Bill Text: CA SB1394 | 2023-2024 | Regular Session | Amended
Bill Title: Access to connected vehicle service.
Spectrum: Partisan Bill (Democrat 3-0)
Status: (Enrolled) 2024-08-31 - Assembly amendments concurred in. (Ayes 38. Noes 0.) Ordered to engrossing and enrolling. [SB1394 Detail]
Download: California-2023-SB1394-Amended.html
|
Amended
IN
Assembly
August 28, 2024 |
|
Amended
IN
Assembly
August 22, 2024 |
|
Amended
IN
Assembly
July 08, 2024 |
|
Amended
IN
Senate
April 11, 2024 |
|
Amended
IN
Senate
April 01, 2024 |
CALIFORNIA LEGISLATURE—
2023–2024 REGULAR SESSION
Senate Bill
No. 1394
| Introduced by Senators Min and Ashby and Assembly Member Weber |
February 16, 2024 |
An act to add Chapter 6 (commencing with Section 28200) to Division 12 of the Vehicle Code, relating to vehicles.
LEGISLATIVE COUNSEL'S DIGEST
SB 1394, as amended, Min.
Access to connected vehicle service.
Existing law generally regulates the safety of motor vehicles and the use of certain types of equipment installed in a motor vehicle, and generally makes a violation of these requirements a crime. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would require, beginning on January 1, 2027, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person
who is outside the vehicle has accessed either connected vehicle service or connected vehicle location access, as those terms would be defined. The bill, beginning on January July 1, 2025, for vehicles with connected vehicle service, would further require a covered provider to provide a process for a driver to terminate a person’s access to connected vehicle service, as specified. The bill would require, beginning on January 1, 2026, 2028,
a covered provider to provide, in a vehicle manufactured on or after January 1, 2028,
that has connected vehicle location access, as specified, a mechanism that meets specific requirements and can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. The bill would, beginning on July 1, 2026, apply this provision to vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates, as specified. The bill would define terms for these purposes, including “covered provider,” which would be defined as a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. By establishing new duties on vehicle manufacturers or these entities, this bill would expand the general crime applicable to provisions under the Vehicle
Code, thereby imposing a state-mandated local program.
The bill would also declare the severability of its provisions.
The bill would make legislative findings and declarations in support of its provisions.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Digest Key
Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YESBill Text
The people of the State of California do enact as follows:
SECTION 1.
The Legislature finds and declares all of the following:(a) Domestic abuse, stalking, dating violence, sexual assault, human trafficking, and related abuse are life-threatening issues that have lasting and harmful effects on individuals, families, and communities.
(b) Abuse survivors often lack resources, options, and meaningful support when establishing independence from an abuser, including the barriers of financial insecurity and limited access to reliable means to maintain essential connections with family, social safety networks, employers, and support services. Abuse
survivors may share a car title with an abusive partner, and safe access to an automobile can be a lifeline for an abuse survivor.
(c) Abusive partners increasingly use technological and communication tools to exercise control over, monitor, and abuse their victims. Cases of technology-enabled stalking and abuse involving vehicles are increasing as automakers include app-connected remote access and digital features. Through these apps, abusive partners are tracking, surveilling, and intimidating abuse survivors through location-tracking and remote-control functions to turn on the ignition, adjust the vehicle’s climate, lock doors, turn off electric charging, honk the horn, record video footage and audio, and use other means of electronically or remotely controlling the vehicle. Tracking can be viewed in real time, or location
history records can be accessed and reviewed at a later time.
(d) Tracking often occurs unbeknownst to an abuse victim, who may be unaware that the vehicle is app-connected or that an abusive partner has remote access through such technologies as mobile phone wireless connectivity and location data capabilities that are manufactured into vehicles.
(e) Safeguards within vehicle design and remote access can prevent future abuse, including requiring app-connected and tracking notifications to be designed to provide knowledge of who has vehicular access.
(f) According to privacy researchers and as reported in the New York Times, “Modern vehicles have been called ‘smartphones with wheels’ because they are internet-connected
and have myriad methods of data collection, from cameras and seat weight sensors to records of how hard you brake and corner. Most drivers don’t realize how much information their cars are collecting and who has access to it.”
(g) Under the federal Safe Connections Act of 2022, survivors of domestic abuse are empowered to protect themselves and their loved ones by requiring telecommunications providers, upon request, to separate their mobile phone accounts from the accounts of their abusers, but the law does not extend to vehicular technology.
(h) It is the intent of this act to end stalking and abuse by abusive partners who can access connected vehicle service.
SEC. 2.
Chapter 6 (commencing with Section 28200) is added to Division 12 of the Vehicle Code, to read:CHAPTER 6. Connected Vehicle Service
Article 1. General Provisions
28200.
Unless the context requires otherwise, for purposes of this chapter, the following terms have the following meanings:(a) “Account holder” means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
(b) “Connected vehicle location access” is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a
location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
(c) “Connected vehicle service” means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
(d) “Connected vehicle service account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
(e) “Connected vehicle service request” means a request
by a driver to terminate a person’s access to connected vehicle service.
(f) “Covered provider” means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service.
28202.
(a) A vehicle with connected vehicle service shall clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed either of the following:(1) Connected vehicle service.
(2) Connected vehicle location access.
(b) This section shall become operative on January 1, 2027. 2028.
28204.
The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.28206.
