Auto Data Privacy and Autonomy Act

This bill prevents vehicle manufacturers from accessing, selling, or sharing data from covered vehicles without the owner's consent, and requires manufacturers to give owners access to and control over that data. It is enforced by the Federal Trade Commission (FTC).

Sec. 2, Definitions: Defines key terms. 'Covered data' includes user data (transferred by the owner/user) and vehicle-generated data (electronic data from the vehicle's sensors and components, including geolocation). 'Covered vehicle' means a motor vehicle or a vehicle used for farming or construction. 'Personally identifiable information' includes direct identifiers (name, SSN), indirect identifiers (gender, race), and geolocation or internet activity.

Sec. 3, User data and vehicle-generated data privacy and security: Manufacturers cannot access covered data unless the owner gives affirmative, written, freely given, specific, and easily withdrawn consent, or if access is solely to improve vehicle performance or safety. They cannot sell, lease, or share covered data unless required by a warrant, court order (with 48-hour notice to owner), or for emergency response, or with the owner's affirmative consent. They also cannot sell or share personally identifiable information of U.S. citizens or permanent residents with North Korea, China, Russia, Iran, or Venezuela. Within 180 days, the FTC must report to Congress on data access, sharing, cybersecurity risks, and the feasibility of a neutral data access interface.

Sec. 4, Vehicle owner's data access and control: Manufacturers must give owners real-time access to and control of all covered data at no extra cost, without restrictions on use or third-party access, without requiring fees or proprietary licenses, through the vehicle's interface port and wireless transmission if equipped, and via an open API that allows data deletion and user preference setting. This section overrides any state laws on the same topic.

Sec. 5, Enforcement: Violations are treated as unfair or deceptive acts under the FTC Act. The FTC enforces this bill with the same powers and penalties as under that Act.

Sec. 6, Disclosure of confidential business information: Except for the owner access requirement in Sec. 4, the bill does not require manufacturers to reveal confidential business information.

Sec. 7, Effective date: The bill takes effect 3 months after enactment.

Sec. 8, No new appropriations: No additional funds are authorized; the FTC must use existing funds.