Committee hears testimony on bill to let abuse victims disconnect vehicle tracking

The House Judiciary Committee heard testimony this week on provisions of H.223 that would let victims of domestic violence disable factory-installed vehicle tracking without first obtaining a protection order.

Committee Chair (unnamed) opened the hearing by saying the committee would “take a look at ... H 2 2 3” and noted that “sections 1 and 3 were moved into H 2 2 2 … But there are 2 sections left, section 2 and 4,” before calling the first witness.

The provision under consideration would address what witnesses called a legal and technical loophole that lets abusers use connected‑car telematics and mobile apps to locate, surveil or remotely control another person’s vehicle. “I’m a survivor of technology facilitated abuse,” said Annie Bridal, a private attorney and co‑chair of the New York Cyber Abuse Task Force, who testified about the risks of “tech abuse” and why state law is needed. Bridal told the committee the Vermont provision is “commendably designed” because it does not require a victim to obtain an order of protection before seeking disconnection.

Andrea Mico, founder of Privacy for Cars, described the technical mechanics that make factory telematics useful to stalkers and the simple fixes some manufacturers have implemented. “It’s a few lines of code that literally can save somebody’s life,” Mico said, explaining a protocol she and Ford developed that uses a factory reset to revoke a mobile app’s authentication so a prior account loses remote access. She said Ford, Lincoln, BMW, Toyota, Lexus and Volkswagen have implemented approaches that cut access after a reset and that her group’s consumer tools have been used by “over 700,000 consumers” nationwide, with “over a thousand in Vermont.”

Witnesses and committee members discussed three recurring topics: (1) technical fixes that can be implemented inside the vehicle (a reset‑to‑disconnect protocol); (2) dealer and rental practices; and (3) statutory scope and carve‑outs. Mico urged requiring a mandatory in‑car disconnect procedure rather than a paper‑intensive process she said survivors are unlikely to complete while fleeing abuse: “All you should be able to do is to follow 4 or 5 steps in the menus of your car, press okay, and know the electronic leash is gone.”

Committee members raised concerns about rental and car‑sharing operations. A committee member noted that the draft statute appears to carve out tracking systems “installed by the manufacturer … including services installed or used by an entity renting out vehicles,” and that would exclude rental companies and marketplaces such as Turo. Mico said rental companies should be expected to reset connections between renters and prior users and called the current carve‑out a “clear carve out here for dealers and especially for rentals.”

Witnesses also pointed to disclosure and consumer‑protection gaps: Mico cited recent Department of Commerce guidance and a California change to the state consumer privacy law as precedents and suggested Vermont could require dealerships and rental firms to disclose telematics capabilities and how to disconnect them at point of sale or rental.

No formal motion or vote occurred at the hearing. Committee members said the hearing’s purpose was information gathering and that staff would use the testimony to refine the bill before a future legislative session. “We’re just trying to get some information to see how to further improve the bill, between now and next January,” the committee chair said.

The hearing transcript records detailed technical and survivor testimony and specific suggestions for statutory changes, including narrowing or removing the rental/car‑share carve‑out, adding mandatory in‑car disconnect functionality, and requiring dealer and rental disclosures.

The committee indicated it will continue work on H.223 in the off session and may contact witnesses for follow up.