Last week, a federal court in California dismissed a complaint concerning allegations that Otonomo, a data broker that partnered with car manufacturers, “used electronic devices in [drivers’] cars to send real-time GPS location data directly to [defendant],” allowing Otonomo to track drivers’ location in real-time.  Read on to learn more about what this means for limiting CIPA litigation exposure for geolocation tracking going forward.

Plaintiff in the case was a resident of California who alleged that her data was being “tracked and exploited by Otonomo.”  The core allegations in the Complaint concern Plaintiff’s contention that Otonomo “is a data broker that secretly collects and sells real-time GPS location information from more than 50 million cars throughout the world, including from tens of thousands in California.”  More specifically, Plaintiff asserted that Otonomo collaborates with its clients, who are automobile manufacturers that install electronic devices in the vehicles they manufacture.  Plaintiff alleged that Otonomo partnered with car manufacturers “to use electronic devices in their cars to send real-time GPS location data directly to Otonomo through a secret ‘always on’ cellular data connection.”

Plaintiff asserted that “[b]y secretly tracking the locations of consumers in their cars, Otonomo has violated and continues to violate the California Invasion of Privacy Act (‘CIPA’), which specifically prohibits the use of an “electronic tracking device to determine the location or movement of a person” without consent.”  The Complaint pled a single claim under CIPA for violation of Section 637.7.  Plaintiff sought to represent a putative class comprised of “[a]ll California residents who own or lease a vehicle and whose GPS data has been collected by Otonomo”.

By way of reference, Section 637.7 provides that:

(a) No person or entity in this state shall use an electronic tracking device to determine the location or movement of a person.

(b) This section shall not apply when the registered owner, lessor, or lessee of a vehicle has consented to the use of the electronic tracking device with respect to that vehicle.

(c) This section shall not apply to the lawful use of an electronic tracking device by a law enforcement agency.

(d) As used in this section, “electronic tracking device” means any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals.

Cal. Penal Code § 637.7 (West 2022).  CIPA is a heavily litigated statute that has been relied upon recently by plaintiffs in privacy class actions involving a number of recent tracking-related claims and technologies.  However, Plaintiff’s application of CIPA Section 637.7 to a built-in component of a vehicle (as opposed to a standalone device) was one of first impression.

Otonomo moved to dismiss the Complaint, raising three purported fundamental deficiencies with Plaintiff’s claim.  First, Plaintiff did not allege an “electronic tracking device” “attached to” his car as the terms are used in CIPA.  Second, Plaintiff did not allege that Otonomo “determine[s] the location or movement of” Plaintiff.  And finally, Plaintiff did not allege that he did not consent to be tracked.  The Court found Otonomo’s arguments persuasive, dismissing the Complaint with prejudice.

In regard to Otonomo’s first argument, violation of CIPA Section 637.7 requires that the location or movement of a person be determined by an “electronic tracking device.”  Cal. Penal Code § 637.7(a).  Additionally, an “electronic tracking device” is defined as a device “attached to a vehicle . . . that reveals its location or movement.” Cal. Penal Code § 637.7(d).  The Court took notice of other CIPA precedent which examined the statue’s legislative history to find that “the statute governs electronic tracking devices placed on vehicles or other movable things.”  As such, the Court ruled, “that the ‘device’ must be a separate device that is attached, or placed, onto an automobile by the alleged wrongdoer.”  On this basis, Plaintiff’s CIPA claim had to be dismissed.  The Court observed that this result was consistent with concessions made by Plaintiff’s counsel at oral argument, which included that the device at issue “is a component part of Plaintiff’s vehicle that is not removable by Plaintiff, nor was the Plaintiff able to obtain his vehicle without [it].”

The Court was also persuaded by Otonomo’s argument that, at most, Otonomo merely received data about the location of vehicles.  This was insufficient under Section 637.7 of CIPA which prohibits the use of “an electronic tracking device to determine the location or movement of a person.” Cal Penal Code § 637.7(a).  This was because, the Court explained, “[t]he wording of the statute explicitly prohibits tracking the location or movement of a person, not a vehicle.”  In this instance, the complaint was devoid of allegations that Otonomo obtained personal information of the drivers of these vehicles.  Furthermore, Plaintiff did not allege that Otonomo received Plaintiff’s personal information from manufacturers, that would possess this information.  On this basis as well Plaintiff’s claim independently failed.

Finally, the Court also adopted Otonomo’s argument regarding Paintiff’s failure to allege that he did not consent to the device installed in his car being used to track him.  Notably, Section 637.7 is not violated “when the registered owner, lessor, or lessee of a vehicle has consented to the use of the electronic tracking device with respect to that vehicle.” Cal. Penal Code § 637.7(b).

In this case, the Complaint did not include an allegation that Plaintiff did not consent to being tracked by his vehicle’s manufacturer.  This was a fundamental deficiency also requiring the Complaint’s dismiss because CIPA Section 637.7 “is not violated if any consent is given to the vehicle being tracked,” (emphasis supplied).  This required that, in order to plead a cognizable claim, Plaintiff had to allege the lack of consent with respect to both Otonomo and his vehicle manufacturer—which he did not.  In so ruling, the Court dismissed Plaintiff’s contention that consent did not need to be pled, as it was an affirmative defense, ruling instead that consent was “an element of the statute.”

Because the Court found that Plaintiff could not plausibly allege other facts that the device at issue was an electronic tracking device within the meaning of CIPA, Plaintiff’s claim was dismissed with prejudice.  Had Plaintiff’s interpretation of CIPA been adopted by the Court in this case, it would have dramatically expanded the scope of the statute.  Additionally, it could have also potentially limited the services provided to drivers on a daily basis due to perceived litigation risk.

As Otonomo’s motion pointed out, “Otonomo’s receiving vehicle GPS data through its contracts with car manufacturers and fleet managers. . .[was] used for things like roadside assistance, emergency location, vehicle theft protection, real-time weather and hazard notifications, and traffic flow management.”  At bottom, Plaintiff in this case sought to create liability under CIPA for any entity that receives GPS data from car manufacturers derived from features the car manufacturers themselves built into the vehicles.  The Court was prudent in this case to reject such an expansion of CIPA.  It remains to be seen, however, how similar claims brought in future filed cases are treated and if this first ruling is adopted in other litigations.

For more on this, and the latest developments concerning privacy, security and innovation, stay tuned.  Privacy World will be there to keep you in the loop.