparency and communication, a vehicle manufacturer shall establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to connected vehicle service pursuant to Section 28202. This online process shall include all of the following features:(1)Confirmation Email. Upon submission of a request, the vehicle manufacturer shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.(2)Action or Resolution Alert. Upon completion of review of the request, the driver shall be informed of the action taken, including the termination of connected vehicle service or if additional information or proof is needed. This alert shall clearly state any relevant details or further actions required from the driver.(3)Explanation and Assistance. In the event of a requests approval, the vehicle manufacturer shall provide the driver with a clear explanation and guidance on how to create their own covered connected vehicle service account, if necessary, to ensure that the driver can maintain control over the connected vehicle service once the persons access to connected vehicle service has been terminated.(b)The vehicle manufacturer shall ensure that all communications are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout this process.(c)The vehicle manufacturer shall ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations.28210.A vehicle manufacturer, dealer, or other provider shall not charge a driver a fee for completing the request pursuant to Section 28202.SEC. 3.The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Connected Vehicle Service1.General Provisions28200.Unless the context requires otherwise, for purposes of this chapter, the following terms have the following meanings:
(a)Account holder means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
(b)Connected vehicle location access is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
(c)Connected vehicle service means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(d)Connected vehicle service account means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
(e)Connected vehicle service request means a request by a driver to terminate a persons access to connected vehicle service.
(f)Covered provider means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service.
28202.(a)A vehicle with connected vehicle service shall clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either of the following:
(1)Connected vehicle service.
(2)Connected vehicle location access.
(b)This section shall become operative on January 1, 2027.
28204.The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
28206.(a)This article, except Section 28202, and Article 2 (commencing with Section 28220) shall become operative on January 1, 2025, and apply to vehicles that have connected vehicle service.
(b)Article 3 (commencing with Section 28240) shall become operative on January 1, 2026, and applies to vehicles manufactured on or after January 1, 2026, that have connected vehicle location access. Article 3 (commencing with Section 28240) also applies to vehicles manufactured prior to January 1, 2026, that have connected vehicle location access, and have the capability to receive software updates to disable connected vehicle location access.
(c)This chapter does not apply to vehicles owned or operated by a rental company, as defined in Section 1939.01 of the Civil Code.
28210.A covered provider or any officer, director, employee, vendor, or agent of a covered provider shall not be subject to liability for any claims deriving from an action taken in compliance with this chapter.
2.Access to Connected Vehicle Service28220.(a)A covered provider shall provide a process that includes a prominent and clearly visible link entitled HOW TO DISCONNECT REMOTE VEHICLE ACCESS on its internet website to complete both of the following transactions:
(1)Submit a connected vehicle service request.
(2)Obtain a new connected vehicle service account.
(b)A covered provider shall ensure that all communications provided pursuant to this article are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout the process for submitting a connected vehicle service request or obtaining a new connected vehicle service account.
28222.To enhance transparency and communication, the process to submit a connected vehicle service request or obtain a new connected vehicle service account shall be efficient, secure, user-friendly, and include all of the following features:
(a)Upon submission of a connected vehicle service request or request to obtain a new connected vehicle service account, the covered provider shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(b)Upon completing the review of the request, the covered provider shall inform the driver of the action taken, including, as applicable, whether a persons access to connected vehicle service has been terminated, or if additional information or proof of legal possession of the vehicle is needed. This alert shall clearly state any relevant details or further actions required from the driver to complete a successful connected vehicle service request.
(c)If a connected vehicle service request is approved, the covered provider shall provide the driver with a clear explanation and guidance on how to create their own connected vehicle service account, if applicable, to ensure that the driver can maintain control over the connected vehicle service once another persons access to connected vehicle service has been terminated.
28224.(a)A driver shall demonstrate to a covered provider the authority to terminate a persons access to connected vehicle service by providing both of the following:
(1)The vehicle identification number.
(2)Proof of legal possession of the vehicle, which may be a legal title to the vehicle, or a dissolution decree, temporary court order, or domestic violence restraining order that awards possession or exclusive use of the vehicle to the driver. A court order awarding sole possession or exclusive use of a vehicle shall take priority over a vehicle title showing joint ownership for purposes of this article.
(b)A covered provider shall not require a driver to provide any proof of legal possession other than what is required in subdivision (a) to establish the authority to terminate a persons access to connected vehicle service.
(c)A covered provider shall not require a driver to take any action to terminate a persons access to connected vehicle service other than what is set forth in this section, including, but not limited to, requiring any of the following:
(1)Payment of a fee, penalty, or other charge to complete a connected vehicle service request.
(2)Maintaining or extending the term of a connected vehicle service account.
(3)Approval by any account holder, including, but not limited to, the named account holder, of the change in access.
(4)An increase in the rate charged for the connected vehicle service.
(d)A covered provider shall terminate a persons access to connected vehicle service within two business days after the date of receiving a completed request from a driver who meets the requirements of this section.
28226.(a)If a covered provider terminated a persons access to connected vehicle service in response to a connected vehicle service request, the covered provider shall not provide to the person any data or information regarding the driver, the vehicle, or any new connected vehicle service account that was generated after that persons access to the connected vehicle service was terminated.
(b)A covered provider shall ensure that all personal information provided during the process to terminate a persons access to connected vehicle service is handled with appropriate security and privacy, adhering to relevant data protection laws and regulations.
(c)A covered provider and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a driver pursuant to this article as confidential and shall comply with applicable privacy laws.
(d)A covered provider shall not share information submitted by a driver pursuant to this article with any third party without the affirmative consent of the driver, unless sharing that information is required to effectuate a connected vehicle service request.
28228.The termination of connected vehicle service pursuant to this article shall not be deemed to impact legal ownership of a vehicle.
3.Disabling Connected Vehicle Location Access28240.If a vehicle includes connected vehicle location access, a covered provider shall provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access.
28242.A mechanism for disabling connected vehicle location access shall meet all of the following requirements:
(a)Be prominently located and easy to use.
(b)Not require access to, or use of, a remote or online application.
(c)(1)Not require account creation, a password, or login information.
(2)A vehicle manufacturer may require a driver to input a mobile number associated with the connected vehicle service account. If a vehicle manufacturer requires a driver to input a mobile number in order to disable the connected vehicle location access connection, it shall not require any further information in order to allow the driver to disable the connection, including, but not limited to, using that number as part of a two-factor authentication process that results in sending a code to the mobile number.
(d)Allow connected vehicle location access that has been disabled from inside the vehicle to be enabled only by a driver who is located inside the vehicle.
28244.Disabling the connected vehicle location access from inside the vehicle shall not result in an account holder of the connected vehicle service, vehicle manufacturer, or a third-party service provider receiving any notification related to the connected vehicle location access being disabled, including, but not limited to, an alert, email, text, or telephone call.
SEC. 4.SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, sexual assault, and human trafficking are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources when establishing independence from an abuser or may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and other means of electronically or remotely controlling the vehicle. Tracking can be viewed in real time, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)It is the intent of this act to end stalking and abuse by abusive partners who can access remote vehicle technology.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Remote Vehicle Technology Connected Vehicle Service28200.Unless the context requires otherwise, for purposes of this chapter, remote vehicle technology means any technology that allows a person who is outside of a vehicle to track the location of, or control any operation of, the vehicle, and includes, but is not limited to, a Global Positioning System (GPS) that tracks the location of the vehicle or an app-based technology that controls any operation of the vehicle. chapter, the following terms have the following meanings:
(a)Connected vehicle service means any capability provided by or on behalf of a motor vehicle manufacturer that enables a person to remotely obtain data from, or send commands to, a covered vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(b)Connected vehicle service request means a request by a driver to terminate or disable a persons access to a connected vehicle service.
(c)Covered connected vehicle service account means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
28202.(a)A (1)A vehicle manufacturer that offers a vehicle for sale, rent, or lease in this state that includes connected vehicle service shall do each of the following:
(A)Ensure that the connected vehicle service can be immediately disabled by a driver of the vehicle while that driver is inside the vehicle by a method that meets all of the following criteria:
(i)The method of disabling the connected vehicle service is prominently located and easy to use and does not require access to a remote, online application.
(ii)Upon its use, the method of disabling the connected vehicle service informs the driver of the requirements of subdivision (b).
(iii)The method of disabling the connected vehicle service does not require a password or any login information.
(iv)Upon its use, the method of disabling the connected vehicle service does not result in the connected vehicle service, vehicle manufacturer, or a third-party service provider sending to the registered or legal owner of the vehicle an email, telephone call, or any other notification related to the connected vehicle service being disabled.
(v)Upon its use, the method of disabling the connected vehicle service causes the connected vehicle service to be disabled for a minimum of 48 hours and capable of being reenabled only by the vehicle manufacturer pursuant to subparagraph (B).
(B)Reenable the connected vehicle service under either of the following circumstances:
(i)The registered or legal owner of the vehicle notifies the manufacturer that the connected vehicle service was disabled in error and a driver has not contacted the vehicle manufacturer to provide the information required by subdivision (b) within 48 hours of the connected vehicle service being disabled.
(ii)The driver has requested that the connected vehicle service be reenabled from the vehicle manufacturer.
(2)(A)If, for technological reasons, a vehicle manufacturer is unable to comply with paragraph (1), the vehicle manufacturer shall create a conspicuous mechanism that is easy to use by which a driver or the drivers designated person can submit a connected vehicle service request.
(B)A vehicle manufacturer shall disable the connected vehicle service within one business day after receiving a connected vehicle service request from a driver.
(b)(1)A driver shall submit a connected vehicle service request to a vehicle manufacturer pursuant to subdivision (a) of Section 28208 within 48 hours of the date on which the driver used the method of disabling the connected vehicle service pursuant to subdivision (a), which shall include the vehicle identification number of the vehicle and a copy of any of the following documents that supports that a person has committed, or allegedly committed, domestic violence against the driver or an individual in the drivers care:
(A)A signed affidavit from any of the following individuals acting within the scope of that persons employment:
(i)A licensed medical or mental health care provider.
(ii)A licensed military medical or mental health care provider.
(iii)A licensed social worker.
(iv)A victim services provider.
(v)A licensed military victim services provider.
(B)A police report.
(C)A statement provided by the police, including military police, to a magistrate judge or other judge.
(D)A charging document.
(E)A protective or restraining order, including military protective orders.
(2)Following the submission of the documentation pursuant to paragraph (1), a driver shall, within 30 days, provide proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle, and the vehicle identification number of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.
(c)A vehicle manufacturer shall terminate a persons access to remote vehicle technology within two business days the connected vehicle service within one business day after the date of receiving a completed request from a driver who meets the requirements of subdivision (b). A vehicle manufacturer shall not require a driver to provide any information other than what is required in subdivision (b) to establish the ability to terminate a persons access to remote vehicle technology. connected vehicle service.
(b)A driver shall demonstrate to a vehicle manufacturer the ability to terminate a persons access to remote vehicle technology by providing proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.(c)(d)A vehicle manufacturer shall notify a driver seeking relief under subdivision (a), (c), in clear and accessible language, that the vehicle manufacturer may contact the driver, or the designated representative of the driver, to confirm a persons access to the remote vehicle technology connected vehicle service has been terminated.
(e)This section does not authorize or require a vehicle manufacturer to verify ownership of a vehicle, the identity of a driver, or the authenticity of information that is submitted by the driver.
28204.A vehicle manufacturer shall provide a notification inside of a vehicle that is installed with remote vehicle technology connected vehicle service that shows if the remote vehicle technology connected vehicle service is being used.
28206.A vehicle manufacturer shall provide information on its internet website and remote vehicle technology applications, connected vehicle service, in clear and accessible language, on the process of terminating a persons access to remote vehicle technology, including, but not limited to, how a driver can demonstrate the ability to terminate a persons access to remote vehicle technology. submitting a connected vehicle service request and obtaining a new covered connected vehicle service account.
28208.(a)To enhance transparency and communication, a vehicle manufacturer shall establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to remote vehicle technology connected vehicle service pursuant to Section 28202. This online process shall include all of the following features:
(1)Confirmation Email. Upon submission of a request, the vehicle manufacturer shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(2)Action or Resolution Alert. Upon completion of review of the request, the driver shall be informed of the action taken, including the termination of remote vehicle access connected vehicle service or if additional information or proof is needed. This alert shall clearly state any relevant details or further actions required from the driver.
(3)Explanation and Assistance. In the event of a requests approval, the vehicle manufacturer shall provide the driver with a clear explanation and guidance on how to create their own app account, covered connected vehicle service account, if necessary, to ensure that the driver can maintain control over the vehicles remote technology connected vehicle service once the persons access to remote vehicle technology connected vehicle service has been terminated.
(b)The vehicle manufacturer shall ensure that all communications are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout this process.
(c)The vehicle manufacturer shall ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations.
28210.A vehicle manufacturer, dealer, or other provider shall not charge a driver a fee for completing the request pursuant to Section 28202.
SEC. 3.The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
SEC. 3.SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, sexual assault, and human trafficking are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources when establishing independence from an abuser or may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and other means of electronically or remotely controlling the vehicle. Tracking can be viewed in real time, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)It is the intent of this act to end stalking and abuse by abusive partners who can access remote vehicle technology.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Remote Vehicle Technology28200.Unless the context requires otherwise, for purposes of this chapter, remote vehicle technology means any technology that allows a person who is outside of a vehicle to track the location of, or control any operation of, the vehicle, and includes, but is not limited to, a Global Positioning System (GPS) that tracks the location of the vehicle or an app-based technology that controls any operation of the vehicle.
28202.(a)A vehicle manufacturer shall terminate a persons access to remote vehicle technology within two business days after the date of receiving a completed request from a driver who meets the requirements of subdivision (b). A vehicle manufacturer shall not require a driver to provide any information other than what is required in subdivision (b) to establish the ability to terminate a persons access to remote vehicle technology.
(b)A driver shall demonstrate to a vehicle manufacturer the ability to terminate a persons access to remote vehicle technology by providing proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.
(c)A vehicle manufacturer shall notify a driver seeking relief under subdivision (a), in clear and accessible language, that the vehicle manufacturer may contact the driver, or the designated representative of the driver, to confirm a persons access to the remote vehicle technology has been terminated.
28204.A vehicle manufacturer shall provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used.
28206.A vehicle manufacturer shall provide information on its internet website and remote vehicle technology applications, in clear and accessible language, on the process of terminating a persons access to remote vehicle technology, including, but not limited to, how a driver can demonstrate the ability to terminate a persons access to remote vehicle technology.
28208.(a)To enhance transparency and communication, a vehicle manufacturer shall establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to remote vehicle technology pursuant to Section 28202. This online process shall include all of the following features:
(1)Confirmation Email. Upon submission of a request, the vehicle manufacturer shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(2)Action or Resolution Alert. Upon completion of review of the request, the driver shall be informed of the action taken, including the termination of remote vehicle access or if additional information or proof is needed. This alert shall clearly state any relevant details or further actions required from the driver.
