Personal Data Collected by Cars Increasingly at Odds with the Law
State Privacy Laws
- Famously CCPA in CA, but about 1/3 of the states have privacy proposals
State UDAP Laws
- Many states have one A 50-State Report on Unfair and Deceptive Acts and Practices Statutes
- Some AGs particularly active
State Data Security Laws
- 24 States have requirements for private entities by statute
- 32 States have requirements for government entities by statute (e.g. apply to government fleets)
- Other Laws (e.g. biometrics in IL)

Growing FTC Attention
UDAP penalties up to $43,280 per violation
FTC Posts on the topic:
For Car Rentals (August 2016) | For Fleets (August 2018) | For Consumers (August 2018)

The First Class Action Suits Already in Play
Greenley v. Avis Budget Group, Inc
Mitton v. Inc
Hertz Global Holdings, Inc
Ayala v. Sixt Rent A Car, LLC.
Kramer v.Enterprise Holdings, Inc.
SIXT case made it to Discovery
Defense costs alone: six-figures
Settlement likely to put damages at well over seven figures plus plaintiffs’ attorney’s fees