Auto Data Privacy and Autonomy Act

This bill restricts vehicle manufacturers from accessing, selling, or sharing certain data from cars, trucks, farm, and construction vehicles, and gives owners control over their vehicle's data. It tasks the Federal Trade Commission (FTC) with setting standards and reporting on data practices.

Sec. 2, Definitions: Defines key terms including 'covered vehicle' (motor vehicles and farm/construction vehicles), 'operator data' (electronic data generated or stored onboard), 'personally identifiable information' (direct or indirect identifiers like name, location), and 'secure' and 'technology-neutral' interfaces.

Sec. 3, Operator data privacy and security: Prohibits manufacturers from accessing operator data without the owner's freely given, written, and revocable consent, except for improving vehicle performance or safety. Bans selling or sharing operator data unless required by warrant, court order (with 48-hour notice to owner), or for emergency response, or with owner or next-of-kin permission. Also bans sharing personally identifiable information of U.S. citizens or permanent residents with North Korea, China, Russia, Iran, or Venezuela. Requires the FTC to report to Congress within 180 days on data access, sharing, cybersecurity, and foreign government involvement.

Sec. 4, Operator data access: Requires manufacturers to give owners free, unrestricted access and control of their operator data via a secure, technology-neutral, standards-based interface, without fees or proprietary devices. Mandates open APIs for data deletion and setting user preferences.

Sec. 5, Standards: Directs the FTC to report on current data practices within 180 days, then within one year set standards for the required interface in coordination with NIST and stakeholders. Standards must be reviewed and revised every five years.

Sec. 6, Enforcement: Treats violations as unfair or deceptive acts under the FTC Act, giving the FTC full enforcement powers, penalties, and privileges.

Sec. 7, Relation to other laws: This bill overrides any conflicting state or federal laws or regulations.

Sec. 8, Disclosure of confidential business information: Does not require manufacturers to reveal confidential business information, except as needed for owner data access.

Sec. 9, Effective date: Takes effect three months after enactment.

Sec. 10, No new appropriations: The FTC must use existing unobligated funds to carry out this act.