(3)Explanation and Assistance. In the event of a requests approval, the vehicle manufacturer shall provide the driver with a clear explanation and guidance on how to create their own app account, if necessary, to ensure that the driver can maintain control over the vehicles remote technology once the persons access to remote vehicle technology has been terminated.
(b)The vehicle manufacturer shall ensure that all communications are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout this process.
(c)The vehicle manufacturer shall ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations.
28210.A vehicle manufacturer, dealer, or other provider shall not charge a driver a fee for completing the request pursuant to Section 28202.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, sexual assault, and human trafficking are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources when establishing independence from an abuser or may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and other means of electronically or remotely controlling the vehicle. Tracking can be viewed in realtime, real time, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)It is the intent of this act to end stalking and abuse by abusive partners who can access remote vehicle technology.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Remote Vehicle Technology28200.Unless the context requires otherwise, for purposes of this chapter, remote vehicle technology means any technology that allows a person who is outside of a vehicle to track the location of, or control any operation of, the vehicle, and includes, but is not limited to, a Global Positioning System (GPS) that tracks the location of the vehicle or an app-based technology that controls any operation of the vehicle.
28202.(a)A vehicle manufacturer shall terminate a persons access to remote vehicle technology within two business days after the date of receiving a completed request from a driver who meets the requirements of subdivision (b). A vehicle manufacturer shall not require a driver to provide any information other than what is required in subdivision (b) to establish the ability to terminate a persons access to remote vehicle technology.
(b)A driver shall demonstrate to a vehicle manufacturer the ability to terminate a persons access to remote vehicle technology by providing proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.
(c)A vehicle manufacturer shall notify a driver seeking relief under subdivision (a), in clear and accessible language, that the vehicle manufacturer may contact the driver, or the designated representative of the driver, to confirm a persons access to the remote vehicle technology has been terminated.
28204.A vehicle manufacturer shall provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used.
28206.A vehicle manufacturer shall provide information on its internet website and vehicle internet remote vehicle technology applications, in clear and accessible language, on the process of terminating a persons access to remote vehicle technology, including, but not limited to, how a driver can demonstrate the ability to terminate a persons access to remote vehicle technology.
28208.A vehicle manufacturer shall employ dedicated staff who are trauma-informed to receive and respond to requests made pursuant to Section 28202.28208.(a)To enhance transparency and communication, a vehicle manufacturer shall establish an efficient, secure, and user-friendly online submission process for requests related to terminating a persons access to remote vehicle technology pursuant to Section 28202. This online process shall include all of the following features:
(1)Confirmation Email. Upon submission of a request, the vehicle manufacturer shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(2)Action or Resolution Alert. Upon completion of review of the request, the driver shall be informed of the action taken, including the termination of remote vehicle access or if additional information or proof is needed. This alert shall clearly state any relevant details or further actions required from the driver.
(3)Explanation and Assistance. In the event of a requests approval, the vehicle manufacturer shall provide the driver with a clear explanation and guidance on how to create their own app account, if necessary, to ensure that the driver can maintain control over the vehicles remote technology once the persons access to remote vehicle technology has been terminated.
(b)The vehicle manufacturer shall ensure that all communications are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive support and clear guidance throughout this process.
(c)The vehicle manufacturer shall ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations.
28210.A vehicle manufacturer, dealer, or other provider shall not charge a driver a fee for completing the request pursuant to Section 28202.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
The Legislature finds and declares all of the following:
(a)Domestic abuse, stalking, sexual assault, and human trafficking are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b)Abuse survivors often lack resources when establishing independence from an abuser or may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c)Abusive partners increasingly use technological tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicles climate, lock doors, honk the horn, record video footage and audio, and other means of electronically or remotely controlling the vehicle. Tracking can be viewed in realtime, or location history records can be accessed and reviewed at a later time.
(d)Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access.
(e)Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f)It is the intent of this act to end stalking and abuse by abusive partners who can access remote vehicle technology.
SEC. 2.Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:6.Remote Vehicle Technology28200.Unless the context requires otherwise, for purposes of this chapter, remote vehicle technology means any technology that allows a person who is outside of a vehicle to track the location of, or control any operation of, the vehicle, and includes, but is not limited to, a Global Positioning System (GPS) that tracks the location of the vehicle or an app-based technology that controls any operation of the vehicle.
28202.(a)A vehicle manufacturer shall terminate a persons access to remote vehicle technology within two business days after the date of receiving a completed request from a driver who meets the requirements of subdivision (b). A vehicle manufacturer shall not require a driver to provide any information other than what is required in subdivision (b) to establish the ability to terminate a persons access to remote vehicle technology.
(b)A driver shall demonstrate to a vehicle manufacturer the ability to terminate a persons access to remote vehicle technology by providing proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.
(c)A vehicle manufacturer shall notify a driver seeking relief under subdivision (a), in clear and accessible language, that the vehicle manufacturer may contact the driver, or the designated representative of the driver, to confirm a persons access to the remote vehicle technology has been terminated.
28204.A vehicle manufacturer shall provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used.
28206.A vehicle manufacturer shall provide information on its internet website and vehicle internet applications, in clear and accessible language, on the process of terminating a persons access to remote vehicle technology, including, but not limited to, how a driver can demonstrate the ability to terminate a persons access to remote vehicle technology.
28208.A vehicle manufacturer shall employ dedicated staff who are trauma-informed to receive and respond to requests made pursuant to Section 28202.
28210.A vehicle manufacturer, dealer, or other provider shall not charge a driver a fee for completing the request pursuant to Section 28202.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
|
Date
|
Status
|
|---|---|
| Sep 27, 2024 | Chaptered by Secretary of State. Chapter 655, Statutes of 2024. |
| Sep 27, 2024 | Approved by the Governor. |
| Sep 12, 2024 | Enrolled and presented to the Governor at 3 p.m. |
| Aug 31, 2024 | Assembly amendments concurred in. (Ayes 38. Noes 0. Page 5801.) Ordered to engrossing and enrolling. |
| Aug 31, 2024 | In Senate. Concurrence in Assembly amendments pending. |
| Aug 31, 2024 | Read third time. Passed. (Ayes 76. Noes 1. Page 7113.) Ordered to the Senate. |
| Aug 29, 2024 | Assembly Rule 96 suspended. |
| Aug 29, 2024 | Ordered to third reading. |
| Aug 29, 2024 | Withdrawn from committee. |
| Aug 28, 2024 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on RLS. |
| Aug 27, 2024 | Re-referred to Com. on RLS. pursuant to Assembly Rule 97. |
| Aug 22, 2024 | Read third time and amended. |
| Aug 22, 2024 | Ordered to third reading. |
| Aug 8, 2024 | Ordered to third reading. |
| Aug 8, 2024 | From consent calendar on motion of Assembly Member Aguiar-Curry. |
| Aug 8, 2024 | Read second time. Ordered to consent calendar. |
| Aug 7, 2024 | From committee: Do pass. Ordered to consent calendar. (Ayes 14. Noes 0.) (August 7). |
| Jul 8, 2024 | Read second time and amended. Re-referred to Com. on APPR. |
| Jul 8, 2024 | From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 10. Noes 0.) (July 2). |
| Jun 18, 2024 | June 18 set for first hearing canceled at the request of author. |
| May 28, 2024 | Referred to Com. on P. & C.P. |
| May 9, 2024 | In Assembly. Read first time. Held at Desk. |
| May 9, 2024 | Read third time. Passed. (Ayes 37. Noes 0. Page 3873.) Ordered to the Assembly. |
| May 7, 2024 | Read second time. Ordered to consent calendar. |
| May 6, 2024 | From committee: Be ordered to second reading pursuant to Senate Rule 28.8 and ordered to consent calendar. |
| Apr 26, 2024 | Set for hearing May 6. |
| Apr 24, 2024 | From committee: Do pass and re-refer to Com. on APPR with recommendation: To consent calendar. (Ayes 11. Noes 0. Page 3726.) (April 23). Re-referred to Com. on APPR. |
| Apr 11, 2024 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on JUD. |
| Apr 11, 2024 | Set for hearing April 23. |
| Apr 10, 2024 | From committee: Do pass and re-refer to Com. on JUD. with recommendation: To consent calendar. (Ayes 15. Noes 0. Page 3536.) (April 9). Re-referred to Com. on JUD. |
| Apr 1, 2024 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on TRANS. |
| Mar 6, 2024 | Set for hearing April 9. |
| Feb 29, 2024 | Referred to Coms. on TRANS. and JUD. |
| Feb 20, 2024 | From printer. May be acted upon on or after March 18. |
| Feb 16, 2024 | Introduced. Read first time. To Com. on RLS. for assignment. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 31, 2024 | SB 1394 Min Senate Third Reading By Weber | Assembly Floor |
Passed |
|
| Aug 31, 2024 | Unfinished Business SB1394 Min et al. Concurrence | Senate Floor |
Passed |
|
| Aug 7, 2024 | Do pass. To Consent Calendar. | Assembly Standing Committee on Appropriations |
Passed |
|
| Jul 2, 2024 | Do pass as amended and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
|
| May 9, 2024 | Consent Calendar 2nd SB1394 Min | Senate Floor |
Passed |
|
| Apr 23, 2024 | Do pass, but first be re-referred to the Committee on [Appropriations] with the recommendation: To Consent Calendar | Senate Standing Committee on Judiciary |
Passed |
|
| Apr 9, 2024 | Do pass, but first be re-referred to the Committee on [Judiciary] with the recommendation: To Consent Calendar | Senate Standing Committee on Transportation |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| Alliance For Automotive Innovation | * Neutral | Jul 2, 2024 |
| California Partnership To End Domestic Violence | ** Support | |
| California Women's Law Center | ** Support | |
| Consumer Federation Of California | ** Support | |
| Consumers For Auto Reliability And Safety | ** Support | |
| Crime Victims Alliance | * Support | Jul 2, 2024 |
| Elder Law & Advocacy | ** Support | |
| Electronic Frontier Foundation | ** Support | |
| Electronic Frontier Foundation | * For If Amend | Jul 2, 2024 |
| EndTab | ** Support | |
| Family Violence Appellate Project | ** Support | |
| Junior League of Orange County | ** Support | |
| Junior Leagues of California State Public Affairs Committee | ** Support | |
| Laura's House | ** Support | |
| Laura’s House | ** Support | |
| Legal Aid Foundation of Los Angeles | ** Support | |
| Oakland Privacy | ** Support | |
| Oakland Privacy | * Support | Jul 2, 2024 |
| Public Law Center | ** Support | |
| Radiant Futures | ** Support | |
| Rise Economy | ** Support | |
| Rivian | ** Support | |
| Streets for All | ** Support | |
| UCI Law Domestic Violence Clinic | * Support | Jul 2, 2024 |
| University of California Irvine, Domestic Violence Clinic | ** Support | |
| University of California, Irvine School of Law Domestic Violence Clinic | ** Support | |
| WEAVE | ** Support | |
| Women's Transitional Living Center, INC. | ** Support |
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | SB 1394 |
UNFINISHED BUSINESS
Bill No: SB 1394
Author: Min (D), Ashby (D) and Weber (D)
Amended: 8/28/24
Vote: 21
SENATE TRANSPORTATION COMMITTEE: 15-0, 4/9/24
AYES: Cortese, Niello, Allen, Archuleta, Becker, Blakespear, Dahle, Dodd, Gonzalez, Limón, Newman, Nguyen, Portantino, Seyarto, Umberg
SENATE JUDICIARY COMMITTEE: 11-0, 4/23/24
AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Gonzalez, Laird, Min, Niello, Wahab
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
SENATE FLOOR: 37-0, 5/9/24 (Consent)
AYES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Newman, Nguyen, Niello, Ochoa Bogh, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
NO VOTE RECORDED: Grove, Min, Padilla
ASSEMBLY FLOOR: 64-1, 8/31/24 – Roll call not available
SUBJECT: Access to connected vehicle service
SOURCE: EndTAB
University of California, Irvine School of Law Domestic Violence
Clinic
Consumer Federation of California
DIGEST:
This bill requires vehicle manufacturers to allow drivers to terminate remote access to a vehicle and remote access to the location of a vehicle under specified circumstances.
Assembly Amendments
delay the implementation of the ability to terminate remote access to a vehicle and add a new provision to permit drivers to disable vehicle location access capabilities from inside the vehicle.
ANALYSIS:
Existing law:
Provides various protections to persons who are escaping domestic violence, including providing a means for keeping the names and addresses of abuse survivors confidential in public records.
This bill:
- Beginning July 1, 2025, a vehicle manufacturer shall provide a clearly labelled process on its internet website to submit a connected vehicle service request and to obtain a new connected vehicle service account.
- Upon submission of the request, the manufacturer shall automatically send a confirmation email to the driver. Upon completing the review of the request, the manufacturer shall inform the driver whether the person’s access to connected vehicle service has been terminated or if additional information is needed.
- A driver shall demonstrate to a manufacturer the authority to terminate a person’s access to connected vehicle service by providing both the vehicle identification number and proof of legal possession of the vehicle, which can be legal title, a dissolution decree, or domestic violence restraining order.
- A manufacturer shall terminate a person’s access to connected vehicle service within two business days after the date of receiving a completed request from a driver who meets the specified requirements.
- Beginning January 1, 2028 for vehicles manufactured on or after January 1, 2028 that have connected vehicle location access, or on July 1, 2026 for vehicles manufactured prior to January 1, 2028 that have connected vehicle location access and have the capability to receive software updates that provides the necessary functionality:
- A manufacturer shall provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access.
- A mechanism for disabling connected vehicle location access shall be prominently located, easy to use, not require access to an online application, not require a password or login information, and only allow reenabling of the connected vehicle location access by a driver who is located inside the vehicle.
- Beginning January 1, 2028, requires a vehicle with connected vehicle service to clearly indicate to anyone inside the vehicle when a person outside the vehicle has accessed either connected vehicle service or connected vehicle location access.
Comments
- Author’s Statement. According to the author, “Recognizing the critical safety needs of abuse survivors, this bill creates a mechanism for a driver to disable location tracking from inside the vehicle, and an online process to submit a request to terminate connected vehicle service. SB 1394 will empower survivors with greater control over their privacy and mobility, preventing abusive partners from exploiting vehicle technology as a means of continued abuse.”
