Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Good morning, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Friday, 05/01/2026 at 09:04 in the morning. So we're here to continue discussions on F71, take more testimony. So Mary, is she online? Uh-huh. Or is she here? Good morning, Mary. Good

[Mary Marwig]: morning. Can you hear me?

[Michael Marcotte (Chair)]: Yes, we can. Awesome. Thank you for joining us this morning.

[Mary Marwig]: Thank you.

[Michael Marcotte (Chair)]: So if you'd like I think

[Mary Marwig]: we're ready to get started folks.

[Michael Marcotte (Chair)]: Yes, we are.

[Mary Marwig]: Okay. Well, it's a pleasure to be with you all today. Thank you for the opportunity to testify in support of the Vermont Data Privacy and Online Secure Surveillance Act. My name is Mary Marwig. I'm the Vice President of Global Communications and Advocacy at Privacy for Cars, a world leading authority on vehicle privacy and data security. And I've spent about seven years working in data privacy. And I got into privacy because I was frightened. I was living in fear of a stalker who had a lot of commercially available data about people, including me. And I was most concerned about the location data because that's how an online harm can turn into a physical harm very quickly. So seven years ago, I decided to take that fear and turn it into something positive, which is real world protections for people like me and today, the people of Vermont. I've spent the last nearly two years in automotive privacy, is what I'm here to talk about today. So let's start with a quick story. There's a guy named Michael Tirana, and he requested the data that a data broker had on his driving behavior. And that report showed that nearly every single day around 05:30PM, there was a near miss collision small object. And it turns out that when he would pull into his driveway after work, his cats were excited to see him and they would run up to the car to greet him. And so excited cats became a near miss collision in this data set, which is a risk score now that follows Michael everywhere and could have cost him hundreds of dollars in raised insurance rates. And that story is capturing why your bill matters. So for most Vermonters, a car is a necessity. It is not just a convenience. Vermont has roughly one vehicle per resident and Vermonters drive 20% more than the national average. So cars play an enormous role in your constituents' everyday lives. And yet today, cars are among the most data intensive consumer products on the market, but would you know it? The concept that cars are mainly mechanical things like four wheels and a seat is just outdated. Electronics and software represent 40% of the cost of manufacturing a vehicle day today, and that's expected to jump to over 50% in the next four years. The nonprofit Mozilla Foundation rated cars as the worst product category for privacy that they have ever reviewed, worse than dating apps, and worse than fertility trackers. So that's really saying something folks. In addition to that, there are a multitude of players in the automotive ecosystem that can collect, share, sell, buy, and use highly sensitive personal data. That includes manufacturers, third party service providers, telematics companies, finance companies, data brokers and insurance companies. And we're not just talking about breaking habits and route history. If I may, I'd like to share an infographic. May I please get sharing permissions?

[Michael Marcotte (Chair)]: Yes. Okay.

[Mary Marwig]: Okay, let me know when you can see my screen.

[Michael Marcotte (Chair)]: Are

[Mary Marwig]: you able to see it?

[Michael Marcotte (Chair)]: Yeah, we can.

