State declines to take action on Alton resident's complaint against VW selling personal data

CONCORD — The state’s Consumer Protection and Antitrust Bureau has closed the book on a complaint filed in September 2023 about Volkswagen’s unauthorized collection and sale of personal data, putting the onus on the complainant to file a new request if they wish the state to pursue legal action under a recently enacted cybersecurity law, RSA 507.

It is the latest setback in Alton resident Gerry Kennedy’s attempt to persuade the state to take seriously the ubiquitous collection of personal data by automakers which they then sell to marketing and insurance companies for profit. Stellantis, a multinational automotive manufacturing company representing 14 automotive brands, places the value of the data on its books at €588.24 per titled owner.

“The infiltration and exfiltration of data from my legally titled vehicle is an unlawful act that infringes upon my rights as its owner,” Kennedy wrote in his original complaint. “It is imperative to recognize that the data generated by a vehicle is not just a collection of numbers and statistics but a reflection of an individual’s private life and habits. Protecting this data from unauthorized access is not only a legal obligation but a fundamental right in our digital age. Any attempt to exploit or profit from this data without permission is a grave breach of the law, with serious consequences for those involved.”

The Department of Justice does not see it that way. A paralegal responded to his complaint, “After careful review, the Bureau has determined that it is unable to pursue your individual complaint. As a law enforcement agency, the Bureau has jurisdiction to act in cases where there has been a violation of the New Hampshire Consumer Protection Act (CPA), RSA 358-A. Violations of the CPA occur when the State can prove that the defendant’s unfair or deceptive actions were purposeful and not merely reckless or negligent. Further, the State must show that the defendant’s actions attained a level of rascality that would raise the eyebrow of someone inured to the rough and tumble world of commerce.” She added, “Although the Bureau is unable to take action in this matter, you may wish to explore all available private remedies with your own attorney.”

Kennedy followed up in December 2024 by offering a nearly 17,000-word document citing all existing laws Volkswagen’s data collection allegedly violated, arguing the actions reached the “level of rascality” required for the state to take legal action.

The bureau asked for additional information, which Kennedy submitted in February. Assistant Attorney General Warren Cormack then informed Kennedy, “After careful review of the facts alleged in your complaint ... your complaint was closed. Though your complaint was closed after thorough review, it raised issues that may be addressed by your issuance of an RSA 507-H rights request.”

For Kennedy, collecting consumer data without the express permission of car owners constitutes unauthorized taking for profit. Mozilla’s *Privacy Not Included research revealed “every car brand we looked at collects more personal data than necessary and uses that information for a reason other than to operate your vehicle and manage their relationship with you.”

Researchers Jen Caltrider, Misha Rykov, and Zoë MacDonald found software installed in all major automotive brands, which allows popular features to work, can collect not only how you interact with your car, but also the data from connected services such as Sirius XM and Google Maps. The car’s app can even collect “super intimate information about you — from your medical information, your genetic information, to your ‘sex life’ (seriously), to how fast you drive, where you drive, and what songs you play in your car — in huge quantities. They then use it to invent more data about you through ‘inferences’ about things like your intelligence, abilities, and interests,” they wrote.

Their research showed most car brands surveyed said they have the ability to share the data, with 19 automakers admitting they may sell your personal data.

While New Hampshire’s Attorney General John Formella appears to be reluctant to do anything about it (and has not responded to requests for comment), Texas Attorney General Ken Paxton has initiated lawsuits against Allstate and its subsidiary, Arity, for those companies’ collection, use and sale of data collected through Allstate’s mobile apps, which Paxton argues violates Texas’ data privacy law.

Paxton alleges Allstate, through Arity, paid third-party developers to embed software into various mobile apps, including GasBuddy, Fuel Rewards, and Routely, allowing Allstate to build up a database of consumer driving behavior from more than 45 million consumers nationwide. When quoting or renewing insurance coverage, Allstate and other insurers used that data to justify increasing premiums or dropping coverage.

Kennedy suggests vehicles today function as “rolling digital currency generators, continuously producing marketable data”, and he argues “data extracted without consent from legally titled vehicles is tantamount to involuntary servitude under the 13th Amendment, as car owners are providing valuable digital labor without compensation.”

He offers another reason for New Hampshire to pursue litigation around the automakers’ profit-making through the sale of consumer information: the data extraction serves as a hidden revenue source for companies, unregulated and untaxed, he said. Taxing those profits could help solve the state’s budget challenges.

“By failing to acknowledge vehicle-generated data as a taxable commodity, the State of New Hampshire has left over $558 million in potential tax revenue on the table,” he said. “This revenue could have been used for infrastructure, cybersecurity programs, public education, and other critical state functions.”

New Hampshire has 442,915 registered vehicles, so with each titled owner’s data valued at roughly $600, automakers are potentially collecting $265.75 million per year, Kennedy says. With data ports having been mandated in 1996, data exfiltration has been occurring for 28 years, according to Kennedy, yielding $7.44 billion. If taxed under New Hampshire’s Business Profits Tax rate of 7.5%, it would have generated $558 million in state revenue.

Yet the Justice Department closed the complaint without acting.

Gov. Kelly Ayotte and members of the Executive Council were asked about the Attorney General’s Office decision, but declined to comment on the matter. Kennedy says he is not giving up.

“I’ll meet with the governor,” Kennedy said. He expects Ayotte, as a former attorney general, will recognize the merit of his arguments and act on them, in contrast to Cormack’s inaction.