- Remote Access Abuse. Vehicles can increasingly be tracked and controlled remotely. This feature provides customers with convenience and safety but can also be abused. Remote tracking and control is established by the vehicle’s registered owner. If an individual is the victim of domestic abuse and leaves with a vehicle registered to the domestic abuser (e.g. a wife leaves with a shared vehicle where the registered owner is the husband), the abuser can track the vehicle and, in some cases, manipulate controls, such as door locks. Some car manufacturers will not allow anyone but the registered owner to disable the tracking or remote access.[1] This risk to domestic violence victims has recently caught the attention of the Federal Communications Commission, whose Chair has questioned the largest automakers asking for details about remote access technology and their plans to support people who have been harassed and stalked by domestic abusers.
- Compromise Achieved. At the beginning of the year there were three bills dealing with remote vehicle access. Two of those bills, AB 3139 (Weber) and SB 1000 (Ashby), have died. This bill represents a compromise among the interest groups, authors, and the Administration. The provisions are similar to the bill that passed the Senate with the addition of a requirement that a driver be able to disable vehicle location access while in the vehicle. This provision has a delayed implementation date of July 1, 2026 or later, depending on the vehicle model.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes
From the Assembly Appropriations Committee: Minor state costs, if any.
SUPPORT: (Verified 8/31/24)
EndTAB (co-source)
University of California, Irvine School of Law Domestic Violence Clinic (co-source)
Consumer Federation of California (co-source)
Consumers For Auto Reliability and Safety
Elder Law & Advocacy
Public Law Center
Rise Economy
Weave
OPPOSITION: (Verified 8/31/24)
None received
Prepared by: Randy Chinn / TRANS. / (916) 651-4121
8/31/24 23:10:27
**** END ****
A December 19, 2023 report by Reuters (“An abused wife took on Tesla over tracking tech. She lost.” by Kristina Cooke and Dan Levine) noted a case where a domestic violence victim sued Tesla for negligence by continuing to provide her husband access to their shared car despite the restraining order against him. ↑
SENATE THIRD READING
STR Bill Id:SB 1394
Author:(Min, et al.)
As Amended Ver:August 28, 2024
Majority vote
SUMMARY
This bill would require a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2028, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2028, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car.
Major Provisions
- Requires auto manufacturers, by July 1, 2025, to develop a clear process for allowing drivers to submit a request to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account.
- Requires a driver to submit documentation demonstrating that they have the authority to terminate a person's access to the connected vehicle service.
- Requires the manufacturer to terminate the service within two business days of receiving the request.
- Requires, beginning January 1, 2028, that new vehicles with connected vehicle location access include a mechanism within the car that allows a driver to disable that access and only allow it to be re-enabled in the same manner.
- Requires that on July 1, 2026, vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, must be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality.
- Allows manufacturers to require a driver to input a mobile phone number associated with the connected vehicle service account in order to disable the location access.
- Prohibits requiring any verification beyond the phone number in order to disable location access, including, but not limited to, the use of a two-factor authentication process.
- Requires, beginning January 1, 2028, that a vehicle with connected vehicle service clearly indicate to a person inside the vehicle that someone outside the vehicle has accessed the connected vehicle service or the connected vehicle location access.
- Exempts vehicles owned or operated by a rental company that is subject to the provisions in Civil Code Section 1393.01.
COMMENTS
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
There are nearly 90 domestic violence related killings in California each year. There were 87 deaths in 2020, 70 were women and 17 were men.[1] The National Domestic Violence Hotline reports that an average of 24 people per minute are victims of rape, physical violence or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime (48.4% and 48.8%, respectively).[2]
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.
Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car's location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car's climate controls; make the horn honk; and turn on its lights. Alongside these advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives.
According to the Author
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates an online process for survivors of domestic abuse to rapidly terminate their abusers remote access to a vehicle and ensure their safety and privacy, and gives survivors access to a vehicle that can be a lifeline to escaping violence and receiving help, free from technology enabled tracking that can put them in danger.
Arguments in Support
The co-sponsors, University of California, Irvine, School of Law Domestic Violence Clinic convey the urgency of enacting legislation in order to protect survivors:
Attorneys and advocates working with domestic violence survivors across California have identified vehicle technology abuse as a dangerous and real threat to survivors' safety. While safe access to a vehicle is often a lifeline for abuse survivors, survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology, including after being granted a civil restraining order. For example, advanced technology features allow abusers to remotely lock and unlock vehicles, start and stop vehicles, adjust safety settings, and record audio and video. Further, abusers can access GPS-tracking data to stalk survivors in real time. Survivors are often unaware that their vehicle is being tracked, which further heightens the danger.
The increasing prevalence of vehicle technology abuse has been the subject of recent national reporting informed by SB 1934's co-sponsor EndTAB. In December of 2023, The New York Times published the article, "Your Car is Tracking You. Abusive Partners May Be Too." In the same month, Reuters published, "An Abused Wife Took on Tesla Over Tracking Tech. She Lost." In both news stories, the carmakers refused to sever the abusers' access from the survivors' vehicle accounts, even though the abused women had court orders. Unfortunately, there are multiple other examples of Mercedes, Tesla, and other car manufacturers refusing to act to protect survivors. SB 1394 provides needed protections and a streamlined process to address this alarming issue.
The California Partnership to End Domestic Violence writes in support of the version of the bill currently in print:
Survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology. Advanced technology features now allow abusers to remotely lock and unlock vehicles, start and stop vehicles, turn off electric charging capability, adjust safety settings, and record audio and video.
[. . .]
California carmakers are currently routinely denying survivors' requests to sever their abusers' remote vehicle access from the survivor's own vehicle. Currently, no carmaker has a formal policy on how to respond to these requests, even when severing access to the car is court-ordered. It is time for California to catch up with rapid technological advances and implement laws that will protect survivors from all forms of domestic abuse.
Arguments in Opposition
None on file.
FISCAL COMMENTS
According to the Appropriations Committee:
Minor state costs, if any.
VOTES
SENATE FLOOR: 37-0-3
YES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Newman, Nguyen, Niello, Ochoa Bogh, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
ABS, ABST OR NV: Grove, Min, Padilla
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wilson
ABS, ABST OR NV: Wicks
ASM APPROPRIATIONS: 14-0-1
YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta
ABS, ABST OR NV: Villapudua
UPDATED
VERSION: August 28, 2024
CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0004845
SENATE THIRD READING
STR Bill Id:SB 1394
Author:(Min, et al.)
As Amended Ver:August 28, 2024
Majority vote
SUMMARY
This bill would require a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2028, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2028, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car.
Major Provisions
- Requires auto manufacturers, by July 1, 2025, to develop a clear process for allowing drivers to submit a request to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account.
- Requires a driver to submit documentation demonstrating that they have the authority to terminate a person's access to the connected vehicle service.
- Requires the manufacturer to terminate the service within two business days of receiving the request.
- Requires, beginning January 1, 2028, that new vehicles with connected vehicle location access include a mechanism within the car that allows a driver to disable that access and only allow it to be re-enabled in the same manner.
- Requires that on July 1, 2026, vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, must be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality.
- Allows manufacturers to require a driver to input a mobile phone number associated with the connected vehicle service account in order to disable the location access.
- Prohibits requiring any verification beyond the phone number in order to disable location access, including, but not limited to, the use of a two-factor authentication process.
- Requires, beginning January 1, 2028, that a vehicle with connected vehicle service clearly indicate to a person inside the vehicle that someone outside the vehicle has accessed the connected vehicle service or the connected vehicle location access.
- Exempts vehicles owned or operated by a rental company that is subject to the provisions in Civil Code Section 1393.01.
COMMENTS
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
There are nearly 90 domestic violence related killings in California each year. There were 87 deaths in 2020, 70 were women and 17 were men.[1] The National Domestic Violence Hotline reports that an average of 24 people per minute are victims of rape, physical violence or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime (48.4% and 48.8%, respectively).[2]
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.
Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car's location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car's climate controls; make the horn honk; and turn on its lights. Alongside these advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives.
According to the Author
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates an online process for survivors of domestic abuse to rapidly terminate their abusers remote access to a vehicle and ensure their safety and privacy, and gives survivors access to a vehicle that can be a lifeline to escaping violence and receiving help, free from technology enabled tracking that can put them in danger.
Arguments in Support
The co-sponsors, University of California, Irvine, School of Law Domestic Violence Clinic convey the urgency of enacting legislation in order to protect survivors:
Attorneys and advocates working with domestic violence survivors across California have identified vehicle technology abuse as a dangerous and real threat to survivors' safety. While safe access to a vehicle is often a lifeline for abuse survivors, survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology, including after being granted a civil restraining order. For example, advanced technology features allow abusers to remotely lock and unlock vehicles, start and stop vehicles, adjust safety settings, and record audio and video. Further, abusers can access GPS-tracking data to stalk survivors in real time. Survivors are often unaware that their vehicle is being tracked, which further heightens the danger.
The increasing prevalence of vehicle technology abuse has been the subject of recent national reporting informed by SB 1934's co-sponsor EndTAB. In December of 2023, The New York Times published the article, "Your Car is Tracking You. Abusive Partners May Be Too." In the same month, Reuters published, "An Abused Wife Took on Tesla Over Tracking Tech. She Lost." In both news stories, the carmakers refused to sever the abusers' access from the survivors' vehicle accounts, even though the abused women had court orders. Unfortunately, there are multiple other examples of Mercedes, Tesla, and other car manufacturers refusing to act to protect survivors. SB 1394 provides needed protections and a streamlined process to address this alarming issue.
The California Partnership to End Domestic Violence writes in support of the version of the bill currently in print:
Survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology. Advanced technology features now allow abusers to remotely lock and unlock vehicles, start and stop vehicles, turn off electric charging capability, adjust safety settings, and record audio and video.
[. . .]
California carmakers are currently routinely denying survivors' requests to sever their abusers' remote vehicle access from the survivor's own vehicle. Currently, no carmaker has a formal policy on how to respond to these requests, even when severing access to the car is court-ordered. It is time for California to catch up with rapid technological advances and implement laws that will protect survivors from all forms of domestic abuse.
Arguments in Opposition
None on file.
FISCAL COMMENTS
According to the Appropriations Committee:
Minor state costs, if any.
VOTES
SENATE FLOOR: 37-0-3
YES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Newman, Nguyen, Niello, Ochoa Bogh, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
ABS, ABST OR NV: Grove, Min, Padilla
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wilson
ABS, ABST OR NV: Wicks
ASM APPROPRIATIONS: 14-0-1
YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta
ABS, ABST OR NV: Villapudua
UPDATED
VERSION: August 28, 2024
CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0004845
SENATE THIRD READING
STR Bill Id:SB 1394
Author:(Min, et al.)
As Amended Ver:August 22, 2024
Majority vote
SUMMARY
This bill would require a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2027, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2026, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car.
Major Provisions
- Requires auto manufacturers to develop a clear process for allowing drivers to submit a requested to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account.
- Requires a driver to submit documentation demonstrating that they have the authority to terminate a person's access to the connected vehicle service.
- Requires the manufacturer to terminate the service within two business days of receiving the request.
- Requires, beginning January 1, 2026, that vehicles with connected vehicle location access include a mechanism within the car that allows a driver to disable that access and only allow it to be re-enabled in the same manner.
- Allows manufacturers to require a driver to input a mobile phone number associated with the connected vehicle service account in order to disable the location access.
- Prohibits requiring any verification beyond the phone number in order to disable location access, including, but not limited to, the use of a two-factor authentication process.
- Requires, beginning January 1, 2027, that a vehicle with connected vehicle service clearly indicate to a person inside the vehicle that someone outside the vehicle has accessed the connected vehicle service or the connected vehicle location access.
- Exempts vehicles owned or operated by a rental company that is subject to the provisions in Civil Code Section 1393.01.
COMMENTS
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
There are nearly 90 domestic violence related killings in California each year. There were 87 deaths in 2020, 70 were women and 17 were men.[1] The National Domestic Violence Hotline reports that an average of 24 people per minute are victims of rape, physical violence or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime (48.4% and 48.8%, respectively).[2]
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.
Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car's location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car's climate controls; make the horn honk; and turn on its lights. Alongside these advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives.
According to the Author
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates an online process for survivors of domestic abuse to rapidly terminate their abusers remote access to a vehicle and ensure their safety and privacy, and gives survivors access to a vehicle that can be a lifeline to escaping violence and receiving help, free from technology enabled tracking that can put them in danger.
Arguments in Support
The co-sponsors, University of California, Irvine, School of Law Domestic Violence Clinic convey the urgency of enacting legislation in order to protect survivors:
Attorneys and advocates working with domestic violence survivors across California have identified vehicle technology abuse as a dangerous and real threat to survivors' safety. While safe access to a vehicle is often a lifeline for abuse survivors, survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology, including after being granted a civil restraining order. For example, advanced technology features allow abusers to remotely lock and unlock vehicles, start and stop vehicles, adjust safety settings, and record audio and video. Further, abusers can access GPS-tracking data to stalk survivors in real time. Survivors are often unaware that their vehicle is being tracked, which further heightens the danger.
The increasing prevalence of vehicle technology abuse has been the subject of recent national reporting informed by SB 1934's co-sponsor EndTAB. In December of 2023, The New York Times published the article, "Your Car is Tracking You. Abusive Partners May Be Too." In the same month, Reuters published, "An Abused Wife Took on Tesla Over Tracking Tech. She Lost." In both news stories, the carmakers refused to sever the abusers' access from the survivors' vehicle accounts, even though the abused women had court orders. Unfortunately, there are multiple other examples of Mercedes, Tesla, and other car manufacturers refusing to act to protect survivors. SB 1394 provides needed protections and a streamlined process to address this alarming issue.
The California Partnership to End Domestic Violence writes in support of the version of the bill currently in print:
Survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology. Advanced technology features now allow abusers to remotely lock and unlock vehicles, start and stop vehicles, turn off electric charging capability, adjust safety settings, and record audio and video.
[. . .]
California carmakers are currently routinely denying survivors' requests to sever their abusers' remote vehicle access from the survivor's own vehicle. Currently, no carmaker has a formal policy on how to respond to these requests, even when severing access to the car is court-ordered. It is time for California to catch up with rapid technological advances and implement laws that will protect survivors from all forms of domestic abuse.
Arguments in Opposition
None on file.
FISCAL COMMENTS
According to the Appropriations Committee:
Minor state costs, if any.
VOTES
SENATE FLOOR: 37-0-3
YES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Newman, Nguyen, Niello, Ochoa Bogh, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
ABS, ABST OR NV: Grove, Min, Padilla
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wilson
ABS, ABST OR NV: Wicks
ASM APPROPRIATIONS: 14-0-1
YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta
ABS, ABST OR NV: Villapudua
UPDATED
VERSION: August 22, 2024
CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0004577
SENATE THIRD READING
STR Bill Id:SB 1394
Author:(Min)
As Amended Ver:July 8, 2024
Majority vote
SUMMARY
This bill would require a vehicle manufacturer that offers a vehicle for sale, rent, or lease in this state that includes connected vehicle service to ensure that the connected vehicle service can be immediately disabled for a period of at least 48 hours by a driver of the vehicle while that driver is inside the vehicle.
