The Faraday Future logo is displayed on the steering wheel of the FF91 electric car unveiled at the 2017 Consumer Electronics Show (CES) in Las Vega.

Internet-enabled cars outfitted with ever-growing numbers of sensors and cameras can offer performance and safety benefits, but they also can collect and transmit to car companies vast amounts of data.

Oregon lawmakers are considering a bill that aims to give drivers more control over how automakers collect and use their personal data.

“We’re beginning to understand that cars are a privacy nightmare,” Rep. David Gomberg, D-Otis, said during a hearing over House Bill 3875 on Tuesday. “Our cars know whether we prefer Starbucks or Dutch Brothers. Our cars know whether we worship on the weekend, or whether we stop by a local tavern on our way home from work every night.”

Gomberg, the bill’s chief’s sponsor, told lawmakers on the House Committee on Commerce and Consumer Protection that most modern vehicles today are equipped with gadgets that automatically collect, store and share data related to driving habits and other personal details — often without the driver’s knowledge.

HB 3875 proposes to expand the state’s existing privacy laws to include car manufacturers. The Oregon Consumer Privacy Act, which went into effect last year, establishes data privacy requirements for businesses that have collected data on at least 100,000 Oregonians, and it gives consumers the right to access, delete or get copies of any personal data that was collected or sold.

The law already applies to most major car companies. Supporters of HB 3875, however, say niche car brands and startups might slip under the threshold.

The bill also would require passenger car manufacturers to get explicit consent from their customers to share or sell their data.

It would exempt commercial truck manufacturers, including Daimler Truck, the German manufacturer that has its North American headquarters and some manufacturing in Portland.

Critics of the bill include Alliance for Automotive Innovation, a powerful national auto industry lobby group, which argues that the bill would create an uneven playing field for smaller car manufacturers.

Curt Augustine, senior director of state affairs for the Alliance for Automotive Innovation, testified that the bill unfairly requires small automakers to comply with Oregon’s data privacy mandates while keeping other similar-sized companies exempt. He argued that small car manufacturers shouldn’t be treated any differently from other companies under the law.

A 2023 report by the Mozilla Foundation, the nonprofit behind the open-source web Firefox browser, examined the data practices of 25 major car brands for privacy concerns. The study found that every automaker reviewed collected personal data from drivers, and only two — both brands sold only in Europe — gave customers the right to have their data deleted. Additionally, 21 of the 25 brands shared user information with third parties.

The data collected isn’t limited to driving habits. The Mozilla study found cars — often linked to smartphones — can gather information including basic personal identifiers, contact information and more intimate details like the user’s race and calendar entries.

Oregon lawmakers on Tuesday also heard a related bill that aims to broadly expand the state’s data privacy law. House Bill 3899 proposes to extend the law to companies that collect personal data from at least 35,000 Oregonians. Companies that collect data on at least 10,000 consumers and generate at least 20% of their revenue from selling that data would also be subject to the law.

HB 3899 also seeks to ban data collecting companies from selling precise location data — which could allow someone to locate a person to within 1,750 feet — of a consumer as well as any data belonging to a minor under 16 years old. It also aims to include protections for people’s health data, such as a consumer’s past or present physical or mental health condition.

Supporters say that HB 3899 expands consumer protections under the state’s privacy law. Opponents argue that the bill would burden small companies that might not have the money to comply with stricter privacy laws.