Page 1

Ninth Circuit:

Data Broker Not Liable for Privacy Violation Over Secret Trackers Installed on Cars

Opinion Says Statute Prohibiting Attachment of Location-Tracing Equipment to Vehicles Without Consent Does Not Apply if Device Is Built-in

By a MetNews Staff Writer

The Ninth U.S. Circuit Court of Appeals held yesterday that a class action complaint asserting a privacy law claim against a company that sells data collected from its electronic tracking devices, which are installed by automakers and allegedly collect real-time location information of unsuspecting drivers, was properly dismissed because the statute in question does not contemplate liability for built-in components.

At issue is Penal Code §637.7, which prohibits using “an electronic tracking device” to determine a person’s location or movement without their consent and defines the term to mean “any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals.”

Sec. 637.2 provides for civil liability for a violation of the statute and specifies that a plaintiff may seek injunctive relief and recover $5,000 per violation or three times the amount of actual damages, whichever is greater.

In a memorandum decision, signed by Circuit Judges Michelle T. Friedland, Salvador Mendoza Jr., and Roopali H. Desai, the court noted that “California courts have not addressed whether a device installed in a vehicle at manufacturing can constitute an ‘electronic tracking device’ under §637.7,” but concluded that the legislative intent behind the section supports the view that built-in equipment is not covered.

Class Action Complaint

In April 2022, Saman Mollaei, a citizen of California, filed a class action complaint in San Francisco Superior Court against Otonomo Inc., a Delaware company with its principal place of business in Israel. Otonomo successfully removed the matter to federal court the following month.

Mollaei alleges:

“Defendant Otonomo Inc. is a data broker that secretly collects and sells real-time GPS location information from more than 50 million cars throughout the world, including from tens of thousands in California….

“Of course, Otonomo cannot simply ask drivers for permission to track their GPS locations and sell them to scores of unknown third parties. Very few (if any) drivers would voluntarily provide a data broker like Otonomo unfettered access to their daily personal lives. As such, Otonomo has partnered with at least sixteen car manufacturers—including BMW, General Motors, Ford, and Toyota—to use electronic devices in their cars to send real-time GPS location data directly to Otonomo through a secret ‘always on’ cellular data connection. In this way, drivers never even realize electronic tracking devices have been attached to their cars or that anybody is tracking their real-time movements, let alone a data broker.”

The plaintiff asserts one claim, on behalf of himself and the purported class, for a violation of §637.7 and requests injunctive relief and damages of $5,000 per violation under §637.2. He claims that an Otonomo telematics control unit (“TCU”) device was installed on his BMW and used to gather information about his location by collecting data from the car’s sensors and radios.

Dismissal of Complaint

After Otonomo filed a motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), District Court Judge Trina L. Thompson granted the request, reasoning that the device was part of the vehicle and not simply an “attachment.” She wrote:

“Here, the TCU falls short of an electronic tracking device under Section 637.7….At oral argument, Plaintiff confirmed that the TCU is a component part of Plaintiff’s vehicle that is not removable by Plaintiff, nor was the Plaintiff able to obtain his vehicle without the TCU….Plaintiff analogizes the TCU to a tire attached to the vehicle: ‘If a tire falls off a car, an attached part of the vehicle is no longer attached. No one would say the vehicle ceased to exist.’…The analogy, however, is only applicable if Defendant installed onto Plaintiff’s vehicle a tire in addition to those that are already part of the vehicle. The Court declines to extend the statute beyond its plain meaning or the intent of the legislature….[T]he TCU is not an ‘electronic tracking device,’ because it is not ‘attached to a vehicle.’ ”

Yesterday’s opinion affirmed the ensuing judgment.

Ninth Circuit’s View

Friedland, Mendoza, and Desai wrote:

“Neither § 637.7 nor any other part of the California Invasion of Privacy Act, Cal. Penal Code § 630 et seq., defines ‘vehicle.’ The ordinary meaning of ‘vehicle’ is ‘a means of carrying or transporting something.’…But that does not answer the question before us: are devices installed during manufacturing considered part of the ‘vehicle’ for purposes of § 637.7?”

Turning to the legislative history, they pointed out that the California Legislature, in commentary accompanying the section, acknowledged that the statute “would allow a person to place one of these [electronic tracking] devices on their own automobile to be used as an anti-theft device but it would not allow a private investigator to place a device on the automobile of an individual he or she was trying to follow.”

The jurists also noted that subdivision (f) contemplates the loss of licensure to any private investigator found to be in violation of the section. Under these circumstances, they said:

“The legislative history strongly suggests that § 637.7 was enacted to address private investigators affixing tracking devices to other people’s vehicles to track them without their knowledge. There is nothing in the legislative history to suggest that the law also intends to target devices built into a car during manufacturing that collect location data.”

Decline Invitation

Mollaei argues that, because the tracking device can be removed, it must be “attached” to the vehicle and not a component of the car itself. Rejecting this assertion, the panel said:

“We decline to accept Mollaei’s invitation to expand liability under § 637.7. Mollaei’s contention that tracking devices installed during manufacturing are ‘attached to’ rather than part of the ‘vehicle’ cannot be squared with the plain understanding of what constitutes a ‘vehicle’ or with the statute’s purpose….[I]nterpreting ‘vehicle’ to carve out certain parts installed during manufacturing would lead to absurd results and sweep in conduct far beyond what the legislature intended to prohibit.”

They continued:

“Section 637.7 criminalizes attaching a tracking device to an unsuspecting person’s vehicle. If we were to accept Mollaei’s definition of ‘vehicle,’ § 637.7 would transform from a circumscribed privacy law into an expansive consumer protection law targeting the collection of location data generally. That is not what the legislature intended.

“We thus hold that a ‘vehicle’ under § 637.7 includes parts built into the car during manufacturing.”

Applying this definition, the judges opined:

“Because the TCU was installed during manufacturing, it is part of the vehicle itself and cannot be considered ‘attached to the vehicle.’ Therefore, the TCU is not an ‘electronic tracking device’…, and Mollaei fails to plead a plausible claim that Otonomo violated § 637.7.”

The case is Mollaei v. Otonomo Inc., 23-16079.