DRIVER Act

The DRIVER Act requires motor vehicle manufacturers to give owners free, real-time, secure access to and joint control of their vehicle's data, with no restrictions on lawful use, and prohibits certain sales of sensitive data without opt-out consent, enforced by the Federal Trade Commission. Sec. 2, Motor vehicle owner access to motor vehicle data: Manufacturers must provide owners secure, real-time access to vehicle data at no extra cost, without restrictions on lawful use or third-party authorization (except to foreign adversaries), without fees or licenses, through an interface port and wireless transmission if equipped, enabling data deletion, and complying with voluntary cybersecurity standards. Sec. 3, Additional motor vehicle owner data access controls: Manufacturers cannot sell covered data (biometric identifiers, precise geolocation, driver behavior) without a clear opt-out; fleet owners must give drivers an opt-out for such sales, with exceptions for employment-related data unless used for harmful profiling; sales to North Korea, China, Russia, Iran, and Venezuela are banned; and 18 exceptions define what is not a sale, such as transfers to emergency responders or for safety recalls. Sec. 4, Enforcement by Commission: Violations of section 2 are treated as unfair or deceptive acts under FTC regulations, and the FTC enforces it with full powers under the FTC Act. Sec. 5, Disclosure of confidential business information: The Act does not require manufacturers to divulge confidential business information, except as in section 2. Sec. 6, Relationship to state law: No state or local law may maintain or enforce any provision relating to section 2 of this Act. Sec. 7, Definitions: Defines key terms including biometric identifier (e.g., fingerprints, facial features), covered data (personal data on biometrics, geolocation, or driver behavior, excluding deidentified info), driver behavior (profiling causing harmful effects), motor vehicle (as in federal law, including trailers), motor vehicle data (electronic data from onboard sensors), motor vehicle fleet owner (owner of 5+ vehicles or long-term lessee), motor vehicle owner (owner or long-term lessee), personal data (linked to an identifiable person), precise geolocation (within 1,750 feet), sale (exchange for money, excluding user-requested services), and user data (data from personal devices, not vehicle data).