Major Provisions
- Requires a vehicle manufacturer to do the following:
- Ensure that the connected vehicle service can be immediately disabled by a driver of that vehicle while the driver is inside the vehicle by a means that meets the following criteria:
- The method is prominently located and easy to use and does not require access to a remote, online application.
- The method of disabling the services informs the driver of the requirements related to keeping the technology disabled.
- The method cannot require a password or any log-in information.
- The method cannot result in the connected vehicle service, vehicle manufacturer or a third-party service provider alerting the owner of the car to the fact that it has been disabled.
- Upon its use the method of disabling the connected vehicle service must remain disabled for a minimum of 48 hours and capable of only being reenabled by the vehicle manufacturer.
- If, for technological reasons, a vehicle manufacturer is unable to comply with the previous requirements, it must create a conspicuous mechanism that is easy to use by which the driver or their designated person can submit a connected vehicle service request. Upon receiving the request, the vehicle manufacturer must disable the connected service within one business day.
- Ensure that the connected vehicle service can be immediately disabled by a driver of that vehicle while the driver is inside the vehicle by a means that meets the following criteria:
- Requires the driver to submit a connected vehicle service request to the manufacturer within 48 hours of the date that the technology was disabled. The request must include the following:
- The vehicle identification number.
- A copy of any of the following documents that supports that a person has committed, or allegedly committed domestic violence against the driver or someone in their care:
- As signed affidavit from any of the following people acting in the scope of their employment:
- A licensed medical or mental health care provider.
- A licensed military medical or mental health care provider.
- A licensed social worker.
- A victim services provider.
- A licensed military victim services provider.
- A police report.
- A statement provided by the police to a magistrate judge or other judge.
- A charging document.
- A protective or restraining order, including military protective orders.
- As signed affidavit from any of the following people acting in the scope of their employment:
- Requires a vehicle manufacturer to provide a notification inside of a vehicle that is installed with a connected vehicle service that shows if it is being used.
COMMENTS
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
There are nearly 90 domestic violence related killings in California each year. There were 87 deaths in 2020, 70 were women and 17 were men.[1] The National Domestic Violence Hotline reports that an average of 24 people per minute are victims of rape, physical violence or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime (48.4% and 48.8%, respectively).[2]
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.
Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car’s location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car’s climate controls; make the horn honk; and turn on its lights. Alongside these advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives.
According to the Author
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates a process for survivors of domestic abuse to rapidly terminate remote access to a vehicle and ensure their safety and privacy.
Arguments in Support
The co-sponsors, University of California, Irvine, School of Law Domestic Violence Clinic convey the urgency of enacting legislation in order to protect survivors:
Attorneys and advocates working with domestic violence survivors across California have identified vehicle technology abuse as a dangerous and real threat to survivors’ safety. While safe access to a vehicle is often a lifeline for abuse survivors, survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology, including after being granted a civil restraining order. For example, advanced technology features allow abusers to remotely lock and unlock vehicles, start and stop vehicles, adjust safety settings, and record audio and video. Further, abusers can access GPS-tracking data to stalk survivors in real time. Survivors are often unaware that their vehicle is being tracked, which further heightens the danger.
The increasing prevalence of vehicle technology abuse has been the subject of recent national reporting informed by SB 1934's co-sponsor EndTAB. In December of 2023, The New York Times published the article, "Your Car is Tracking You. Abusive Partners May Be Too." In the same month, Reuters published, "An Abused Wife Took on Tesla Over Tracking Tech. She Lost." In both news stories, the carmakers refused to sever the abusers' access from the survivors' vehicle accounts, even though the abused women had court orders. Unfortunately, there are multiple other examples of Mercedes, Tesla, and other car manufacturers refusing to act to protect survivors. SB 1394 provides needed protections and a streamlined process to address this alarming issue.
The California Partnership to End Domestic Violence writes in support of the version of the bill currently in print:
Survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology. Advanced technology features now allow abusers to remotely lock and unlock vehicles, start and stop vehicles, turn off electric charging capability, adjust safety settings, and record audio and video.
[. . .]
California carmakers are currently routinely denying survivors’ requests to sever their abusers’ remote vehicle access from the survivor’s own vehicle. Currently, no carmaker has a formal policy on how to respond to these requests, even when severing access to the car is courtordered. It is time for California to catch up with rapid technological advances and implement laws that will protect survivors from all forms of domestic abuse.
Arguments in Opposition
None on file.
FISCAL COMMENTS
According to the Appropriations Committee:
Minor state costs, if any.
VOTES
SENATE FLOOR: 37-0-3
YES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Newman, Nguyen, Niello, Ochoa Bogh, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
ABS, ABST OR NV: Grove, Min, Padilla
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wilson
ABS, ABST OR NV: Wicks
ASM APPROPRIATIONS: 14-0-1
YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta
ABS, ABST OR NV: Villapudua
UPDATED
VERSION: July 8, 2024
CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0003814
Date of Hearing: August 7, 2024
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Buffy Wicks, Chair
SBPCA Bill Id:SB 1394
Author:(Min) – As Amended Ver:July 8, 2024
Policy Committee: | Privacy and Consumer Protection | Vote: | 10 - 0 |
|
| ||
|
|
Urgency: No State Mandated Local Program: Yes Reimbursable: No
SUMMARY:
This bill requires a vehicle manufacturer to ensure each vehicle with connected vehicle service can be manually disabled by a driver. The bill also requires a vehicle manufacturer, upon receiving a substantiated request from a survivor of domestic violence, to terminate another person’s access to a vehicle’s connected vehicle service within one business day.
FISCAL EFFECT:
Minor state costs, if any.
COMMENTS:
- Purpose. According to the author:
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers, but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates a process for survivors of domestic abuse to rapidly terminate remote access to a vehicle and ensure their safety and privacy.
- Background. This is one of three bills currently pending in the Legislature that attempt to help survivors of domestic violence escape the reach of remote vehicle technology and internet-connected devices, which can be used by perpetrators to track, harass, and harm them. One of the bills – SB 1000 (Ashby) – pertains to both internet-connected devices and remote vehicle technology. This bill and AB 3139 (Weber) pertain only to remote vehicle technology. At this point, all three bills contain similar provisions about remote vehicle technology, including requiring a mechanism that any driver can use to immediately and manually disable remote vehicle technology without a password or login information.
This bill also creates a mechanism for a domestic violence survivor to request termination of another person’s access to a vehicle’s connected vehicle service. This provision allows a survivor who has lawful possession of a car but shares legal ownership of the car with someone else (generally the perpetrator of domestic violence) to have the other person’s access to the car’s connected vehicle service terminated. Under the bill, if the survivor substantiates their request with a restraining order, police report, or other specified documentation, the manufacturer must terminate the other person’s access to the connected vehicle service.
Unlike the other two bills referenced above, this bill, SB 1394, does not contain a private right of action or authorization for enforcement by public prosecutors. Instead, it is enforceable through the Vehicle Code, which governs other vehicle safety requirements that car manufacturers must meet. AB 3139 is currently pending the Senate Appropriations Committee. SB 1000 is currently pending in this committee.
Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081
Date of Hearing: July 2, 2024
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Rebecca Bauer-Kahan, Chair
SBPCA Bill Id:SB 1394
Author:(Min) – As Amended Ver:April 11, 2024
AS PROPOSED TO BE AMENDED
SENATE VOTE: 37-0
SUBJECT: Access to remote vehicle technology
SYNOPSIS
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.
Since 2012, when General Motors’ OnStar debuted Family Link, a service that allowed remote users to track their family members and receive alerts about where the car goes, advocates and experts working with survivors of stalking and domestic abuse have warned about the dangers related to allowing this type of technology to be used in cars without offering a way for it to discreetly be turned off by the driver. Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car’s location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car’s climate controls; make the horn honk; and turn on its lights.
As currently in print, this bill is substantially similar to the federal Safe Connections Act (SCA) of 2022 (PL 117-223), which requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. Like the SCA, the purpose of this bill is to require an automobile manufacturer disconnect a vehicle from any remote vehicle technology within two business days of receiving a request from a survivor.
The Committee is concerned that allowing two business days to disconnect the technology is too long in the case where a survivor is in immediate danger and needs to use their vehicle to escape an abuser.
SUMMARY: Requires a vehicle manufacturer to separate access to remote vehicle technology from a vehicle no later than two days after receiving a separation request from a survivor of domestic violence. Specifically, this bill:
- Defines “connected vehicle service” as any capability provided by or on behalf of a motor vehicle manufacturer that enables a person to remotely obtain data from, or send commands to, a covered vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
- Defines “connected vehicle service request” as a request by a driver to terminate or disable a person’s access to a connected vehicle service.
- Defines “covered connected vehicle services account” as an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
- Requires a vehicle manufacturer to do the following:
- Ensure that the connected vehicle service can be immediately disabled by a driver of that vehicle while the driver is inside the vehicle by a means that meets the following criteria:
- The method is prominently located and easy to use and does not require access to a remote, online application.
- The method of disabling the services informs the driver of the requirements related to keeping the technology disabled.
- The method cannot require a password or any log-in information.
- The method cannot result in the connected vehicle service, vehicle manufacturer or a third-party service provider alerting the owner of the car to the fact that it has been disabled.
- Upon its use the method of disabling the connected vehicle service must remain disabled for a minimum of seven days and capable of only being reenabled by the vehicle manufacturer.
- Reenable the connected vehicle service only under the following circumstances:
- The owner of the vehicle notifies the manufacturer that the connected vehicle service was disabled in error and the driver has not contacted the vehicle manufacturer within the seven-day timeframe to provide the information required by the bill.
- The driver requests that the connected vehicle service be reenabled.
- If, for technological reasons, a vehicle manufacturer is unable to comply with the previous requirements, it must create a conspicuous mechanism that is easy to use by which the driver or their designated person can submit a connected vehicle service request.
- Ensure that the connected vehicle service can be immediately disabled by a driver of that vehicle while the driver is inside the vehicle by a means that meets the following criteria:
- Requires the driver to submit a connected vehicle service request to the manufacturer within two days of the date that the technology was disabled. The request must include the following:
- The vehicle identification number.
- A copy of any of the following documents that supports that a person has committed, or allegedly committed domestic violence against the driver or someone in their care:
- As signed affidavit from any of the following people acting in the scope of their employment:
- A licensed medical or mental health care provider.
- A licensed military medical or mental health care provider.
- A licensed social worker.
- A victim services provider.
- A licensed military victim services provider.
- A police report.
- A statement provided by the police to a magistrate judge or other judge.
- A charging document.
- A protective or restraining order, including military protective orders.
- As signed affidavit from any of the following people acting in the scope of their employment:
- Within thirty days following the submission of the documentation in 5), requires a driver to provide proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership. Nothing further shall be required of the driver and no fee may be charged.
- Requires the manufacturer to notify the driver that they may contact the driver to confirm a person’s access to the remote vehicle technology has been terminated.
- Requires a vehicle manufacturer to provide a notification inside of a vehicle that is installed with a connected vehicle service that shows if it is being used.
- Requires a vehicle manufacturer to detail the above process on its website and connected vehicle service application. An efficient, secure, and user-friendly online submission process for requests must be established including the following:
- A confirmation email acknowledging receipt.
- Disclosure of the action taken or of additional information needed.
- If approved, a clear explanation and guidance on how to create their own app account, if necessary, to ensure that the driver can maintain control over the vehicle’s remote technology once the person’s access to remote vehicle technology has been terminated.
- Requires the vehicle manufacturer to adhere to relevant data protection laws and regulations.
- Provides that the provisions of this act are severable.
EXISTING LAW:
- Authorizes a court to issue an ex parte order enjoining a party from molesting, attacking, striking, stalking, threatening, sexually assaulting, battering, credibly impersonating, falsely personating, harassing, telephoning, including, but not limited to, making annoying telephone calls, destroying personal property, contacting, either directly or indirectly, by mail or otherwise, coming within a specified distance of, or disturbing the peace of the other party. “Disturbing the peace of the other party” refers to conduct that, based on the totality of the circumstances, destroys the mental or emotional calm of the other party. This conduct may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. (Fam. Code § 6320.)
- Authorizes an adult person, or a parent or guardian on behalf of a minor or an incapacitated person, to apply to participate in the Safe at Home program by stating that they are a victim of specified conduct, including domestic violence, sexual assault, stalking, human trafficking, child abduction, or elder or dependent adult abuse, or is a household member of a victim, designating the Secretary of State (SOS) as the agent for service of process and receipt of mail, and providing the SOS with any address they wish to be kept confidential. (Gov. Code § 6206(a).)
- Establishes the federal Safe Connections Act (SCA) of 2022, which requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. (PL 117-223).
- Establishes the Safe at Home (SAH) address confidentiality program in order to enable state and local agencies to both accept and respond to requests for public records without disclosing the changed name or address of a victim of domestic violence, sexual assault, or stalking. (Chapter 3.1 (commencing with Section 6205) of Division 7 of Title 1 of the Government Code.)
FISCAL EFFECT: As currently in print, this bill is keyed fiscal.
COMMENTS:
1) Intimate Partner Violence. Nationally more than one-third of women will experience rape, physical violence, and/or stalking by an intimate partner in their lifetime. Nearly 8 million women experience one or more of these abuses by a current or former partner each year. There are nearly 90 domestic violence related killings in California each year. There were 87 deaths in 2020, 70 were women and 17 were men.[1] The National Domestic Violence Hotline reports that an average of 24 people per minute are victims of rape, physical violence or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime (48.4% and 48.8%, respectively).[2]
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.[3] According to Canada’s Battered Women Support Services:
Separation is a common theme found within spousal murder-suicide where half of the cases occur after the couple have either separated (26%), were in the process of separating (9%), or had expressed a desire to separate (15%). . . . The statistics outline the reality that the most dangerous time for a survivor/victim is when she leaves the abusive partner; 77 percent of domestic violence-related homicides occur upon separation and there is a 75 percent increase of violence upon separation for at least two years.[4]
With the omnipresent nature of technology that contains remote geo-location capabilities, especially vehicles, leaving an abuser becomes significantly more difficult if the abuser has online access to the survivor’s location that allows them to track the survivor’s every movement.
