Auto Data Privacy and Autonomy

Summary#

This bill, the Auto Data Privacy and Autonomy Act, would stop vehicle manufacturers from accessing, selling, or otherwise sharing most data from covered vehicles without the owner's clear consent. "Covered data" includes user data transferred to the vehicle and vehicle-generated data such as sensor outputs and geolocation. Manufacturers could access covered data only if the owner (or next of kin, if the owner is dead or incapacitated) gives free, informed, specific, written consent that can be easily withdrawn, or if the access is solely to improve vehicle performance or safety. The bill bars manufacturers from selling or sharing covered data except for a lawful warrant, a court order with owner notice and time to object, to facilitate emergency response, or with owner consent given in the same clear way.

The bill also specifically forbids selling or otherwise making personally identifiable information available to five named foreign countries: the Democratic People's Republic of Korea, the People's Republic of China, the Russian Federation, the Islamic Republic of Iran, and the Bolivarian Republic of Venezuela. The Federal Trade Commission (FTC), in consultation with other federal agencies, must report to Congress within 180 days on who accesses covered data, how it is used, cybersecurity risks, compromises, foreign uses, and the feasibility of a technology-neutral, standards-based secure interface for owners to access and control their data.

Manufacturers must give vehicle owners access to and control of all covered data generated or processed onboard or transferred to the vehicle: at no cost beyond the vehicle's purchase price, in real time, without restriction on use or requiring payment or proprietary devices to decrypt or access the data. Access must be available via the vehicle's interface port and wireless transmission (if equipped), and must support an open application programming interface that allows deleting user data and setting user preferences. The bill preempts conflicting state rules for these owner access requirements. Violations are treated as unfair or deceptive acts under the FTC Act and enforced by the FTC. The bill exempts required confidential business information disclosures and takes effect three months after enactment. No additional federal appropriations are authorized to carry out the law.

What it means for you#

• If passed, vehicle owners would have a legal right to get their vehicle's data and to control it in real time without extra charges beyond the vehicle price.
• Manufacturers generally could not access or share your vehicle's data without your clear written consent, except for safety or other narrow exceptions spelled out in the bill.
• You could withdraw consent easily, and you could delete user data or change user preferences through an open interface or API the manufacturer must provide.
• Certain foreign transfers of personally identifiable information would be banned by name under this bill.
• Law enforcement access is still possible under warrants, some court orders, or emergency response situations as described in the bill.

Expenses#

• The bill requires manufacturers to provide owner access at no cost beyond the vehicle purchase price.
• The bill says no additional federal funds are authorized; the FTC must carry out the law using amounts otherwise appropriated.
• No publicly available information on estimated costs to manufacturers, consumers, or federal agencies beyond the statements above.

Proponents' View#

No publicly available information.

Opponents' View#

No publicly available information.