Class-Action Lawsuit Targets Company That Harvests Location Data From 50 Million

An anonymous reader quotes a report from Motherboard: A new class-action lawsuit filed in California targets Otonomo, a data broker that harvests location data from tens of millions of vehicles around the world and then sells access to that information. Otonomo says it has systems in place that protect peoples' privacy. But in June last year, Motherboard published an investigation based on a set of Otonomo data and used the information to find where people likely lived, worked, and where else they drove. At the time, experts said that Otonomo could face legal consequences because of how it handles consent and its data. The new lawsuit focuses specifically on those issues.

"Defendant Otonomo Inc. is a data broker that secretly collects and sells real-time GPS location information from more than 50 million cars throughout the world, including from tens of thousands in California. This data allows Otonomo -- and its paying clients -- to easily pinpoint consumers' precise locations at all times of day and gain specific insight about where they live, work, and worship, and who they associate with," the lawsuit, filed by lawyers from Edelson PC, reads. Courthouse News first reported on the lawsuit. The plaintiff in the case is Saman Mollaei, a citizen of California. The lawsuit does not explain how it came to the conclusion that Otonomo is tracking tens of thousands of people in California. Otonomo originally started in Israel and has an office in California.

Mollaei drives a 2020 BMW X3, and when the vehicle was delivered to him, it contained an electronic device that allowed Otonomo to track its real-time location, according to the lawsuit. Importantly, the lawsuit alleges that Mollaei did not provide consent for this tracking, adding that "At no time did Otonomo receive -- or even seek -- Plaintiff's consent to track his vehicle's locations or movements using an electronic tracking device." More broadly, the lawsuit claims that Otonomo "never requests (or receives) consent from drivers before tracking them and selling their highly private and valuable GPS location information to its clients." The lawsuit says that because Otonomo is "secretly" tracking vehicle locations, it has violated the California Invasion of Privacy Act (CIPA), which bans the use of an "electronic tracking device to determine the location or movement of a person" without consent.

In a previous report, Motherboard discovered that Otonomo established agreements with 16 OEM car manufacturers to source location data from their vehicles, which total over 40 million. They also source data from navigation apps and satnavs. The data, which is "relatively easy to deanonymize," is then sold to thousands of different organizations.