2) Technological Abuse. Alongside advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives. In fact, the federal government now recognizes technological abuse as a form of domestic abuse. The Office of Violence against Women housed in the US Department of Justice defines technological abuse as:
An act or pattern of behavior that is intended to harm, threaten, control, stalk, harass, impersonate, exploit, extort, or monitor another person that occurs using any form of technology, including but not limited to: internet enabled devices, online spaces and platforms, computers, mobile devices, cameras and imaging programs, apps, location tracking devices, or communication technologies, or any other emerging technologies.[5]
Specifically, as it relates to this bill and automobile technology, since 2012, when General Motors’ OnStar debuted Family Link, a service that allowed remote users to track their family members and receive alerts about where the car goes, advocates and experts working with survivors of stalking and domestic abuse have warned about the dangers related to allowing this type of technology to be used in cars without offering a way for it to discreetly be turned off by the driver.[6] Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car’s location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car’s climate controls; make the horn honk; and turn on its lights.[7]
According to a recent article in The New York Times, “Domestic violence experts say that these convenience features are being weaponized in abusive relationships, and that car makers have not been willing to assist victims. This is particularly complicated when the victim is a co-owner of the car, or not named on the title.”[8]
3) Purpose of this bill. This bill is partially modelled after the federal Safe Connections Act (SCA) of 2022 (PL 117-223). The SCA requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. Like the SCA, the purpose of this bill is to require an automobile manufacturer to provide a method for disconnecting remote vehicle technology in order to protect survivors of domestic violence and allow them to stop an abuser from either tracking their car remotely or using app enabled technology within the car as a weapon.
4) Author’s statement. According to the author:
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates a process for survivors of domestic abuse to rapidly terminate remote access to a vehicle and ensure their safety and privacy.
5) Federal Communications Commission (FCC) Rulemaking. FCC chair, Jessica Rosenworcel, has called on automakers to help in protecting domestic abuse survivors from the misuse of remote vehicle technology by abusers. As modern vehicles make it increasingly easy for passengers and drivers to access hands-free communication tools, find-your car services, and more, these smart car services can and have been used to stalk, harass, and intimidate survivors of intimate partner violence. Chairwoman Rosenworcel importantly notes, “No survivor of domestic violence and abuse should have to choose between giving up their car and allowing themselves to be stalked and harmed by those who can access its data and connectivity.”[9]
The FCC is currently examining how the agency can use existing law to ensure car manufacturers are taking steps to assist abuse victims and are seeking comment on additional steps the Commission can take to safeguard domestic violence survivors.[10]
6) Analysis. As noted previously, this bill is modeled after federal legislation that allows survivors to have their mobile phones separated from family plans or contracts that are connected to their abuser. This allows survivors to keep their phones and phone numbers. Under that law and this legislation, businesses have two business days to break the connection between devices once the business receives a request accompanied by documentation from a survivor. Arguably, someone escaping violence could turn off their phone while leaving an abuser and wait for the time it takes for the mobile phone carrier to separate the phone from the connected account before turning it back on. However, as discussed in detail in previous sections of this analysis, the most dangerous time in an abusive relationship is when the survivor is attempting to leave. Having access to a vehicle is critical for most survivors during that time. Unfortunately, as currently drafted, this bill allows auto manufacturers the same two business-day period to disconnect the remote vehicle technology. Imagine being a survivor in an increasingly dangerous relationship who needs to flee the Friday before Memorial Day. Under this bill, and two similar bills within this Committee’s jurisdiction, an abuser would have five days to track the person fleeing before the connection is broken. This is likely ample time for an abuser to track down their victim and either harm them more or force them to return to their home.
Three bills modeled after the Safe Connection Act were introduced in the Legislature this year. AB 3139 (Weber) and this bill both initially focused solely on applying the policies established in the Act to allowing survivors of domestic abuse to request that an auto manufacturer disconnect their vehicles from any remote capabilities. As noted above, the manufacturers would be provided with two business days to fulfill the request. The third bill, SB 1000 (Ashby and Rubio), which is also before the Committee, takes the policy solutions in the Safe Connection Act and applies it broadly to all connected devices including home appliances, thermostats, locks, doorbells, vehicles, and any other device that is connected remotely to an application.
When it comes to connectivity in vehicles, the Committee has expressed concern about the delayed time frame in all three bills and has proposed amendments to all of them designed to accomplish three key things:
- The driver must be able to disable the connectivity from inside the car without needing to log into an account or provide a password.
- Disabling the technology cannot result in account-holders or registered owner being notified that it has been disconnected by the driver.
- The survivor must be provided with a grace period that allows her time to get to safety and then gather and submit the documents required to permanently remove the abuser from remote access.
Creating a safe harbor. The intent of these amendments is to provide survivors with the immediate protection they need when using their vehicle to escape escalating violence, while allowing them time to submit the necessary information to an auto manufacturer establishing that even though the survivor may not be the registered owner of the vehicle, they have a right to disconnect the technology. The amendments still require that survivors provide the necessary documentation needed to establish their right to the car. This is intended to ensure that abusers cannot further weaponize the vehicle by disabling the technology in the car and simply claiming that they are the person being abused in the relationship.
7) Proposed Committee amendments. In order to eliminate the waiting period between requesting that the connected service be disabled and the service being turned off, the proposed amendments require that vehicle manufacturers develop a method that allows drivers to disable the connected technology.
Amendment #1 – details the new process and requirements:
28202. (a) (1) A vehicle manufacturer that offers a vehicle for sale, rent, or lease in this state that includes connected vehicle service shall do each of the following:
(A) Ensure that the connected vehicle service can be immediately disabled by a driver of the vehicle while that driver is inside the vehicle by a method that meets all of the following criteria:
(i) The method of disabling the connected vehicle service is prominently located and easy to use and does not require access to a remote, online application.
(ii) Upon its use, the method of disabling the connected vehicle service informs the driver of the requirements of subdivision (b).
(iii) The method of disabling the connected vehicle service does not require a password or any log-in information.
(iv) Upon its use, the method of disabling the connected vehicle service does not result in the connected vehicle service, vehicle manufacturer, or a third-party service provider sending to the registered or legal owner of the vehicle an email, telephone call, or any other notification related to the connected vehicle service being disabled.
(v) Upon its use, the method of disabling the connected vehicle service causes the connected vehicle service to be disabled for a minimum of seven days and capable of being reenabled only by the vehicle manufacturer pursuant to paragraph (2).
(B) Reenable the connected vehicle service under the following circumstances:
(i) The registered or legal owner of the vehicle notifies the manufacturer that the connected vehicle service was disabled in error and a driver has not contacted the vehicle manufacturer to provide the information required by subdivision (b) within seven days of the connected vehicle service being disabled.
(ii) The driver has requested that the connected vehicle service be reenabled from the vehicle manufacturer.
(2) If, for technological reasons, a vehicle manufacturer is unable to comply with paragraph (1), the vehicle manufacturer shall create a conspicuous mechanism that is easy to use by which a driver or the driver’s designated person can submit a connected vehicle service request.
(b) (1) A driver shall submit a connected vehicle service request to a vehicle manufacturer pursuant to subdivision (a) of Section 28208 within two days of the date on which the driver used the method of disabling the connected vehicle service pursuant to paragraph (1) of subdivision (a), which shall include the vehicle identification number of the vehicle and a copy of any of the following documents that supports that a person has committed, or allegedly committed, an act of domestic violence against the driver or an individual in the driver’s care:
(A) A signed affidavit from any of the following individuals acting within the scope of that person’s employment:
(i) A licensed medical or mental health care provider.
(ii) A licensed military medical or mental health care provider.
(iii) A licensed social worker.
(iv) A victim services provider.
(v) A licensed military victim services provider.
(B) A police report.
(C) A statement provided by the police, including military police, to a magistrate judge or other judge.
(D) A charging document.
(E) A protective or restraining order, including military protective orders.
(2) Following the submission of the documentation pursuant to paragraph (1), a driver shall, within 30 days, provide proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.
Amendment #2 – adds the following clarification:
(g) This section does not authorize or require a vehicle manufacturer to verify ownership of a vehicle, the identity of a driver, or the authenticity of information that is submitted by the driver.
Amendment #3 – reduces from two days to one day the timeframe provided to vehicle manufacturers to permanently reset the connected vehicle service after receiving the proper documentation.
In addition the author has requested the following amendments:
Amendment #1 – modifying terms and definitions in the following manner
28200. Unless the context requires otherwise, for purposes of this chapter, “remote vehicle technology” means any technology that allows a person who is outside of a vehicle to track the location of, or control any operation of, the vehicle, and includes, but is not limited to, a Global Positioning System (GPS) that tracks the location of the vehicle or an app-based technology that controls any operation of the vehicle. chapter, the following terms have the following meanings:
(a) “Connected vehicle service” means any capability provided by or on behalf of a motor vehicle manufacturer that enables a person to remotely obtain data from, or send commands to, a covered vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(b) “Connected vehicle service request” means a request by a driver to terminate or disable a person’s access to a connected vehicle service.
(c) “Covered connected vehicle services account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
Amendment #2 – adds a severability clause:
The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
Amendment #3 – replaces the term “remote vehicle technology” with “connected vehicle service” throughout the bill.
8) Larger policy questions. While this bill has the potential to make a significant difference in the lives of those fleeing abusive partners, it raises larger policy considerations related to the invasive nature of technology that would benefit from additional attention. With the proliferation of surveillance and tracking technology, including built in vehicle location technology, tracking devices that can easily be concealed in a car or in someone’s belongings, in home and public surveillance cameras, automated license plate recognition tools, not to mention the ability to track someone using the smartphones that are virtually universal, at what point has surveillance gone too far? Should Californians simply accept the complete loss of privacy as they move through their lives in public and private spaces?
Much like the focus that is being placed on the impact of social media, advancement in artificial technology, and the collection and sale of personal information for profit, constant surveillance by private individuals, businesses, and government has a profound impact on Californians’ lives. Rather than considering the risks of one device or technological advancement at a time, at some point, it might behoove the Legislature, and this Committee in particular, to explore the larger surveillance policy questions, including the dangers associated with the unchecked proliferation of surveillance tools and their impact on Californians’ privacy rights, especially for those who are at risk of abuse.
9) Related legislation. AB 3139 (Weber, 2024) requires the manufacturer of a vehicle with remote vehicle technology allowing the vehicle to be tracked to equip the vehicle with a feature that allows the driver to immediately sever the connection between the vehicle and the remote application. In addition, it prohibits manufacturers from restoring the connection for one week, while allowing a survivor of domestic abuse the opportunity to provide a vehicle separation request accompanied by the required documentation. This bill is currently pending in the Senate Judiciary Committee.
SB 1000 (Ashby and Rubio, 2024) commencing January 1, 2026, would require an account manager, as defined, to deny an abuser, as defined, access to a connected device commencing no later than two days after a device protection request is submitted to the account manager by a victim of that abuser, and would set forth the requirements for a victim to submit a device protection request and the requirements that an account manager make the request available. This bill is currently pending in this Committee.
ARGUMENTS IN SUPPORT:
Writing in support of the version of the bill currently in print, the co-sponsors, University of California, Irvine, School of Law Domestic Violence Clinic convey the urgency of enacting legislation in order to protect survivors:
Attorneys and advocates working with domestic violence survivors across California have identified vehicle technology abuse as a dangerous and real threat to survivors’ safety. While safe access to a vehicle is often a lifeline for abuse survivors, survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology, including after being granted a civil restraining order. For example, advanced technology features allow abusers to remotely lock and unlock vehicles, start and stop vehicles, adjust safety settings, and record audio and video. Further, abusers can access GPS-tracking data to stalk survivors in real time. Survivors are often unaware that their vehicle is being tracked, which further heightens the danger.
The increasing prevalence of vehicle technology abuse has been the subject of recent national reporting informed by SB 1934’s co-sponsor EndTAB. In December of 2023, The New York Times published the article, “Your Car is Tracking You. Abusive Partners May Be Too.” In the same month, Reuters published, “An Abused Wife Took on Tesla Over Tracking Tech. She Lost.” In both news stories, the carmakers refused to sever the abusers’ access from the survivors’ vehicle accounts, even though the abused women had court orders. Unfortunately, there are multiple other examples of Mercedes, Tesla, and other car manufacturers refusing to act to protect survivors. SB 1394 provides needed protections and a streamlined process to address this alarming issue.
The California Partnership to End Domestic Violence writes in support of the version of the bill currently in print:
Survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology. Advanced technology features now allow abusers to remotely lock and unlock vehicles, start and stop vehicles, turn off electric charging capability, adjust safety settings, and record audio and video.
[. . .]
California carmakers are currently routinely denying survivors’ requests to sever their abusers’ remote vehicle access from the survivor’s own vehicle. Currently, no carmaker has a formal policy on how to respond to these requests, even when severing access to the car is courtordered. It is time for California to catch up with rapid technological advances and implement laws that will protect survivors from all forms of domestic abuse.
REGISTERED SUPPORT / OPPOSITION:
Support
EndTAB (co-sponsor)
University of California, Irvine School of Law Domestic Violence Clinic (co-sponsor)
California Partnership to End Domestic Violence
California Women's Law Center
Electronic Frontier Foundation
Family Violence Appellate Project
Laura's House
Oakland Privacy
Rivian
Women's Transitional Living Center, INC.
Opposition
>
Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200
California Partnership to End Domestic Violence. California Domestic Violence Fact Sheet (2022) https://www.cpedv.org/policy-priorities. ↑
The National Domestic Violence Hotline. Domestic Violence Statistics. https://www.thehotline.org/stakeholders/domestic-violence-statistics/. ↑
Will My Partner Be Violent After I Leave? How to predict violence after leaving an abuser. DomesticShelters.org. (Mar. 24, 2017) https://www.domesticshelters.org/articles/safety-planning/will-my-partner-be-violent-after-i-leave. ↑
Eighteen Months After Leaving Domestic Violence is Still the Most Dangerous Time, Battered Women’s Support Services (Jun. 11, 2020) https://www.bwss.org/eighteen-months-after-leaving-domestic-violence-is-still-the-most-dangerous-time/. ↑
Information on the types of domestic violence and the Office of Violence against Women can be found at https://www.justice.gov/ovw/domestic-violence. ↑
Lineman, Tracey. “Connected Car Technology Can Enable Abusers to Track Their Victims,” Motherboard, Tech by Vice (Aug 14, 2018) available at https://www.vice.com/en/article/gy3kw7/internet-connected-car-technology-can-enable-abusers-to-track-victims. ↑
Hill, Kashmir. “Your Car Is Tracking You. Abusive Partners May Be, Too.” The New York Times (Dec. 31, 2023) available at https://www.nytimes.com/2023/12/31/technology/car-trackers-gps-abuse.html. ↑
Ibid. ↑
FCC Media Release (Jan. 11, 2024) https://docs.fcc.gov/public/attachments/DOC-399700A1.pdf. ↑
Miranda, Shauneen. “FCC chairwoman asks that automakers be subject to a domestic abuse law.” Axios (Feb. 28, 2024) https://www.axios.com/2024/02/28/fcc-automakers-proposal-domestic-abuse. ↑
Date of Hearing: July 2, 2024
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Rebecca Bauer-Kahan, Chair
SBPCA Bill Id:SB 1394
Author:(Min) – As Amended Ver:April 11, 2024
AS PROPOSED TO BE AMENDED
SENATE VOTE: 37-0
SUBJECT: Access to remote vehicle technology
SYNOPSIS
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.
