Auto Data Privacy and Autonomy Act

Summary#

This bill would limit what vehicle manufacturers can do with covered data. "Covered data" means user data and vehicle-generated data, including geolocation. Manufacturers could not access covered data unless the vehicle owner gives clear, written consent or the access is solely to improve vehicle performance or safety. Manufacturers could not sell, lease, or otherwise share covered data unless required by a warrant, a court order that gives the owner at least 48 hours notice to object, to assist an emergency response, or the owner gives clear, written consent. The bill also bars sharing personally identifiable information of U.S. citizens or lawful permanent residents with five named foreign governments. The Federal Trade Commission (FTC) would enforce the law and treat violations as unfair or deceptive acts. The FTC must report to Congress within 180 days about what data manufacturers access, who else accesses it, cybersecurity risks, any past data compromises, and whether a standards-based secure interface could give owners access and control. Manufacturers must give vehicle owners real-time, no-cost access and control of all covered data through the vehicle port and wirelessly if the vehicle supports it. Owners must be able to delete user data, set preferences, and use an open application programming interface without paying extra fees or buying a manufacturer device or license. The bill supersedes state requirements on these owner-access rules, allows manufacturers to keep confidential business information private, takes effect 3 months after enactment, and does not authorize new appropriations.

What it means for you#

• If you own a covered vehicle, you would get real-time access to data generated by your vehicle and any user data you put into it.
• You could control that data at no extra cost beyond the purchase price, delete user data, and set user preferences through an open API.
• Manufacturers generally could not access or share your data without your clear written consent, except to improve vehicle safety or performance, to respond to an emergency, or when compelled by a warrant or court order (with notice to you and 48 hours to object).
• The law would prevent certain foreign governments from receiving personally identifiable information of U.S. citizens or lawful permanent residents.
• The FTC would enforce these rules and report to Congress about data access, risks, and options to give owners standardized access.

Expenses#

• The bill states no additional funds are authorized; the FTC must use amounts otherwise appropriated to carry out the requirements.
• No publicly available information on estimated costs to industry, owners, or federal agencies is provided in the bill text.

Proponents' View#

No publicly available information.

Opponents' View#

No publicly available information.