Auto Data Privacy and Autonomy Act
- Sponsor
- Rep. Burlison, Eric [R-MO-7]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Dec 16, 2025
Bottom line
The bill aims to grant vehicle owners comprehensive control and privacy over their vehicle's data, restricting manufacturer access and sharing, while also prohibiting data transfer to certain foreign adversaries.
What it actually does
This bill prohibits vehicle manufacturers from accessing, selling, leasing, or otherwise sharing vehicle-generated and user data without the explicit, informed consent of the vehicle owner, with limited exceptions for safety, emergency response, or legal warrants. It also mandates that manufacturers provide vehicle owners with real-time, free, and unrestricted access to and control over all covered data, including the ability to delete user data and set user preferences via an open application programming interface. Additionally, it bans the transfer of personally identifiable information to specific foreign adversaries.
Proponents argue
Proponents argue the bill empowers consumers by giving them full control over their personal and vehicle-generated data, protecting privacy from commercial exploitation and potential foreign espionage. It ensures data security and prevents manufacturers from monetizing data without consent, fostering a more transparent and competitive ecosystem for vehicle data services.
Opponents contend
Opponents might argue that the strict consent requirements and real-time data access mandates could hinder vehicle safety improvements, legitimate research, and the development of advanced vehicle features that rely on aggregated data. They may also raise concerns about the technical feasibility and cost implications for manufacturers to implement such a comprehensive data access framework, potentially increasing vehicle prices.
The bill is concise, allowing for a quick read, but its implications for data privacy, automotive industry practices, and national security warrant careful consideration beyond a superficial review.
Section 2
Definitions of Key Terms
This section establishes the precise meanings for terms central to the bill, such as "covered data" (which includes both data transferred by the user and data generated by the vehicle itself), "covered vehicle" (broadly including motor vehicles and farming/construction vehicles), and "personally identifiable information" (which includes direct identifiers, indirect identifiers, geolocation, and internet activity). These definitions are critical for determining the scope of the bill's protections and mandates.
Supporters argue
Supporters argue that clear and comprehensive definitions are essential to ensure the bill's protections are unambiguous and cover the full spectrum of data generated and used by modern vehicles, preventing loopholes.
Critics contend
Critics might argue that some definitions, particularly "personally identifiable information" and "vehicle-generated data," are overly broad and could inadvertently capture data not intended for strict privacy controls, potentially hindering innovation or legitimate vehicle diagnostics.
Tradeoffs
Balances the need for broad data protection with the potential for overreach into data that might be necessary for vehicle functionality or safety improvements.
Section 3(a)
Prohibition on Manufacturer Data Access and Sharing
This provision generally prohibits vehicle manufacturers from accessing, selling, leasing, or otherwise sharing "covered data" (user data and vehicle-generated data) without the explicit, informed, written, and easily withdrawable consent of the vehicle owner or their next of kin. Exceptions for access include improving vehicle performance or safety, and exceptions for sharing include lawfully executed warrants, court orders with notice, or emergency responses.
Section 3(a)(3)
Prohibition on Sharing Personally Identifiable Information with Foreign Adversaries
This specific subsection prohibits manufacturers from selling, licensing, renting, trading, transferring, releasing, disclosing, providing access to, or otherwise making available personally identifiable information of U.S. citizens or lawful permanent residents to five named foreign governments: Democratic People's Republic of Korea, People's Republic of China, Russian Federation, Islamic Republic of Iran, and Bolivarian Republic of Venezuela.
Section 4(a)
Mandate for Vehicle Owner Data Access and Control
This section mandates that manufacturers provide vehicle owners with real-time, free, and unrestricted access to and control over all covered data. This access must be available through the vehicle's interface port and wirelessly (if equipped), without requiring fees or proprietary devices. It also requires an open application programming interface (API) that facilitates deletion of user data and enables setting user preferences.
Section 4(b)
Federal Preemption of State Laws on Data Access
This subsection states that Section 4 (regarding vehicle owner's data access and control) supersedes any conflicting State or political subdivision statutes, rules, requirements, or other legal obligations. This ensures a uniform federal standard for data access and control.
Section 5
Enforcement by the Federal Trade Commission
This section designates violations of the Act as unfair or deceptive acts or practices under the Federal Trade Commission Act. It grants the FTC the authority to enforce the Act using its existing powers, duties, and jurisdiction, ensuring that penalties and privileges under the FTC Act apply.
Allows manufacturers to access covered data "solely to improve covered vehicle performance or safety" without explicit consent. It also allows sharing of covered data without consent if required by a lawfully executed warrant, court order (with notice and objection period), or to facilitate an emergency response.
Section 3(a)(1)(B) and 3(a)(2)(A)
Why it matters:Standard legislative practice to include necessary exceptions to broad prohibitions.
Case for: Proponents argue these exceptions are crucial for public safety (emergency response, vehicle performance/safety improvements) and legitimate law enforcement needs, balancing privacy with essential functions.
Case against: Critics might argue that the "improve covered vehicle performance or safety" exception is broad and could be exploited by manufacturers to access data without consent for purposes beyond strict safety, potentially undermining the bill's intent. The court order exception with 48-hour notice is a good balance.
Estimated impact: Allows for critical safety and emergency functions to continue, potentially impacting all vehicle owners in emergency situations or through vehicle updates.
States that nothing in the Act, except for Section 4 (owner's data access), requires a manufacturer to divulge confidential business information as defined in 49 CFR 512.3(c).
Section 6
Why it matters:Standard legislative practice to include carve-outs for proprietary information, but its placement and external reference make it less prominent.
Case for: Manufacturers would argue this protects their intellectual property and trade secrets, which are vital for competition and innovation, ensuring that the data access mandates do not force them to reveal sensitive design or operational details.
Case against: Consumer advocates might argue that this provision could create a loophole, allowing manufacturers to classify certain data as "confidential business information" to avoid providing full access to owners, potentially undermining the spirit of Section 4.
Estimated impact: Could limit the scope of data available to owners or third parties if manufacturers successfully argue certain data falls under "confidential business information."