[Mary Marwig]: Okay, great. So what's okay, excellent. So the data we're talking about is all sorts of things. Frequently visited destinations, driving schedules, search content, health diagnoses, exercise data, even citizenship status and ethnicity. And this infographic shows the types of personal data collected in those automotive contexts. This was paired by privacy expert Debbie Reynolds for a federal initiative under the US Department of Commerce and NIST. And as you can see here, this includes highly sensitive personal information. So what are the harms that can stem from this? Well, there is a multitude. Financial harms. Insurance premium increases. So one driver's premium jumped 80% after an automaker shared hundreds of entries of their driving data with a data broker. It could include insurance denial or cancellation. Another driver said the driving data that was shared about him impacted his ability to find auto insurance at all. And then there's inaccurate risk scoring. So think about that cat example I just explained to you. Then there's privacy violations, undisclosed surveillance. Most people don't understand the amount of data that is being shared or sold. Loss of control over personal data. It's shocking when consumers do get the access to these reports and see hundreds of pages of their driving history. They're also often enrolled without meaningful consent and the data is persisting in resold vehicles. For example, over 80% of used pre owned, pre used vehicles today have prior driver and passenger's personal information still stored on the car when it's resold. Then there's physical safety harms, abuse, stalking, using a remote vehicle as a weapon of control. Abusive people have used cars to show real time location inside and outside the car with the cameras, and some use it to remotely control the car. So they are honking the horn at early morning hours or turning on the heat remotely so high that you overheat. Mary, I think you might want to turn off video. Just it's delayed. Oh, it is? Okay. Just one second. Okay. So turning off my video. All right. Here we go. One survivor said that her ex would unlock her car trunk at 03:49 in the morning, forcing her to get out of bed to secure her vehicle. And she said she lived in constant fear of what her ex might do through the app. Another harm is identity theft and data breach exposure. So this is a great example of why data minimization similar to Maryland's is so important. We've all seen the mass data breaches impacting millions of people. And for cars, there are extractable digital identities. And there's lifetime risk because the data collected in CAR contexts, it represents some of the most intimate data of our lives, especially the location data. It's easy to change a password on account, but how easy is it for you to change your life, your home address, your routines, your life patterns. Other harms include inferential harms and discrimination, sensitive life information derived from location data. So your religious beliefs because you park near your church, your health information because you park near a hospital, your sexual orientation, and more. These inferences can also show your relationships with other people and your lifestyle preferences, who you spend time with. There's also law enforcement access without warrants, and there's national security exposure because we've heard that data brokers have sold location data of military members to foreign governments. And then there's systemic and market harms. There's eroding consumer trust here. We've seen deceptive user experience patterns. In fact, California has done a large enforcement on that topic in automotive context. But most importantly, I would say is the asymmetric power. Consumers have little or no control over their personal data in car contexts. Consumers have little to no bargaining power. You can't buy a modern car that doesn't collect data and the consent mechanisms today are opaque and the privacy choices are limited. And without a private right of action, that lack of power, that asymmetric power is cemented. So when we think about this act, need to think about connected cars specifically as one of the most intimate surveillance devices consumers engage with today, which is one they're not only paying for with money, so they pay for the car with money, but also unbeknownst to many, they are also paying with their personal data. So this act also covers online surveillance. I want to stress that it's important to understand that people access the Internet increasingly not just on browsers through computers, but also through IoT devices. So I do recommend that you include a system recognizing universal opt out mechanisms similar to Colorado's formal review process. And I say that because the currently widely adopted universal opt out mechanism global privacy control only works in browser based settings, so not when consumers access the Internet with an IoT device. And cars are one of the largest IoT devices and the most expensive IoT devices that a Vermonter will ever own. And geolocation data, one of the most invasive data types that we've been talking about here, it shows where you are, where you live, where you work, where you might be, medical visits, religious institutions, political and union activities, and so much more. Should these highly sensitive details of our lives be sold? Your act says no. And I truly commend you for that. I strongly, strongly, strongly support this act. Its sensitive data definitions, the prohibition on selling