Car Privacy Rights Act of 2026
- Sponsor
- Sen. Merkley, Jeff [D-OR]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Sep 30, 2026
Bottom line
This bill aims to significantly enhance consumer privacy rights over data generated by their vehicles by restricting data monetization, increasing transparency, and providing robust enforcement mechanisms.
What it actually does
This bill establishes comprehensive restrictions on how covered entities, including car manufacturers, insurance companies, and application developers, can collect, process, share, or sell consumer car-related data. It mandates affirmative express consent for data sharing or selling, prohibits retaliation against consumers who withhold consent, and grants consumers rights to access their data and privacy policies. Crucially, it imposes an absolute ban on the sharing or selling of precise geolocation data.
Proponents argue
Supporters argue that consumers currently lack meaningful control over the vast amounts of data their modern vehicles collect, leading to potential privacy abuses, unauthorized data sales, and even discrimination. This bill would empower individuals by giving them agency over their personal car data, preventing its commercial exploitation, and protecting highly sensitive information like precise geolocation.
Opponents contend
Potential opponents might contend that these stringent restrictions could stifle innovation in automotive services, increase compliance costs for manufacturers and service providers, and limit the development of beneficial data-driven features or safety improvements. They may also argue that the broad definition of 'consumer car-related data' could encompass information necessary for routine vehicle operation or maintenance, creating undue burdens.
The bill is relatively short and clearly structured, making it accessible for an informed reader to understand its core provisions within a reasonable timeframe.
Section 3
Permitted Purposes for Data Collection and Processing
This section outlines a limited set of specific reasons for which a covered entity (such as a car manufacturer or insurance company) is allowed to collect or process consumer car-related data. These permissible purposes include providing requested products or services, complying with legal obligations, protecting life or physical safety, investigating fraud, conducting approved scientific research, and performing internal operations on de-identified data.
Supporters argue
Supporters argue this provision is crucial for establishing a baseline of privacy, ensuring that data collection is not open-ended but tied to legitimate, consumer-benefiting purposes or legal necessities. It prevents indiscriminate data harvesting.
Critics contend
Opponents might argue that this list is too restrictive, potentially hindering the development of new services or diagnostic tools that could benefit consumers but fall outside the enumerated exceptions. They may also claim it creates an undue burden for compliance.
Tradeoffs
This provision balances consumer privacy with the operational needs and potential innovation of covered entities. The tension lies in defining 'reasonably necessary' and ensuring the list of exceptions is comprehensive enough without creating loopholes.
Section 4(a)-(c)
Affirmative Express Consent for Data Sharing/Selling and Anti-Retaliation
This provision makes it unlawful for covered entities to share or sell consumer car-related data without first providing a clear, conspicuous, and accessible notice to the consumer, and then obtaining their explicit affirmative express consent. It also prohibits entities from denying services or discriminating against consumers for withholding or revoking consent, unless data sharing is 'reasonably necessary' for the service or the data's value justifies a price difference.
Section 4(e)
Ban on Sharing or Selling Precise Geolocation Data
This subsection explicitly makes it unlawful for any covered entity to share or sell any data that relates to a precise geolocation. This is a stricter prohibition than the general consent requirement, meaning even with consumer consent, this specific type of data cannot be commercially shared or sold.
Section 5
Consumer Rights to Privacy Policy and Data Access
This section mandates that covered entities provide a detailed and accurate privacy policy to consumers, outlining their data practices and how consumers can exercise their rights. Upon request, entities must confirm if they are collecting or processing a consumer's data, provide access to that data, and list any third parties with whom data has been shared or sold (if consent was given).
Section 6
Annual Reporting to the FTC
Covered entities are required to submit annual reports to the Federal Trade Commission (FTC) detailing their consumer data privacy practices, including what data is collected, why, and with whom it is shared or sold. The FTC, in turn, must summarize and publish these reports annually for Congress and the public.
Section 7
Guidance on Domestic Violence and Car Applications
This section directs the FTC, in consultation with the FCC and NHTSA, to issue guidance or regulations within 180 days of enactment. This guidance will address how car manufacturers can tackle domestic violence issues related to their applications that have the capability to determine the precise geolocation of an individual, consumer car, or device.
Section 8
Comprehensive Enforcement Mechanisms
This section establishes robust enforcement mechanisms. Violations are treated as unfair or deceptive acts under the FTC Act, granting the FTC broad enforcement powers. State attorneys general can bring civil actions on behalf of residents. Crucially, it creates a private right of action, allowing individual consumers to sue violating entities for damages (minimum $5,000 per violation or actual damages, whichever is greater), punitive damages, and equitable relief.
Defines 'affirmative express consent' as an affirmative act by a consumer that clearly communicates authorization, is in response to a specific notice, and explicitly excludes general terms of service, hovering, fraudulent means, or notices offering only an 'accept' option.
Section 2(1)
Why it matters:Standard legislative practice to define terms upfront, but the specificity here makes it fundamentally consequential for the bill's consent requirements.
Case for: Proponents argue this robust definition is essential to prevent dark patterns and ensure genuine, informed consent, making the consent requirement truly meaningful for consumer protection.
Case against: Opponents might argue that such a strict definition could make obtaining consent overly cumbersome for legitimate services, leading to user friction and increased development costs for compliance.
Estimated impact: High, as it dictates the practical implementation of all consent-based data practices for covered entities.
Defines 'de-identified data' with stringent requirements: not reasonably linkable to an individual or device, reasonable measures to prevent re-identification, a public commitment by the covered entity not to re-identify, and contractual obligations for recipients to meet these standards.
Section 2(9)
Why it matters:Standard legislative practice for defining terms, but the strictness of this definition is a key policy choice that impacts the scope of data use without consent.
Case for: Proponents argue that a robust definition of de-identified data is necessary to prevent companies from claiming data is anonymous when it can still be re-linked to individuals, thus closing a potential loophole for data exploitation.
Case against: Opponents might contend that the requirements for de-identification are overly stringent and difficult to meet in practice, potentially limiting the legitimate use of anonymized data for research and product improvement.
Estimated impact: High, as it determines what data can be used without explicit consent under the de-identification exception outlined in Section 3.