Summary#
The Car Privacy Rights Act of 2026 would create a new federal law; it does not amend an existing Act. Its stated goals are to restrict sales of car-related data and increase transparency about data practices. The bill is at an early stage and is not law; passage is uncertain.
- Covered entities could collect or process a consumer’s car-related data only when reasonably necessary for one of the bill’s listed purposes. These include providing a requested product or service, complying with law or a government inquiry, handling contracts and legal claims, protecting safety or security, investigating fraud or illegal activity, approved public-interest research, and making data de-identified. The bill also permits certain internal uses of de-identified data.
- Before sharing or selling data, a covered entity would generally have to give a clear, detailed notice and get the consumer’s affirmative express consent. Consumers could revoke consent through the entity’s website or application. Sharing or selling precise geolocation data would be prohibited, with no stated exception.
- Covered entities could not deny a good or service or retaliate against consumers for refusing or revoking consent, subject to an exception where sharing or selling the data is reasonably necessary for the service or the data’s value reasonably relates to a price or quality difference.
- Covered entities would have to provide privacy policies and, on request, confirm whether they collect or process a consumer’s data, give access to it, and—if the consumer consented to sharing or sale—identify third-party recipients.
- The Federal Trade Commission (FTC) would enforce the law, make necessary rules, and issue guidance or regulations with the Federal Communications Commission and National Highway Traffic Safety Administration on domestic-violence issues involving car-maker applications that can locate people. State officials and consumers could also bring civil cases.
What it means for you#
- Consumers: The bill covers people who are U.S. citizens, residents, or located in the United States, and cars they own, lease, or operate outside a commercial or employment context. It would give you data-access and consent rights, but does not create a general right to have data deleted.
- Consumers: You could refuse or revoke consent to sharing or sale without being denied service or treated worse, except where the bill’s service-necessity or data-value exception applies. Precise geolocation data could not be shared or sold.
- Car manufacturers, insurers, app companies, and other covered entities: They would have to follow the limits on collection, processing, sharing, and sale; provide notices and privacy policies; answer consumer data requests; and file annual reports with the FTC.
- Consumers and covered entities: A consumer could sue over data collected, processed, shared, or sold in violation of the bill. If the consumer wins, a court could award at least $5,000 per violation, adjusted for inflation, or actual damages if greater, as well as punitive damages, other relief, and legal costs.
- FTC and state officials: The FTC would enforce the law. State attorneys general and other authorized state officials could bring civil actions on residents’ behalf.
Money#
No cost information is in the available material.
- The bill requires FTC rules, guidance or regulations, and annual reports to Congress, but gives no estimate of government staffing or costs. Covered entities would also have to report annually and meet the bill’s privacy requirements; their costs are not estimated.
- Successful consumer lawsuits could result in damages of at least $5,000 per violation, adjusted for inflation, or greater actual damages, plus possible punitive damages and legal costs. These are potential court awards, not a set fee or tax.
What is unclear#
- The bill does not set an effective date or say how long covered entities have to meet its requirements.
- It does not define key terms such as “reasonably necessary,” “share,” or “sell,” or explain how the FTC should apply them.
- It sets no deadline or detailed process for responding to consumer data requests, and does not specify a process for resolving disagreements about a request.
- The bill does not explain how its rules would interact with existing federal or state privacy laws. The supplied material does not include those laws for comparison.
- No publicly available information on implementation costs, staffing needs, or how many entities and consumers would be affected.
Case for#
- A possible argument for the bill is that car-related data can include location, vehicle condition, and information about occupants. Requiring consent before sharing or selling much of this data, and banning sharing or sale of precise geolocation data, would give consumers stronger control.
- Requiring clear notices, privacy policies, access to data, and a way to revoke consent could make data practices easier for consumers to understand and act on.
- Limits on collecting and processing data could reduce unnecessary use, while the listed exceptions allow specified activities such as providing requested services, recalls, safety, security, and approved research.
- FTC, state, and consumer enforcement could provide several ways to challenge violations.
Case against#
- One concern is that terms such as “reasonably necessary” are undefined, while the list of permitted purposes is broad. This could leave uncertainty about what data collection and use are allowed.
- The bill creates significant reporting, notice, consent, and response duties but does not set detailed procedures or deadlines. That may make compliance harder to assess consistently.
- Consumers could bring lawsuits with a minimum damages amount per violation, but the bill does not explain how separate violations would be counted. This could make potential legal exposure difficult to predict.
- The bill requires federal guidance or regulations on domestic-violence issues involving certain applications, but does not specify what protections those rules must provide or how affected people would be involved.