Since 2012, when General Motors’ OnStar debuted Family Link, a service that allowed remote users to track their family members and receive alerts about where the car goes, advocates and experts working with survivors of stalking and domestic abuse have warned about the dangers related to allowing this type of technology to be used in cars without offering a way for it to discreetly be turned off by the driver. Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car’s location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car’s climate controls; make the horn honk; and turn on its lights.
As currently in print, this bill is substantially similar to the federal Safe Connections Act (SCA) of 2022 (PL 117-223), which requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. Like the SCA, the purpose of this bill is to require an automobile manufacturer disconnect a vehicle from any remote vehicle technology within two business days of receiving a request from a survivor.
The Committee is concerned that allowing two business days to disconnect the technology is too long in the case where a survivor is in immediate danger and needs to use their vehicle to escape an abuser.
SUMMARY: Requires a vehicle manufacturer to separate access to remote vehicle technology from a vehicle no later than two days after receiving a separation request from a survivor of domestic violence. Specifically, this bill:
- Defines “connected vehicle service” as any capability provided by or on behalf of a motor vehicle manufacturer that enables a person to remotely obtain data from, or send commands to, a covered vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
- Defines “connected vehicle service request” as a request by a driver to terminate or disable a person’s access to a connected vehicle service.
- Defines “covered connected vehicle services account” as an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
- Requires a vehicle manufacturer to do the following:
- Ensure that the connected vehicle service can be immediately disabled by a driver of that vehicle manually while the driver is inside the vehicle by a means that meets the following criteria:
- The method is prominently located and easy to use and does not require access to a remote, online application.
- The method of manually disabling the services informs the driver of the requirements related to keeping the technology disabled.
- The method cannot require a password or any log-in information.
- The method cannot result in the connected vehicle service, vehicle manufacturer or a third-party service provider alerting the owner of the car to the fact that it has been disabled.
- Upon its use the method of disabling the connected vehicle service must remain disabled for a minimum of seven days and capable of only being reenabled by the vehicle manufacturer.
- Reenable the connected vehicle service only under the following circumstances:
- The owner of the vehicle notifies the manufacturer that the connected vehicle service was disabled in error and the driver has not contacted the vehicle manufacturer within the seven-day timeframe to provide the information required by the bill.
- The driver requests that the connected vehicle service be reenabled.
- If, for technological reasons, a vehicle manufacturer is unable to comply with the previous requirements, it must create a conspicuous mechanism that is easy to use by which the driver or their designated person can submit a connected vehicle service request.
- Ensure that the connected vehicle service can be immediately disabled by a driver of that vehicle manually while the driver is inside the vehicle by a means that meets the following criteria:
- Requires the driver to submit a connected vehicle service request to the manufacturer within seven days of the date that the technology was manually disabled. The request must include the following:
- The vehicle identification number.
- A copy of any of the following documents that supports that a person has committed, or allegedly committed domestic violence against the driver or someone in their care:
- As signed affidavit from any of the following people acting in the scope of their employment:
- A licensed medical or mental health care provider.
- A licensed military medical or mental health care provider.
- A licensed social worker.
- A victim services provider.
- A licensed military victim services provider.
- A police report.
- A statement provided by the police to a magistrate judge or other judge.
- A charging document.
- A protective or restraining order, including military protective orders.
- Any other relevant document that is an official record.
- As signed affidavit from any of the following people acting in the scope of their employment:
- Within seven days following the submission of the documentation in 5), requires a driver to provide proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership. Nothing further shall be required of the driver and no fee may be charged.
- Requires the manufacturer to notify the driver that they may contact the driver to confirm a person’s access to the remote vehicle technology has been terminated.
- Requires a vehicle manufacturer to provide a notification inside of a vehicle that is installed with a connected vehicle service that shows if it is being used.
- Requires a vehicle manufacturer to detail the above process on its website and connected vehicle service application. An efficient, secure, and user-friendly online submission process for requests must be established including the following:
- A confirmation email acknowledging receipt.
- Disclosure of the action taken or of additional information needed.
- If approved, a clear explanation and guidance on how to create their own app account, if necessary, to ensure that the driver can maintain control over the vehicle’s remote technology once the person’s access to remote vehicle technology has been terminated.
- Requires the vehicle manufacturer to adhere to relevant data protection laws and regulations.
- Provides that the provisions of this act are severable.
EXISTING LAW:
- Authorizes a court to issue an ex parte order enjoining a party from molesting, attacking, striking, stalking, threatening, sexually assaulting, battering, credibly impersonating, falsely personating, harassing, telephoning, including, but not limited to, making annoying telephone calls, destroying personal property, contacting, either directly or indirectly, by mail or otherwise, coming within a specified distance of, or disturbing the peace of the other party. “Disturbing the peace of the other party” refers to conduct that, based on the totality of the circumstances, destroys the mental or emotional calm of the other party. This conduct may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. (Fam. Code § 6320.)
- Authorizes an adult person, or a parent or guardian on behalf of a minor or an incapacitated person, to apply to participate in the Safe at Home program by stating that they are a victim of specified conduct, including domestic violence, sexual assault, stalking, human trafficking, child abduction, or elder or dependent adult abuse, or is a household member of a victim, designating the Secretary of State (SOS) as the agent for service of process and receipt of mail, and providing the SOS with any address they wish to be kept confidential. (Gov. Code § 6206(a).)
- Establishes the federal Safe Connections Act (SCA) of 2022, which requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. (PL 117-223).
- Establishes the Safe at Home (SAH) address confidentiality program in order to enable state and local agencies to both accept and respond to requests for public records without disclosing the changed name or address of a victim of domestic violence, sexual assault, or stalking. (Chapter 3.1 (commencing with Section 6205) of Division 7 of Title 1 of the Government Code.)
FISCAL EFFECT: As currently in print, this bill is keyed fiscal.
COMMENTS:
1) Intimate Partner Violence. Nationally more than one-third of women will experience rape, physical violence, and/or stalking by an intimate partner in their lifetime. Nearly 8 million women experience one or more of these abuses by a current or former partner each year. There are nearly 90 domestic violence related killings in California each year. There were 87 deaths in 2020, 70 were women and 17 were men.[1] The National Domestic Violence Hotline reports that an average of 24 people per minute are victims of rape, physical violence or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime (48.4% and 48.8%, respectively).[2]
Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.
Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.[3] According to Canada’s Battered Women Support Services:
Separation is a common theme found within spousal murder-suicide where half of the cases occur after the couple have either separated (26%), were in the process of separating (9%), or had expressed a desire to separate (15%). . . . The statistics outline the reality that the most dangerous time for a survivor/victim is when she leaves the abusive partner; 77 percent of domestic violence-related homicides occur upon separation and there is a 75 percent increase of violence upon separation for at least two years.[4]
With the omnipresent nature of technology that contains remote geo-location capabilities, especially vehicles, leaving an abuser becomes significantly more difficult if the abuser has online access to the survivor’s location that allows them to track the survivor’s every movement.
2) Technological Abuse. Alongside advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives. In fact, the federal government now recognizes technological abuse as a form of domestic abuse. The Office of Violence against Women housed in the US Department of Justice defines technological abuse as:
An act or pattern of behavior that is intended to harm, threaten, control, stalk, harass, impersonate, exploit, extort, or monitor another person that occurs using any form of technology, including but not limited to: internet enabled devices, online spaces and platforms, computers, mobile devices, cameras and imaging programs, apps, location tracking devices, or communication technologies, or any other emerging technologies.[5]
Specifically, as it relates to this bill and automobile technology, since 2012, when General Motors’ OnStar debuted Family Link, a service that allowed remote users to track their family members and receive alerts about where the car goes, advocates and experts working with survivors of stalking and domestic abuse have warned about the dangers related to allowing this type of technology to be used in cars without offering a way for it to discreetly be turned off by the driver.[6] Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car’s location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car’s climate controls; make the horn honk; and turn on its lights.[7]
According to a recent article in The New York Times, “Domestic violence experts say that these convenience features are being weaponized in abusive relationships, and that car makers have not been willing to assist victims. This is particularly complicated when the victim is a co-owner of the car, or not named on the title.”[8]
3) Purpose of this bill. This bill is partially modelled after the federal Safe Connections Act (SCA) of 2022 (PL 117-223). The SCA requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. Like the SCA, the purpose of this bill is to require an automobile manufacturer to provide a method for disconnecting remote vehicle technology in order to protect survivors of domestic violence and allow them to stop an abuser from either tracking their car remotely or using app enabled technology within the car as a weapon.
4) Author’s statement. According to the author:
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates a process for survivors of domestic abuse to rapidly terminate remote access to a vehicle and ensure their safety and privacy.
5) Federal Communications Commission (FCC) Rulemaking. FCC chair, Jessica Rosenworcel, has called on automakers to help in protecting domestic abuse survivors from the misuse of remote vehicle technology by abusers. As modern vehicles make it increasingly easy for passengers and drivers to access hands-free communication tools, find-your car services, and more, these smart car services can and have been used to stalk, harass, and intimidate survivors of intimate partner violence. Chairwoman Rosenworcel importantly notes, “No survivor of domestic violence and abuse should have to choose between giving up their car and allowing themselves to be stalked and harmed by those who can access its data and connectivity.”[9]
The FCC is currently examining how the agency can use existing law to ensure car manufacturers are taking steps to assist abuse victims and are seeking comment on additional steps the Commission can take to safeguard domestic violence survivors.[10]
6) Analysis. As noted previously, this bill is modeled after federal legislation that allows survivors to have their mobile phones separated from family plans or contracts that are connected to their abuser. This allows survivors to keep their phones and phone numbers. Under that law and this legislation, businesses have two business days to break the connection between devices once the business receives a request accompanied by documentation from a survivor. Arguably, someone escaping violence could turn off their phone while leaving an abuser and wait for the time it takes for the mobile phone carrier to separate the phone from the connected account before turning it back on. However, as discussed in detail in previous sections of this analysis, the most dangerous time in an abusive relationship is when the survivor is attempting to leave. Having access to a vehicle is critical for most survivors during that time. Unfortunately, as currently drafted, this bill allows auto manufacturers the same two business-day period to disconnect the remote vehicle technology. Imagine being a survivor in an increasingly dangerous relationship who needs to flee the Friday before Memorial Day. Under this bill, and two similar bills within this Committee’s jurisdiction, an abuser would have five days to track the person fleeing before the connection is broken. This is likely ample time for an abuser to track down their victim and either harm them more or force them to return to their home.
Three bills modeled after the Safe Connection Act were introduced in the Legislature this year. AB 3139 (Weber) and this bill both initially focused solely on applying the policies established in the Act to allowing survivors of domestic abuse to request that an auto manufacturer disconnect their vehicles from any remote capabilities. As noted above, the manufacturers would be provided with two business days to fulfill the request. The third bill, SB 1000 (Ashby and Rubio), which is also before the Committee, takes the policy solutions in the Safe Connection Act and applies it broadly to all connected devices including home appliances, thermostats, locks, doorbells, vehicles, and any other device that is connected remotely to an application.
When it comes to connectivity in vehicles, the Committee has expressed concern about the delayed time frame in all three bills and has proposed amendments to all of them designed to accomplish three key things:
- The driver must be able to manually disable the connectivity from inside the car without needing to log into an account or provide a password.
- Disabling the technology cannot result in account-holders or registered owner being notified that it has been disconnected by the driver.
- The survivor must be provided with a grace period that allows her time to get to safety and then gather and submit the documents required to permanently remove the abuser from remote access.
Creating a safe harbor. The intent of these amendments is to provide survivors with the immediate protection they need when using their vehicle to escape escalating violence, while allowing them time to submit the necessary information to an auto manufacturer establishing that even though the survivor may not be the registered owner of the vehicle, they have a right to disconnect the technology. The amendments still require that survivors provide the necessary documentation needed to establish their right to the car. This is intended to ensure that abusers cannot further weaponize the vehicle by manually disabling the technology in the car and simply claiming that they are the person being abused in the relationship.
7) Proposed Committee amendments. In order to eliminate the waiting period between requesting that the connected service be disabled and the service being turned off, the proposed amendments require that vehicle manufacturers develop a method that allows drivers to manually disable the connected technology.
Amendment #1 – details the new process and requirements:
28202. (a) (1) A vehicle manufacturer that offers a vehicle for sale, rent, or lease in this state that includes connected vehicle service shall do each of the following:
(A) Ensure that the connected vehicle service can be immediately disabled by a driver of the vehicle while that driver is inside the vehicle by a method that meets all of the following criteria:
(i) The method of disabling the connected vehicle service is prominently located and easy to use and does not require access to a remote, online application.
(ii) Upon its use, the method of disabling the connected vehicle service informs the driver of the requirements of subdivision (b).
(iii) The method of disabling the connected vehicle service does not require a password or any log-in information.
(iv) Upon its use, the method of disabling the connected vehicle service does not result in the connected vehicle service, vehicle manufacturer, or a third-party service provider sending to the registered or legal owner of the vehicle an email, telephone call, or any other notification related to the connected vehicle service being disabled.
(v) Upon its use, the method of disabling the connected vehicle service causes the connected vehicle service to be disabled for a minimum of seven days and capable of being reenabled only by the vehicle manufacturer pursuant to paragraph (2).
(B) Reenable the connected vehicle service under the following circumstances:
(i) The registered or legal owner of the vehicle notifies the manufacturer that the connected vehicle service was disabled in error and a driver has not contacted the vehicle manufacturer to provide the information required by subdivision (b) within seven days of the connected vehicle service being disabled.
(ii) The driver has requested that the connected vehicle service be reenabled from the vehicle manufacturer.
(2) If, for technological reasons, a vehicle manufacturer is unable to comply with paragraph (1), the vehicle manufacturer shall create a conspicuous mechanism that is easy to use by which a driver or the driver’s designated person can submit a connected vehicle service request.
(b) (1) A driver shall submit a connected vehicle service request to a vehicle manufacturer pursuant to subdivision (a) of Section 28208 within two days of the date on which the driver used the method of disabling the connected vehicle service pursuant to paragraph (1) of subdivision (a), which shall include the vehicle identification number of the vehicle and a copy of any of the following documents that supports that a person has committed, or allegedly committed, an act of domestic violence against the driver or an individual in the driver’s care:
(A) A signed affidavit from any of the following individuals acting within the scope of that person’s employment:
(i) A licensed medical or mental health care provider.
(ii) A licensed military medical or mental health care provider.
(iii) A licensed social worker.
(iv) A victim services provider.
(v) A licensed military victim services provider.