geolocation data, its requirements that controllers name the specific entities that they've sold data to, these are real protections, and I really commend you on that. That is super important today in car context as well, because nearly every major car brand is facing legal action over personal data practices. So we've seen class actions, consumer arbitrations, state attorney general investigations, and as of January, an FTC consent order banning an automaker from collecting driving data for five years. And there's a common thread there, and that's that consumers didn't know what personal data of theirs was being collected. Companies didn't clearly disclose what they were doing, and their position was that they weren't clear that the laws were telling them that they even had to. So that's why your bill today matters so much. So in addition to supporting your bill, I do wanna flag three automotive specific gaps that you may not be aware of that could undermine the protections for Vermonters, and there are simple fixes for those. First, there's an absence of vehicle specific multi controller disclosures at the right time. Second, there is an exemption, the GLBA exemption, that lets auto finance and auto insurance companies sidestep the bill entirely. And third, franchise relationships can create hidden data pipelines. So first, let's talk about the disclosure and consent concerns in the vehicle lifecycle. The problem is the bill does not address multi controller transactions like vehicle sales, and it also doesn't specify when the notice is required. Right now, a lot of consumers are only finding out about the data practices after they've purchased. So the problem is consumers are not properly informed. Privacy notices, as I'm sure you've experienced, are buried in paperwork, they are written in legalese, and they're voluminous. So for example, I looked up a 2024 model car and it had, let me show you on my screen, 12 different documents explaining the data practice. Five and a half hours for an average reader, which is approximately the same time a fast reader can get through George Orwell's 1984 book, which feels appropriate. So Vermont law requires every traditional new vehicle purchase to go through franchise dealers. So that law already is on the books. It's mandatory. So if Vermont requires consumers to buy cars through dealerships, doesn't it make sense that a consumer receives a vehicle specific privacy disclosure prior to and at the point of transaction at a dealership before they commit to purchase? That information upfront would allow a consumer to comparison shop on data practices, and maybe they would choose a brand that collects less personal data or doesn't sell or share it. California already has a Notice at Collection Regulation, CA code regulation title 11, section 7,012, that includes automotive examples as a model. So, disclosure needs to be prominent and simple. Consumers should be able to quickly understand whether sensitive data will be collected, geolocation, biometrics, data from their smartphone, whether the vehicle can transmit that data through telematics and the third parties the manufacturer shares that data with, such as affiliates including captive lenders, dealers, data brokers, and ultimately insurers. The timing of that disclosure is critical. As we know, cars are expensive and they are very difficult to back out of. If you find after the purchase that the manufacturer's data practices are misaligned with your privacy preferences or your personal security risk tolerance, what's the remedy? Do you just buy a new car? I'd say that for most people, that's not practical. Also requiring consumers to call the manufacturer ahead of a purchase is not it creates an excessive burden. It adds more time to an already time intensive process and could be outright ineffective. So the notice needs to be prior to transaction. And then after you buy a car, consumers should receive a plain language notice informing them of what rights they have under Vermont law for their privacy and what choices they can make about the data their vehicle collects, stores, sells, and shares. Also, when you trade in a vehicle, so when you're ready to bring back that lease return or trade in a vehicle, return a rental, or if your vehicle is repossessed or deemed a total loss, companies should have a duty to protect the personal data stored on that vehicle. So I mentioned earlier that 80% of pre owned, pre used vehicles for sale today contain prior drivers and passengers unencrypted personal data. So that includes things like their entire contact list, the call logs, who they called, navigation history, garage door codes. So that's a physical harm waiting to happen, and saved passwords. Others already acted. So for example, Illinois requires lenders to delete personal data from repossession, and New Jersey is addressing trade ins and lease returns by requiring dealers to offer to delete personal data from consumers. On top of that, there are many dealers and companies that are already voluntarily deleting personal data from vehicles when they change hands, simply because it is the right thing to do. But we do think that making that a pragmatic simple protection available to all Vermont residents through law is a great idea. So the fix on point one here is requiring plain language, vehicle specific privacy disclosures at the point of sale, after purchase, and at every change of vehicle possession. Alright, my second concern is the GLBA exemption gap. So the bill's entity level GLBA exemption