The New Jersey Division of Consumer Affairs has sent letters to more than 3,000 auto dealerships across the state, reminding them of their legal duty to help prevent unauthorized access to consumer data stored in vehicles that are relinquished for resale or lease.
When consumers connect their mobile devices to a vehicle’s infotainment system, personal information such as call logs, text messages, navigation history, and garage codes can be saved in the car’s memory. Additionally, in-vehicle apps may store sensitive financial details like bank account and credit card information.
To address these risks, Governor Phil Murphy signed the New Jersey data deletion law in January 2024. This law requires dealerships to offer consumers the option to delete personal data when vehicles are turned in for resale or lease. Dealerships that fail to comply could face civil penalties starting at $500 for a first offense and $1,000 for subsequent offenses.
“Security experts have warned that syncing your phone to your car can put you at severe risk for a data breach, especially when you surrender a car for resale or at the end of the lease period,” said Attorney General Platkin. “New Jersey law requires auto dealerships to take certain actions to address that risk, and we expect them to comply. The letters issued by the Division remind dealerships that violators will be held accountable.”
“While the public has become increasingly aware of the data privacy risks associated with discarded computers, cell phones, and other electronic devices, many people are unaware they face the same risks when they surrender their vehicle to a dealership,” said Elizabeth M. Harris, Acting Director of the Division of Consumer Affairs. “By requiring New Jersey dealerships to offer to delete this information for the consumer, we’re raising awareness of this growing security risk and providing consumers with a way to protect themselves from unauthorized disclosure of personal information.”
Dealerships must follow manufacturer-recommended procedures or perform a factory reset on vehicles as part of the data deletion process. While dealers may charge a reasonable fee for these services if disclosed beforehand, consumers also have the option to delete their own information or use another vendor.
