Auto Data Privacy and Autonomy Act

This bill prevents manufacturers of covered vehicles (motor vehicles and farming/construction vehicles) from accessing, selling, or sharing covered data (user data and vehicle-generated data) without the owner's affirmative consent, except for certain safety or legal purposes. It also requires manufacturers to give owners free, real-time access to and control of all covered data. The Federal Trade Commission (FTC) enforces the bill, treating violations as unfair or deceptive acts.

Sec. 2, Definitions: Defines key terms including 'Commission' (FTC), 'covered data' (user data and vehicle-generated data), 'covered vehicle' (motor vehicle or farming/construction vehicle), 'geolocation data' (past or present location), 'personally identifiable information' (direct or indirect identifiers like name, address, social security number, gender, race, date of birth, geolocation, or internet activity), 'user data' (data transferred to the vehicle by the owner or user), 'user preference' (configurable settings choices), and 'vehicle-generated data' (all electronic data generated or processed onboard, including geolocation).

Sec. 3, User data and vehicle-generated data privacy and security: Prohibits manufacturers from accessing covered data unless the owner (or next of kin if owner is dead or incapacitated) gives freely given, informed, specific, unambiguous, written, and easily withdrawn consent, or the access is solely to improve vehicle performance or safety. Prohibits selling, leasing, or sharing covered data unless required by a lawful warrant, a court order with 48-hour notice and hearing opportunity, for emergency response, or with the same type of owner consent. Also prohibits selling or sharing personally identifiable information of U.S. citizens or lawful permanent residents to North Korea, China, Russia, Iran, or Venezuela. Requires the FTC, within 180 days, to report to Congress on types of data accessed, who accesses it, government use, foreign government sharing, cybersecurity risks, data compromise occurrences, and feasibility of a neutral secure interface for owner data access.

Sec. 4, Vehicle owner's data access and control: Manufacturers must provide owners access to and control of all covered data at no extra cost, in real time, without use restrictions, without requiring fees or licenses, through the vehicle's interface port and wireless transmission if equipped, and via an open application programming interface that allows deletion of user data and setting of user preferences. This section supersedes any state laws on the same subject.

Sec. 5, Enforcement: A violation is treated as an unfair or deceptive act under the FTC Act. The FTC enforces the bill with the same powers, penalties, and immunities as under the FTC Act, and nothing limits the FTC's other authority.

Sec. 6, Disclosure of confidential business information: Except for the owner access requirement in section 4, the bill does not require manufacturers to divulge confidential business information as defined in federal regulations.

Sec. 7, Effective date: The bill takes effect 3 months after enactment.

Sec. 8, No new appropriations: No additional funds are authorized; the FTC must use already appropriated funds.