The lawmakers’ findings raise questions about whether automakers can be held to account for departing from promises made about user privacy.