Auto Data Privacy and Autonomy Act
- Sponsor
- Sen. Lee, Mike [R-UT]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Dec 16, 2025
Bottom line
The bill aims to significantly enhance vehicle owner privacy and control over their vehicle's data while also addressing national security concerns regarding data sharing with foreign adversaries.
What it actually does
This bill prohibits manufacturers of covered vehicles from accessing, selling, or sharing vehicle-generated or user data without explicit, informed consent from the vehicle owner, except for vehicle performance/safety improvements or in response to specific legal orders or emergencies. It also forbids sharing personally identifiable information with designated adversarial foreign governments. Furthermore, the bill mandates that manufacturers provide vehicle owners with free, real-time, unrestricted access to and control over all covered data, including through an open application programming interface, and preempts related state laws.
Proponents argue
Supporters argue that this legislation is essential to protect individual privacy rights in the era of connected vehicles, ensuring that vehicle owners, not manufacturers, control their personal and vehicle-generated data. They contend it fosters a competitive aftermarket for vehicle services and strengthens national security by preventing sensitive data from falling into the hands of adversarial foreign governments.
Opponents contend
Critics, particularly vehicle manufacturers, are likely to argue that the bill imposes significant and costly regulatory burdens, potentially stifling innovation in vehicle technology and safety features. They may also raise concerns about the technical feasibility and cybersecurity implications of mandated open data access and the aggressive implementation timeline.
The bill is relatively short and clearly structured, making it accessible for an informed reader to understand its core provisions and implications within a reasonable timeframe.
Section 3(a)(1)
Restricting Manufacturer Access to Covered Data
This provision prevents vehicle manufacturers from accessing any data generated by or transferred to a covered vehicle, including user data and vehicle-generated data. The only exceptions are if the vehicle owner (or next of kin) provides explicit, informed, written, and easily withdrawable consent, or if the data access is solely for improving the vehicle's performance or safety.
Supporters argue
Proponents argue this provision is crucial for establishing vehicle owners' fundamental right to privacy and data ownership, preventing manufacturers from unilaterally collecting and utilizing sensitive information without permission.
Critics contend
Opponents might argue that stringent consent requirements, even with a safety exception, could create administrative hurdles that impede rapid diagnostics, proactive maintenance, or the development of new safety features that rely on broad data analysis.
Tradeoffs
This provision balances individual data privacy rights against manufacturers' operational needs for data to improve products and services. It creates a tension between consumer control and the efficiency of data-driven development.
Section 3(a)(2)
Prohibiting Sale or Sharing of Covered Data Without Consent
This section prohibits vehicle manufacturers from selling, leasing, or otherwise sharing covered data. Exceptions are made only when required by a lawfully executed warrant or court order (with owner notice and objection period), to facilitate an emergency response, or with the explicit, informed, written, and easily withdrawable consent of the vehicle owner (or next of kin).
Section 3(a)(3)
Prohibition on Sharing PII with Foreign Adversaries
This provision explicitly forbids vehicle manufacturers from selling, licensing, renting, trading, transferring, releasing, disclosing, or otherwise making available personally identifiable information (PII) of United States citizens or lawful permanent residents to specific foreign governments: the Democratic People's Republic of Korea, the People's Republic of China, the Russian Federation, the Islamic Republic of Iran, and the Bolivarian Republic of Venezuela.
Section 4(a)
Mandating Owner Access and Control of Covered Data
This provision requires vehicle manufacturers to provide owners with free, real-time, and unrestricted access to and control over all covered data generated by or transferred to their vehicle. This access must be available through the vehicle's interface port and wirelessly (if equipped), without requiring fees or proprietary devices. It also mandates an open application programming interface (API) to facilitate user data deletion and setting of user preferences.
Defines "personally identifiable information" to include geolocation data or internet activity of an individual, even if it does not directly identify them by name or other explicit identifiers.
Section 2(6)(C)
Why it matters:While standard legislative practice to define terms upfront, the breadth of this definition has significant implications for data handling and privacy protections, particularly in the context of vehicle data.
Case for: Supporters argue that this broad definition is essential for comprehensive privacy protection, as geolocation and internet activity can be highly revealing and easily linkable to an individual, even without explicit names or addresses, thus preventing loopholes.
Case against: Critics might argue that including non-directly identifying data as PII could create an overly broad regulatory burden, potentially hindering legitimate data analysis that doesn't target specific individuals, or making compliance unnecessarily complex.
Estimated impact: Significantly expands the scope of data protected under Section 3(a)(3)'s prohibition on sharing with adversarial governments, and implicitly under consent requirements for access and sharing.
This subsection states that Section 4, which mandates vehicle owner data access and control, supersedes any statute, rule, requirement, or other legal obligation of a State or political subdivision thereof that relates to these requirements.
Section 4(b)
Why it matters:While federal preemption is a common feature in federal legislation to ensure national uniformity, its placement can obscure its significant impact on state regulatory authority. It centralizes control at the federal level.
Case for: Proponents argue this ensures a uniform national standard for vehicle data access and control, preventing a patchwork of state laws that could complicate compliance for manufacturers and create inconsistencies for consumers across state lines.
Case against: Opponents might contend that preemption stifles states' abilities to enact stronger data privacy protections tailored to local needs or to innovate in regulatory approaches, potentially lowering the overall standard if the federal law is less stringent than some state efforts.
Estimated impact: Centralizes regulatory authority over vehicle data access and control at the federal level, potentially nullifying existing or future state laws on the subject and limiting state-level experimentation in data privacy.