creates unintended consequences in automotive contexts. So auto dealers, auto lenders, and auto insurers can claim this exemption. It's a very large loophole that you could drive all of Vermont's trucks and cars through. So let me explain how this could work. So we'll go back to Michael as an example. Say Michael finances his car through the manufacturer's captive finance company, which is a bank, fully exempt under the bill as written. The manufacturer collects Michael's driving data every day through the connected vehicle platform. So where he drives, how hard he brakes, how fast he accelerates. That driving data flows from the manufacturer to the finance company without being classified as a sale because they are affiliates under the same corporate parent. So once his personal data is inside the finance company, the bill does not apply at all. So now the finance company has Michael's loan his income, his credit score, social security number, and his daily driving behavior, and it blends it. So late payment plus hard braking plus low income equals high risk driver slash borrower score. And that score could affect his next loan approval, his interest rate, or may trigger an early review of his current loan. So did Michael ever know about the use of his data in this way? No. Did he consent to it? No. So this is the same data that the bill rightly classifies as sensitive in other contexts. So the data didn't change, the harm didn't change, the only thing that changed was the legal classification due to the GLBA entity level exemption. And some captive finance companies, they already use this. They write it into their policies that they use the they have the right to use your vehicle data for repossession. So that that is very common practice. Okay, so now similar to the auto finance, let's consider auto insurance. 100% of Vermont drivers must carry auto insurance. It's a mandatory product and under the current language of this bill, we're allowing auto insurers to collect and use whatever vehicle data they want because they are GLBA exempt. So remember that story about the cats, that type of data would be perfectly fine under the bill. So a fix would be to just add a sentence to the statute saying automotive retailers, automotive lenders, and automotive insurance does not qualify for the entity level GLBA exemption for data collected from or about vehicles. Okay, so let me move on to my third and final recommendation. There is a franchise coercion problem. So franchise dealers operate under contracts dictated by auto manufacturers. Those agreements increasingly mandate that dealers use the manufacturer's dealer management system, enroll customers in connected services, sync customer upstream, and transmit deal data to manufacturer platforms. The dealer cannot refuse without risking critical items to their business, including vehicle allocation, incentives, or even the franchise itself. So if a dealer is exempt or falls below the act's applicability threshold, the franchise agreement becomes an unregulated data pipeline. The manufacturer can extract customer data through the dealer without triggering any Vermont disclosure or consent obligation. The customer never knows, and this puts local Vermont car dealers in an impossible situation because they are contractually compelled to participate in the data practices that they may not fully understand or understand how it may violate your law. So again, there's a fix. It's one sentence. I would recommend adding a franchise agreement may not require a dealer to collect, process or disclose personal data in a manner that violates this act. That makes manufacture data mandates that conflict with the Vermont law unenforceable and protects your local dealers too because it derisks them from being forced into practices that would violate your law. So in closing, this bill is strong. The sensitive data definitions and the sale prohibition are real protections, but the automotive ecosystem exposes three gaps. Again, consumers are not meaningfully informed before and at the point of sale, after the sale, or when vehicles change hands. Two, the GLBA entity level exemption lets auto finance captives and insurers ingest sensitive vehicle data without oversight. And three, the franchise relationships let manufacturers extract data through dealers without accountability. So the good news is, again, there are simple fixes, each just requiring a sentence or two of statutory language. So one, require vehicle specific disclosures for the multi controllers throughout the life cycle of the vehicle. Two, close the GLVA entity exemption for automotive data. And three, bar franchise agreements from overriding the act. In addition, I did want to just highlight again that universal opt out mechanism formal review process that I touched on earlier that will enable you to protect people's online habits in IoT devices. So I will have more details in my written testimony. That's what I have for today. Thank you so much for your time.

[Michael Marcotte (Chair)]: Mary, thank you very much. We appreciate your time. Unfortunately, we don't have time for questions, but if the committee has any, can they reach out to you?

[Mary Marwig]: Of course, absolutely. And I will send my contact information along with my written testimony. Feel free to reach out anytime.

[Michael Marcotte (Chair)]: Thank you very much.

[Mary Marwig]: Thank you.

[Michael Marcotte (Chair)]: We're being called to the floor. Third reading on s three seven. Back in here after the floor to take