(a) This article, except Section 28202, and Article 2 (commencing with Section 28220) shall become operative on(b)Article 3 (commencing with Section 28240) shall become operative on January 1, 2026, and applies to vehicles manufactured on or after January 1, 2026, that have connected vehicle location access. Article 3 (commencing with Section 28240) also applies to vehicles manufactured prior to January 1,
2026, that have connected vehicle location access, and have the capability to receive software updates to disable connected vehicle location access.
(b) Article 3 (commencing with Section 28240) shall become operative as follows:
(1) On January 1, 2028, for vehicles manufactured on or after January 1, 2028, that have connected vehicle location access.
(2) On July 1, 2026, for vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates that provide for the functionality required by Article 3 (commencing with Section 28240).
(c) This chapter does not apply to vehicles owned or operated by a rental company, as defined in Section 1939.01 of the Civil Code.
28210.
A covered provider or any officer, director, employee, vendor, or agent of a covered provider shall not be subject to liability for any claims deriving from an action taken in compliance with this chapter.Article 2. Access to Connected Vehicle Service
28220.
(a) A covered provider shall provide a process that includes a prominent and clearly visible link entitled “HOW TO DISCONNECT REMOTE VEHICLE ACCESS” on its internet website to complete both of the following transactions:(1) Submit a connected vehicle service request.
(2) Obtain a new connected vehicle service account.
(b) A covered provider shall ensure that all communications provided pursuant to this article are clear, concise, and written in accessible language. It is imperative that drivers, particularly those who are abuse survivors, receive
support and clear guidance throughout the process for submitting a connected vehicle service request or obtaining a new connected vehicle service account.
28222.
To enhance transparency and communication, the process to submit a connected vehicle service request or obtain a new connected vehicle service account shall be efficient, secure, user-friendly, and include all of the following features:(a) Upon submission of a connected vehicle service request or request to obtain a new connected vehicle service account, the covered provider shall automatically send a confirmation email to the driver, acknowledging the receipt of the request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
(b) Upon completing the review of the
request, the covered provider shall inform the driver of the action taken, including, as applicable, whether a person’s access to connected vehicle service has been terminated, or if additional information or proof of legal possession of the vehicle is needed. This alert shall clearly state any relevant details or further actions required from the driver to complete a successful connected vehicle service request.
(c) If a connected vehicle service request is approved, the covered provider shall provide the driver with a clear explanation and guidance on how to create their own connected vehicle service account, if applicable, to ensure that the driver can maintain control over the connected vehicle service once another person’s access to connected vehicle service has been terminated.
28224.
(a) A driver shall demonstrate to a covered provider the authority to terminate a person’s access to connected vehicle service by providing both of the following:(1) The vehicle identification number.
(2) Proof of legal possession of the vehicle, which may be a legal title to the vehicle, or a dissolution decree, temporary court order, or domestic violence restraining order that awards possession or exclusive use of the vehicle to the driver. A court order awarding sole possession or exclusive use of a vehicle shall take priority over a vehicle title showing joint ownership for purposes of this
article.
(b) A covered provider shall not require a driver to provide any proof of legal possession other than what is required in subdivision (a) to establish the authority to terminate a person’s access to connected vehicle service.
(c) A covered provider shall not require a driver to take any action to terminate a person’s access to connected vehicle service other than what is set forth in this section, including, but not limited to, requiring any of the following:
(1) Payment of a fee, penalty, or other charge to complete a connected vehicle service request.
(2) Maintaining or extending the term of a connected vehicle service account.
(3) Approval by any account holder, including, but not limited to, the named account holder, of the change in access.
(4) An increase in the rate charged for the connected vehicle service.
(d) A covered provider shall terminate a person’s access to connected vehicle service within two business days after the date of receiving a completed request from a driver who meets the requirements of this section.
28226.
(a) If a covered provider terminated a person’s access to connected vehicle service in response to a connected vehicle service request, the covered provider shall not provide to the person any data or information regarding the driver, the vehicle, or any new connected vehicle service account that was generated after that person’s access to the connected vehicle service was terminated.(b) A covered provider shall ensure that all personal information provided during the process to terminate a person’s access to connected vehicle service is handled with appropriate security and privacy, adhering to relevant data protection laws and regulations.
(c) A covered provider and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a driver pursuant to this article as confidential and shall comply with applicable privacy laws.
(d) A covered provider shall not share information submitted by a driver pursuant to this article with any third party without the affirmative consent of the driver, unless sharing that information is required to effectuate a connected vehicle service request.
(e) Nothing in this section shall preclude a covered provider from responding to a court order or warrant.
28228.
The termination of connected vehicle service pursuant to this article shall not be deemed to impact legal ownership of a vehicle.Article 3. Disabling Connected Vehicle Location Access
28240.
If a vehicle includes connected vehicle location access, a covered provider shall provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access.28242.
A mechanism for disabling connected vehicle location access shall meet all of the following requirements:(a) Be prominently located and easy to use.
(b) Not require access to, or use of, a remote or online application.
(c) (1) Not require account creation, a password, or login information.
(2) A vehicle manufacturer may require a driver to input a mobile number associated with the connected vehicle service account. If a vehicle manufacturer requires a driver to input a mobile
number in order to disable the connected vehicle location access connection, it shall not require any further information in order to allow the driver to disable the connection, including, but not limited to, using that number as part of a two-factor authentication process that results in sending a code to the mobile number.
(d) Allow connected vehicle location access that has been disabled from inside the vehicle to be enabled only by a driver who is located inside the vehicle.