(B) A police report.
(C) A statement provided by the police, including military police, to a magistrate judge or other judge.
(D) A charging document.
(E) A protective or restraining order, including military protective orders.
(2) Following the submission of the documentation pursuant to paragraph (1), a driver shall, within 30 days, provide proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership.
Amendment #2 – adds the following clarification:
(g) This section does not authorize or require a vehicle manufacturer to verify ownership of a vehicle, the identity of a driver, or the authenticity of information that is submitted by the driver.
Amendment #3 – reduces from two days to one day the timeframe provided to vehicle manufacturers to permanently reset the connected vehicle service after receiving the proper documentation.
In addition the author has requested the following amendments:
Amendment #1 – modifying terms and definitions in the following manner
28200. Unless the context requires otherwise, for purposes of this chapter, “remote vehicle technology” means any technology that allows a person who is outside of a vehicle to track the location of, or control any operation of, the vehicle, and includes, but is not limited to, a Global Positioning System (GPS) that tracks the location of the vehicle or an app-based technology that controls any operation of the vehicle. chapter, the following terms have the following meanings:
(a) “Connected vehicle service” means any capability provided by or on behalf of a motor vehicle manufacturer that enables a person to remotely obtain data from, or send commands to, a covered vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(b) “Connected vehicle service request” means a request by a driver to terminate or disable a person’s access to a connected vehicle service.
(c) “Covered connected vehicle services account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
Amendment #2 – adds a severability clause:
The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
8) Larger policy questions. While this bill has the potential to make a significant difference in the lives of those fleeing abusive partners, it raises larger policy considerations related to the invasive nature of technology that would benefit from additional attention. With the proliferation of surveillance and tracking technology, including built in vehicle location technology, tracking devices that can easily be concealed in a car or in someone’s belongings, in home and public surveillance cameras, automated license plate recognition tools, not to mention the ability to track someone using the smartphones that are virtually universal, at what point has surveillance gone too far? Should Californians simply accept the complete loss of privacy as they move through their lives in public and private spaces?
Much like the focus that is being placed on the impact of social media, advancement in artificial technology, and the collection and sale of personal information for profit, constant surveillance by private individuals, businesses, and government has a profound impact on Californians’ lives. Rather than considering the risks of one device or technological advancement at a time, at some point, it might behoove the Legislature, and this Committee in particular, to explore the larger surveillance policy questions, including the dangers associated with the unchecked proliferation of surveillance tools and their impact on Californians’ privacy rights, especially for those who are at risk of abuse.
9) Related legislation. AB 3139 (Weber, 2024) requires the manufacturer of a vehicle with remote vehicle technology allowing the vehicle to be tracked to equip the vehicle with a feature that allows the driver to immediately sever the connection between the vehicle and the remote application. In addition, it prohibits manufacturers from restoring the connection for one week, while allowing a survivor of domestic abuse the opportunity to provide a vehicle separation request accompanied by the required documentation. This bill is currently pending in the Senate Judiciary Committee.
SB 1000 (Ashby and Rubio, 2024) commencing January 1, 2026, would require an account manager, as defined, to deny an abuser, as defined, access to a connected device commencing no later than two days after a device protection request is submitted to the account manager by a victim of that abuser, and would set forth the requirements for a victim to submit a device protection request and the requirements that an account manager make the request available. This bill is currently pending in this Committee.
ARGUMENTS IN SUPPORT:
Writing in support of the version of the bill currently in print, the co-sponsors, University of California, Irvine, School of Law Domestic Violence Clinic convey the urgency of enacting legislation in order to protect survivors:
Attorneys and advocates working with domestic violence survivors across California have identified vehicle technology abuse as a dangerous and real threat to survivors’ safety. While safe access to a vehicle is often a lifeline for abuse survivors, survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology, including after being granted a civil restraining order. For example, advanced technology features allow abusers to remotely lock and unlock vehicles, start and stop vehicles, adjust safety settings, and record audio and video. Further, abusers can access GPS-tracking data to stalk survivors in real time. Survivors are often unaware that their vehicle is being tracked, which further heightens the danger.
The increasing prevalence of vehicle technology abuse has been the subject of recent national reporting informed by SB 1934’s co-sponsor EndTAB. In December of 2023, The New York Times published the article, “Your Car is Tracking You. Abusive Partners May Be Too.” In the same month, Reuters published, “An Abused Wife Took on Tesla Over Tracking Tech. She Lost.” In both news stories, the carmakers refused to sever the abusers’ access from the survivors’ vehicle accounts, even though the abused women had court orders. Unfortunately, there are multiple other examples of Mercedes, Tesla, and other car manufacturers refusing to act to protect survivors. SB 1394 provides needed protections and a streamlined process to address this alarming issue.
The California Partnership to End Domestic Violence writes in support of the version of the bill currently in print:
Survivors are increasingly remotely surveilled and harassed by their abusers through vehicle technology. Advanced technology features now allow abusers to remotely lock and unlock vehicles, start and stop vehicles, turn off electric charging capability, adjust safety settings, and record audio and video.
[. . .]
California carmakers are currently routinely denying survivors’ requests to sever their abusers’ remote vehicle access from the survivor’s own vehicle. Currently, no carmaker has a formal policy on how to respond to these requests, even when severing access to the car is courtordered. It is time for California to catch up with rapid technological advances and implement laws that will protect survivors from all forms of domestic abuse.
REGISTERED SUPPORT / OPPOSITION:
Support
EndTAB (co-sponsor)
University of California, Irvine School of Law Domestic Violence Clinic (co-sponsor)
California Partnership to End Domestic Violence
California Women's Law Center
Electronic Frontier Foundation
Family Violence Appellate Project
Laura's House
Oakland Privacy
Rivian
Women's Transitional Living Center, INC.
Opposition
>
Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200
California Partnership to End Domestic Violence. California Domestic Violence Fact Sheet (2022) https://www.cpedv.org/policy-priorities. ↑
The National Domestic Violence Hotline. Domestic Violence Statistics. https://www.thehotline.org/stakeholders/domestic-violence-statistics/. ↑
Will My Partner Be Violent After I Leave? How to predict violence after leaving an abuser. DomesticShelters.org. (Mar. 24, 2017) https://www.domesticshelters.org/articles/safety-planning/will-my-partner-be-violent-after-i-leave. ↑
Eighteen Months After Leaving Domestic Violence is Still the Most Dangerous Time, Battered Women’s Support Services (Jun. 11, 2020) https://www.bwss.org/eighteen-months-after-leaving-domestic-violence-is-still-the-most-dangerous-time/. ↑
Information on the types of domestic violence and the Office of Violence against Women can be found at https://www.justice.gov/ovw/domestic-violence. ↑
Lineman, Tracey. “Connected Car Technology Can Enable Abusers to Track Their Victims,” Motherboard, Tech by Vice (Aug 14, 2018) available at https://www.vice.com/en/article/gy3kw7/internet-connected-car-technology-can-enable-abusers-to-track-victims. ↑
Hill, Kashmir. “Your Car Is Tracking You. Abusive Partners May Be, Too.” The New York Times (Dec. 31, 2023) available at https://www.nytimes.com/2023/12/31/technology/car-trackers-gps-abuse.html. ↑
Ibid. ↑
FCC Media Release (Jan. 11, 2024) https://docs.fcc.gov/public/attachments/DOC-399700A1.pdf. ↑
Miranda, Shauneen. “FCC chairwoman asks that automakers be subject to a domestic abuse law.” Axios (Feb. 28, 2024) https://www.axios.com/2024/02/28/fcc-automakers-proposal-domestic-abuse. ↑
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | SB 1394 |
CONSENT
Bill No: SB 1394
Author: Min (D)
Amended: 4/11/24
Vote: 21
SENATE TRANSPORTATION COMMITTEE: 15-0, 4/9/24
AYES: Cortese, Niello, Allen, Archuleta, Becker, Blakespear, Dahle, Dodd, Gonzalez, Limón, Newman, Nguyen, Portantino, Seyarto, Umberg
SENATE JUDICIARY COMMITTEE: 11-0, 4/23/24
AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Gonzalez, Laird, Min, Niello, Wahab
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
SUBJECT: Access to remote vehicle technology
SOURCE: Author
DIGEST:
This bill requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology upon request from a driver who establishes proof of legal possession of the vehicle, such as with a domestic violence restraining order awarding possession or exclusive use of the vehicle to the driver.
ANALYSIS: Existing law provides various protections to persons who are escaping domestic violence, including providing a means for keeping the names and addresses of abuse survivors confidential in public records.
This bill:
- Requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology within two business days upon request from a driver who establishes proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession of exclusive use of the vehicle.
- Requires a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used.
- Requires a vehicle manufacturer to provide information on its internet website and apps on the process for terminating access.
- Requires a vehicle manufacturer to establish an online submission process for requests for terminating access.
Comments
- Author’s Statement. According to the author, “We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers, but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates a process for survivors of domestic abuse to rapidly terminate remote access to a vehicle and ensure their safety and privacy.”
- Remote Access Abuse. Vehicles can increasingly be tracked and controlled remotely. This feature provides customers with convenience and safety but can also be abused. Remote tracking and control is established by the vehicle’s registered owner. If an individual is the victim of domestic abuse and leaves with a vehicle registered to the domestic abuser (e.g. a wife leaves with a shared vehicle where the registered owner is the husband), the abuser can track the vehicle and, in some cases, manipulate controls, such as door locks. Some car manufacturers will not allow anyone but the registered owner to disable the tracking or remote access.[1] This risk to domestic violence victims has recently caught the attention of the Federal Communications Commission, whose Chair has questioned the largest automakers asking for details about remote access technology and their plans to support people who have been harassed and stalked by domestic abusers.
- More Work Needed. Automakers have expressed conceptual support for this bill but have concerns about specific provisions. Recent amendments to this bill reflect direct negotiations with the author. Further discussions are needed to resolve concerns about the provision requiring the vehicle manufacturer to provide notifications inside the vehicle if the remote vehicle technology is being used. This seems to be a question of technical feasibility, timing and method of notification.
There are two similar bills being considered this session, SB 1000 (Ashby, 2024) and AB 3139 (Weber, 2024). Automakers raises concerns about inconsistent definitions, operational feasibility, and liability protection.
- No Privacy. Californians have a right to privacy enshrined in the California Constitution, but it is increasingly hard to enforce in the face of tracking technology that follows us on/in our computers, phones, cars, tracking devices like Airtags, and sophisticated public and private camera systems. This bill will make it just a bit easier for victims of domestic violence to keep some distance from their abusers.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes
SUPPORT: (Verified 5/6/24)
California Women's Law Center
Electronic Frontier Foundation
Family Violence Appellate Project
Junior League of Orange County
Junior Leagues of California State Public Affairs Committee
Legal Aid Foundation of Los Angeles
Oakland Privacy
Streets for All
University of California, Irvine School of Law Domestic Violence Clinic
OPPOSITION: (Verified 5/6/24)
None received
Prepared by: Randy Chinn / TRANS. / (916) 651-4121
5/7/24 12:03:51
A December 19, 2023 report by Reuters (“An abused wife took on Tesla over tracking tech. She lost.” by Kristina Cooke and Dan Levine) noted a case where a domestic violence victim sued Tesla for negligence by continuing to provide her husband access to their shared car despite the restraining order against him. ↑
Senator Thomas Umberg, Chair
2023-2024 Regular Session
Bill No: SB 1394 (Author:Min)
Version: April 11, 2024
Hearing Date: April 23, 2024
Fiscal: Yes
Urgency: No
Consultant: CK
SUBJECT
Access to remote vehicle technology
DIGEST
This bill requires a vehicle manufacturer to create a process for terminating a person’s access to remote vehicle technology, as defined, upon a completed request from a driver who establishes proof of legal possession of the vehicle. Upon a successful submission, access shall be terminated within two business days. The bill requires manufacturers to provide a notification inside a vehicle of whether remote vehicle technology is in use.
EXECUTIVE SUMMARY
Domestic violence can take many forms, but generally involve a pattern of behaviors by an abuser to gain and maintain power and control. This can involve emotional abuse, intimidation, economic abuse, coercion and threats, and physical or sexual violence. Abusers can assert control over economic resources, children, and modes of transportation. Escaping domestic violence is often harrowing and beset by fear of being caught or found by the abuser.
With the near ubiquitous nature of connected devices and attendant tracking mechanisms, a new tool for abusers to maintain power and control has caused alarm among survivors and advocates. Research and reporting finds that abusers are increasingly using connected devices in homes and vehicles to harass and terrify their victims even after they have managed to escape.
This bill requires vehicle manufacturers to create a user-friendly online process for terminating a person’s remote access to location tracking technology in a vehicle. A driver is required to provide proof of legal possession of the vehicle, such as a vehicle title or a court order awarding exclusive access. Access must then be terminated within two days. Manufacturers are also required to provide a notification in vehicles with this technology, indicating whether it is in use.
The bill is co-sponsored by the Domestic Violence Clinic at the University of California, Irvine School of Law and Ending Tech-Enabled Abuse (EndTab). It is supported by several advocacy groups, including Streets for All. No timely opposition was received by the Committee. The bill passed out of the Senate Transportation Committee on a 15 to 0 vote.
PROPOSED CHANGES TO THE LAW
Existing law:
- Authorizes a court to issue an ex parte order enjoining a party from molesting, attacking, striking, stalking, threatening, sexually assaulting, battering, credibly impersonating, falsely personating, harassing, telephoning, including, but not limited to, making annoying telephone calls, destroying personal property, contacting, either directly or indirectly, by mail or otherwise, coming within a specified distance of, or disturbing the peace of the other party. “Disturbing the peace of the other party” refers to conduct that, based on the totality of the circumstances, destroys the mental or emotional calm of the other party. This conduct may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. (Fam. Code § 6320.)
- Authorizes an adult person, or a parent or guardian on behalf of a minor or an incapacitated person, to apply to participate in the Safe at Home program by stating that they are a victim of specified conduct, including domestic violence, sexual assault, stalking, human trafficking, child abduction, or elder or dependent adult abuse, or is a household member of a victim, designating the Secretary of State (SOS) as the agent for service of process and receipt of mail, and providing the SOS with any address they wish to be kept confidential. (Gov’t Code § 6206(a).)
This bill:
- Defines “remote vehicle technology” as any technology that allows a person who is outside of a vehicle to track the location of, or control any operation of, the vehicle, and includes, but is not limited to, a Global Positioning System (GPS) that tracks the location of the vehicle or an app-based technology that controls any operation of the vehicle.
- Requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology within two business days after the date of receiving a completed request from a driver, as provided.
- Requires a driver submitting such a request to provide proof of legal possession of the vehicle, such as a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. Legal possession of a vehicle may be established by providing a vehicle title. A court order awarding sole possession or ownership of a vehicle shall take priority over a vehicle title showing joint ownership. Nothing further shall be required of the driver and no fee may be charged.
