State reminds N.J. auto dealers of duty to prevent unauthorized access to vehicle-stored consumer data
TRENTON, N.J. — As part of an ongoing push to strengthen consumer privacy protections, the New Jersey Division of Consumer Affairs has issued letters to more than 3,000 auto dealerships across the state, reminding them of their legal obligation to help prevent unauthorized access to personal information stored in vehicles returned for resale or lease.
The outreach reinforces compliance with the state’s data deletion law, enacted in January 2024, which mandates that dealerships offer to delete sensitive consumer data from vehicles’ infotainment systems when they are relinquished. The law aims to address growing concerns from privacy experts who warn that syncing mobile devices to a vehicle’s onboard system can leave behind personal data, including call logs, text messages, navigation history, garage codes, and even links to financial accounts through in-vehicle apps.
“Security experts have warned that syncing your phone to your car can put you at severe risk for a data breach, especially when you surrender a car for resale or at the end of the lease period,” said Attorney General Matthew J. Platkin. “New Jersey law requires auto dealerships to take certain actions to address that risk, and we expect them to comply. The letters issued by the Division remind dealerships that violators will be held accountable.”
Acting Director of the Division of Consumer Affairs Elizabeth M. Harris added that while the public is more aware of data privacy risks related to electronics, many don’t realize similar risks exist when handing over their vehicle.
“By requiring New Jersey dealerships to offer to delete this information for the consumer, we’re raising awareness of this growing security risk and providing consumers with a way to protect themselves from unauthorized disclosure of personal information,” Harris said.
Dealerships were advised that failure to comply with the law could result in civil penalties—$500 for a first offense and $1,000 for each subsequent violation. The letters also outlined how to carry out data deletion, either through manufacturer-recommended methods or by performing a factory reset.
While dealerships are permitted to charge a reasonable fee for this service, they must disclose the cost to consumers beforehand. Dealers must also inform customers that they have the option to delete their personal data themselves or through a third party.
The Division’s efforts highlight the state’s broader initiative to safeguard residents’ data amid evolving digital and automotive technology landscapes.
