Flooring it into the future with self-driving cars

Colorado authorizes use of self-driving technology – What does that mean for the rules of the road?

David M. Stauss //July 13, 2017//

Flooring it into the future with self-driving cars

Colorado authorizes use of self-driving technology – What does that mean for the rules of the road?

David M. Stauss //July 13, 2017//

In June 2017, the Colorado legislature passed a law authorizing the use of both highly and fully automated driving systems in motor vehicles throughout Colorado. While the use of such vehicles may seem futuristic, car manufacturers have been aggressively pursuing the technology in recent years. In fact, Tesla is currently producing cars capable of operating at full automation. And other car manufacturers are not far behind, including Ford and Volvo, who recently announced ambitious plans to produce highly autonomous vehicles by 2021.

Autonomous vehicles are typically categorized by reference to the Society of Automotive Engineers’ levels of automation (referred to as SAE International’s Standard J3016), which sets forth six levels of automation:

(0) no automation

(1) driver assistance

(2) partial automation

(3) conditional automation

(4) high automation

(5) full automation.

Levels 0 to 3 have already been legalized under Colorado law. The new law authorizes the use of levels 4 and 5.

Consistent with the U.S. Department of Transportation’s Model State Policy on automated vehicles, the Colorado law requires automated driving systems to be capable of complying with every state and federal law that applies to the function that the system is operating.  

The state law defines “automated driving system[s]” as “hardware and software that are collectively capable, without any intervention or supervision by a human operator, of performing all aspects of the dynamic driving task for a vehicle on a part-time or full-time basis, described as levels 4 and 5 automation in SAE International’s Standard J3016[.]”    

Specifically, level 4 automation is defined by SAE as a driving system that controls “all aspects of the dynamic driving task, even if a human driver does not respond appropriately to a request to intervene.” At level 5, the automated driving system controls “all aspects of the dynamic driving task under all roadway conditions.” The difference between these levels of automation is that level 4 only performs under certain conditions and in limited environments, whereas level 5 performs under any conditions and in all environments.

Colorado is one of only 18 states to have passed legislation related to autonomous vehicles, according to the National Conference of State Legislatures. The District of Columbia has also passed autonomous vehicle legislation, and four states have addressed the issue through executive orders. The federal government has weighed in on the issue as well.

While this law only was intended to authorize the use of high and fully autonomous vehicles in the state, the eventual widespread production and use of such vehicles will likely encourage lawmakers and regulators to address difficult issues that arise through their use. For example, the use of such vehicles raises important privacy and cybersecurity risks. From a privacy perspective, autonomous vehicles generate substantial amount of data on a minute-by-minute basis from car-mounted sensors, geolocation, or the internet of things technology used for navigation. As autonomous technology becomes more commonplace, lawmakers and regulators will need to consider the methods by which that data is collected, stored, protected, shared with third parties, and used by manufacturers to ensure user privacy. State lawmakers also may consider revising state breach notification laws to cover the loss of such data.

Considering the cybersecurity risks associated with the widespread use of such vehicles, lawmakers may wish to ensure that car manufacturers are implementing adequate protections from hackers. Further, much like a smart phone downloads software updates for its operating system and apps, autonomous vehicles will need to download manufacturer-provided software updates to ensure ongoing functionality and security. Given that vehicles can be owned and used for decades, lawmakers may create requirements for car manufacturers to provide integral updates for a set period of time to protect consumers.  

It is important to remember that these types of privacy and cybersecurity concerns are not unique to autonomous vehicles. With the growing use of technology in consumer products, and the commercial potential of unmanned aerial vehicles (commonly known as drones), laws and regulations governing their use will be quick to follow. 


David M. Stauss focuses on complex business and commercial litigation in state and federal courts, and it head of the Denver office's privacy and cybersecurity practice group. J. Matthew Thornton is an associate in the litigation group in the Denver office.