- Requires the manufacturer to notify the driver that they may contact the driver to confirm a person’s access to the remote vehicle technology has been terminated.
- Requires a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if it is being used.
- Requires a vehicle manufacturer to detail the above process on its website and remote technology application. An efficient, secure, and user-friendly online submission process for requests must be established including the following:
- A confirmation email acknowledging receipt.
- Disclosure of the action taken or of additional information needed.
- If approved, a clear explanation and guidance on how to create their own app account, if necessary, to ensure that the driver can maintain control over the vehicle’s remote technology once the person’s access to remote vehicle technology has been terminated.
- Requires the vehicle manufacturer to adhere to relevant data protection laws and regulations.
COMMENTS
- Technology as a means of abusive control
Smart technology has revolutionized everything in our lives, from our phones, to our cars, and even our thermostats. However, while remote access to many of these connected devices provides unparalleled convenience, it also has increasingly been used a weapon by abusers to maintain control over their victims. One study of the use of device tracking states the scope of the issue:
Intimate partner violence, abuse, and harassment is routinely linked with efforts to monitor and control a targeted person. As new technologies have seeped into everyday life, aggressors have adopted and repurposed them to terrorize, control, and manipulate their current and former partners. When National Public Radio conducted a survey of 72 domestic violence shelters in the United States, they found that 85% of domestic violence workers assisted victims whose abuser tracked them using GPS. The US-based National Network to End Domestic Violence found that 71% of domestic abusers monitor survivors’ computer activities, while 54% tracked survivors’ cell phones with stalkerware. In Australia, the Domestic Violence Resources Centre Victoria conducted a survey in 2013 that found that 82% of victims reported abuse via smartphones and 74% of practitioners reported tracking via applications as often occurring amongst their client base. In Canada, a national survey of anti-violence support workers from 2012 found that 98% of perpetrators used technology to intimidate or threaten their victims, that 72% of perpetrators had hacked the email and social media accounts of the women and girls that they targeted, and that a further 61% had hacked into computers to monitor online activities and extract information. An additional 31% installed computer monitoring software or hardware on their target’s computer.[1]
Given the explosion of connected devices in our homes, the problem has only gotten worse as even when survivors are able to physically escape domestic violence, the abuse continues:
Connected home devices have increasingly cropped up in domestic abuse cases over the past year, according to those working with victims of domestic violence. Those at help lines said more people were calling in the last 12 months about losing control of Wi-Fi-enabled doors, speakers, thermostats, lights and cameras. Lawyers also said they were wrangling with how to add language to restraining orders to cover smart home technology.
. . .
Each said the use of internet-connected devices by their abusers was invasive — one called it a form of “jungle warfare” because it was hard to know where the attacks were coming from. They also described it as an asymmetry of power because their partners had control over the technology — and by extension, over them.
One of the women, a doctor in Silicon Valley, said her husband, an engineer, “controls the thermostat. He controls the lights. He controls the music.” She said, “Abusive relationships are about power and control, and he uses technology.”[2]
The problem of constant surveillance follows victims through their vehicles, too:
San Francisco police Sergeant David Radford contacted Tesla in May 2020 with a request on a case: Could the automaker provide data on an alleged stalker’s remote access to a vehicle?
A woman had come into the station visibly shaken, according to a police report. She told police that her abusive husband, in violation of a restraining order, was stalking and harassing her using the technology in their 2016 Tesla Model X.
The SUV allows owners to remotely access its location and control other features through a smartphone app. She told police she had discovered a metal baseball bat in the back seat — the same bat the husband had previously used to threaten her, the police report stated.
Weeks later, Sergeant Radford asked Tesla (TSLA.O), opens new tab for data that might help the investigation. A Tesla service manager replied that remote-access logs were only available within seven days of the events recorded, according to records in a lawsuit the woman later filed. Radford’s investigation stalled.
Cases of technology-enabled stalking involving cars are emerging as automakers add ever-more-sophisticated features, such as location tracking and remote control of functions such as locking doors or honking the horn, according to interviews with divorce lawyers, private investigators and anti-domestic-violence advocates. Such abusive behavior using other devices, such as phone spyware or tracking devices, has long been a concern, prompting technology companies including Google and Apple to design safeguards into their products.[3]
A similar story was reported by the New York Times:
After almost 10 years of marriage, Christine Dowdall wanted out. Her husband was no longer the charming man she had fallen in love with. He had become narcissistic, abusive and unfaithful, she said. After one of their fights turned violent in September 2022, Ms. Dowdall, a real estate agent, fled their home in Covington, La., driving her Mercedes-Benz C300 sedan to her daughter’s house near Shreveport, five hours away. She filed a domestic abuse report with the police two days later.
Her husband, a Drug Enforcement Administration agent, didn’t want to let her go. He called her repeatedly, she said, first pleading with her to return, and then threatening her. She stopped responding to him, she said, even though he texted and called her hundreds of times.
Ms. Dowdall, 59, started occasionally seeing a strange new message on the display in her Mercedes, about a location-based service called “mbrace.” The second time it happened, she took a photograph and searched for the name online.
“I realized, oh my God, that’s him tracking me,” Ms. Dowdall said.
. . .
A car, to its driver, can feel like a sanctuary. A place to sing favorite songs off key, to cry, to vent or to drive somewhere no one knows you’re going.
But in truth, there are few places in our lives less private.
Modern cars have been called “smartphones with wheels” because they are internet-connected and have myriad methods of data collection, from cameras and seat weight sensors to records of how hard you brake and corner. Most drivers don’t realize how much information their cars are collecting and who has access to it, said Jen Caltrider, a privacy researcher at Mozilla who reviewed the privacy policies of more than 25 car brands and found surprising disclosures, such as Nissan saying it might collect information about “sexual activity.”[4]
The concern is that often the abuser is the named account holder and likely set up and has continued access to the remote location tracking even after the survivor has escaped the situation or even secured a restraining order. Advocates argue updates to the applicable laws need to be updated:
Legal recourse may be limited. Abusers have learned to use smart home technology to further their power and control in ways that often fall outside existing criminal laws, Ms. Becker said. In some cases, she said, if an abuser circulates video taken by a connected indoor security camera, it could violate some states’ revenge porn laws, which aim to stop a former partner from sharing intimate photographs and videos online.
Advocates are beginning to educate emergency responders that when people get restraining orders, they need to ask the judge to include all smart home device accounts known and unknown to victims. Many people do not know to ask about this yet, Ms. Becker said. But even if people get restraining orders, remotely changing the temperature in a house or suddenly turning on the TV or lights may not contravene a no-contact order, she said.[5]
- Allowing survivors of violence to regain control
This bill seeks to provide a tool for survivors to regain control of their lives by regaining control of their vehicles. This bill requires vehicle manufacturers to establish and make clear a process for drivers to terminate a person’s access to the remote vehicle technology installed in the vehicle. To enhance transparency and communication, the manufacturer has to establish an efficient, secure, and user-friendly online submission process for such requests and include specified features that ensure a driver is made aware of the status of the process.
The driver is required to provide proof of legal possession of the vehicle. This can take the form of a dissolution decree, temporary order, or domestic violence restraining order that awards possession or exclusive use of the vehicle. It specifically states that a court order awarding sole possession takes priority over a vehicle title showing joint ownership. The manufacturer cannot ask for additional documentation beyond this or charge the driver a fee.
Upon receiving the request with the required documentation, the manufacturer is required to terminate access within two business days.
To ensure these drivers are on notice of the technology and when it is being used, the bill requires a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used. Concerns have been raised about the technical feasibility of this without some phase-in period. The author has committed to further engagement with stakeholders on this particular issue.
According to the author:
We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers, but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates a process for survivors of domestic abuse to rapidly terminate remote access to a vehicle and ensure their safety and privacy.
Writing in support, the Electronic Frontier Foundation states the need for the bill:
In addition to internet-connected services and app-controlled access, physical location tracking technology allows stalkers and abusers unprecedented access to a person’s location without their knowledge. At EFF, we have been sounding the alarm about this threat to people, especially survivors of domestic abuse. This realm of technology remains an ongoing concern and we steadfastly champion the elevation of the right to privacy and the safeguarding of individuals, valuing these principles over mere property loss.
In situations of domestic violence or abusive environments, an abuser and victim may share car titles, car loans, and car insurance. Once a victim makes the decision to leave a violent relationship or abusive household, they are not thinking their car is yet another tool that their abuser can use against them. Many victims, let alone consumers are not aware that most modern cars are filled with internet-connected services that can track them and also have app controlled capabilities. This enables abusers to continue to surveil and harass their partners. . . .
S.B. 1394 will create a simple and user-friendly online process for a consumer to request termination of another person’s remote access to a car. Additionally, car manufacturers will be required to provide a clear notification on the dashboard of a vehicle that discloses to a driver when someone has continued remote access or is using a connected-app to control their car.
SUPPORT
EndTab (sponsor)
University of California Irvine, Domestic Violence Clinic (sponsor)
California Women's Law Center
Electronic Frontier Foundation
Family Violence Appellate Project
Junior Leagues of California State Public Affairs Committee
Laura’s House
Radiant Futures
Streets for All
OPPOSITION
None received
RELATED LEGISLATION
Pending Legislation: SB 1000 (Ashby, 2024) provides a mechanism for survivors of “covered acts” to regain control of connected devices. These acts include false imprisonment, human trafficking, and other sexual crimes. With verification that a covered act has been committed against the victim and verification of the device as the victim’s or in the victim’s exclusive control or fixed within their home or vehicle, account managers, those in control of device access, must grant a device protection request, essentially denying the abuser access to the connected device. SB 1000 is currently in this Committee.
Prior Legislation: SB 975 (Min, Ch. 989, Stats. 2022) created a non-judicial process for addressing a debt incurred in the name of a debtor through duress, intimidation, threat, force, or fraud of the debtor’s resources or personal information for personal gain. This bill also created a cause of action through which a debtor can enjoin a creditor from holding the debtor personally liable for such “coerced debts” and a cause of action against the perpetrator in favor of the claimant.
PRIOR VOTES:
Senate Transportation Committee (Ayes 15, Noes 0)
**************
Christopher Parsons, et al., The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry (June 12, 2019) Citizen Lab, https://citizenlab.ca/docs/stalkerware-holistic.pdf. All internet citations are current as of April 11, 2024. ↑
Nellie Bowles, Thermostats, Locks and Lights: Digital Tools of Domestic Abuse (June 23, 2018) The New York Times, https://www.nytimes.com/2018/06/23/technology/smart-home-devices-domestic-abuse.html. ↑
Kristina Cooke & Dan Levine, An abused wife took on Tesla over tracking tech. She lost. (December 19, 2023) Reuters, https://www.reuters.com/technology/an-abused-wife-took-tesla-over-tracking-tech-she-lost-2023-12-19/. ↑
Kashmir Hill, Your Car Is Tracking You. Abusive Partners May Be, Too. (December 31, 2023) The New York Times, https://www.nytimes.com/2023/12/31/technology/car-trackers-gps-abuse.html. ↑
Ibid. ↑
SENATE COMMITTEE ON TRANSPORTATION
Senator Dave Cortese, Chair
2023 - 2024 Regular
Bill No: Hearing Date: 4/9/2024
Author: | Min | ||
Version: | 4/1/2024 Amended | ||
Urgency: | No | Fiscal: | Yes |
Consultant: | Randy Chinn | ||
SUBJECT:
DIGEST: This bill requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology upon request from a driver who establishes proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated.
ANALYSIS:
Existing law:
- Provides various protections to persons who are escaping domestic violence, including providing a means for keeping the names and addresses of abuse survivors confidential in public records.
This bill:
- Requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology within two business days upon request from a driver who establishes proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated.
- Requires a vehicle manufacturer to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used.
- Requires a vehicle manufacturer to provide information on its internet website and apps on the process for terminating access.
- Requires a vehicle manufacturer to establish an online submission process for requests for terminating access.
COMMENTS:
- Author’s Statement. “We have known for some time that GPS-tracking technology in cars is being exploited by domestic violence abusers, but unfortunately, some car manufacturers are refusing to act to address this potentially fatal problem. Survivors of abuse should not have to fear technology as a tool for further victimization by abusers who can track and harass them. SB 1394 creates a process for survivors of domestic abuse to rapidly terminate remote access to a vehicle and ensure their safety and privacy.”
- Remote Access Abuse. Vehicles can increasingly be tracked and controlled remotely. This feature provides customers with convenience and safety but can also be abused. Remote tracking and control is established by the vehicle’s registered owner. If an individual is the victim of domestic abuse and leaves with a vehicle registered to the domestic abuser (e.g. a wife leaves with a shared vehicle where the registered owner is the husband), the abuser can track the vehicle and, in some cases, manipulate controls, such as door locks. Some car manufacturers will not allow anyone but the registered owner to disable the tracking or remote access.[1] This risk to domestic violence victims has recently caught the attention of the Federal Communications Commission, whose Chair has questioned the largest automakers asking for details about remote access technology and their plans to support people who have been harassed and stalked by domestic abusers.
- More Work Needed. Automakers have expressed conceptual support for the bill but have concerns about specific provisions. Recent amendments to the bill reflect direct negotiations with the author. Further discussions are needed to resolve concerns about the provision requiring the vehicle manufacturer to provide notifications inside the vehicle if the remote vehicle technology is being used. This seems to be a question of technical feasibility, timing and method of notification.
- No Privacy. Californians have a right to privacy enshrined in the California Constitution, but it is increasingly hard to enforce in the face of tracking technology that follows us on/in our computers, phones, cars, tracking devices like Airtags, and sophisticated public and private camera systems. This bill will make it just a bit easier for victims of domestic violence to keep some distance from their abusers.
- Double Referral. This bill is double referred to the Judiciary Committee.
Related Legislation:
SB 1000 (Ashby) – Limits the use of connected devices by abusers. This bill is pending in the Senate Judiciary Committee.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes
POSITIONS: (Communicated to the committee before noon on Wednesday,
April 3, 2024.)
SUPPORT:
Electronic Frontier Foundation
Junior Leagues of California State Public Affairs Committee
Oakland Privacy
Streets for All
University of California, Irvine School of Law Domestic Violence Clinic
OPPOSITION:
None received
-- END --
A December 19, 2023 report by Reuters (“An abused wife took on Tesla over tracking tech. She lost.” by Kristina Cooke and Dan Levine) noted a case where a domestic violence victim sued Tesla for negligence by continuing to provide her husband access to their shared car despite the restraining order against him. ↑
Discussed in Hearing
24SEC
Senate Floor
13MIN
Assembly Standing Committee on Privacy and Consumer Protection
Bill Co-Author(s):