Auto Data Privacy and Autonomy Act

This bill prevents covered vehicle manufacturers from accessing, selling, or sharing certain vehicle data without owner consent, and requires them to provide owners with free access and control of that data. Sec. 2, Definitions: Defines key terms including 'covered vehicle' (motor vehicles and farm/construction vehicles), 'operator data' (electronic data generated or stored onboard), 'personally identifiable information' (direct or indirect identifiers like name, location), and 'secure' and 'technology-neutral' interfaces. Sec. 3, Operator data privacy and security: Prohibits manufacturers from accessing operator data without affirmative, written, and easily withdrawn consent, except for vehicle performance or safety improvements. Also bans selling or sharing data unless required by warrant, court order with 48-hour notice, emergency response, or owner permission. Additionally, prohibits sharing personally identifiable information of U.S. citizens or permanent residents with North Korea, China, Russia, Iran, or Venezuela. Requires the Federal Trade Commission (FTC) to report to Congress within 180 days on data access, sharing, cybersecurity, and foreign government involvement. Sec. 4, Operator data access: Requires manufacturers to give owners free access and control of operator data without fees, licenses, or proprietary devices. Must enable open application programming interfaces for data deletion and user preference settings, using a technology-neutral, secure, standards-based interface. Sec. 5, Standards: FTC must report on current data practices within 180 days, then within one year establish standards for the secure interface in coordination with the National Institute of Standards and Technology, industry stakeholders, and other agencies. Standards must be reviewed and revised at least every five years. Sec. 6, Enforcement: Violations are treated as unfair or deceptive acts under the FTC Act, with FTC enforcement powers and penalties. Sec. 7, Relation to other laws: This act supersedes any conflicting state or federal laws. Sec. 8, Disclosure of confidential business information: Does not require manufacturers to reveal confidential business information except as in section 4. Sec. 9, Effective date: Takes effect three months after enactment. Sec. 10, No new appropriations: FTC must use existing unobligated funds.