One afternoon this past summer, a self-driving Waymo pulled into a parking lot in San Mateo County, California, and stayed there until the police arrived. Local cops had gotten a 911 call from Waymo staffers—humans, it should be said—who were viewing the car’s passengers through cameras installed inside the vehicle. It looked like two teens were shooting a black handgun out the window of the vehicle, playing with it and drinking between shots, a police report said.

The story has a happy(ish) ending: The gun was shooting water-filled Orbeez, not bullets. But the incident drew attention to Waymo’s surveillance system. The cars are equipped with automated tech that can flag the presence of a firearm inside, the company said.

The outsides of self-driving cars are studded with cameras, which help them “see” the world around them. (Most also use other sensors, including radar and lidar.) Less appreciated are the cameras inside the vehicles, which companies say are essential to keeping riders safe and enforcing their rules. Earlier this year, Waymo said it used its cabin cameras to do both after some California passengers, many in their twenties or older, reported that Waymo employees suddenly took over the vehicles’ intercoms mid-ride to make sure they were old enough to ride on their own. (One 35-year-old told WIRED he thought his backpack sent up red flags.)

Still, robotaxi privacy policies can be broad. They suggest that footage captured inside vehicles can be used for many innocuous and commonsense reasons—to check cleanliness between rides, to detect lost items—but also to improve their products or services. These catch-all terms could cover many uses. Experts say that in the US, few clear rules govern this sort of surveillance, especially because riders often must agree to lengthy “terms of service” printed in minute fonts before they use ride-hailing apps. That leaves riders to trust that the companies are handling their information responsibly.

“We are being essentially abandoned by our lawmakers when it comes to consumer privacy and what companies can do with information after they’ve collected it,” says Matthew Guariglia, a senior policy analyst at the Electronic Frontier Foundation, where he works on surveillance and policing issues. His advice? “Just because you’re alone in the car doesn’t mean you’re alone in the car. You should behave as if there’s a jumpy person in the front seat.”

In general, robotaxi companies including Waymo, Zoox, and Tesla say that human staff view interior cameras only when needed. All say personal data, including recordings, may be sent to law enforcement or regulators. (A Waymo support page says that government agencies seeking data “are directed to follow valid legal processes in making such request.”)