H.R. 6734 — Auto Data Privacy and Autonomy Act

This section establishes definitions for nine terms used in the Act, including (1) Commission, meaning the Federal Trade Commission; (2) covered data, meaning user data and vehicle-generated data; (3) covered vehicle, meaning a motor vehicle or a vehicle primarily used for farming or construction; (4) geolocation data, meaning information revealing the past or present physical location of an individual, covered vehicle, or device; (5) motor vehicle, having the meaning given in 49 U.S.C. 30102(a) and including a motor vehicle trailer; (6) personally identifiable information, meaning information that directly identifies an individual (e.g., name, address), indirectly identifies an individual (e.g., gender, race), or reveals geolocation data or internet activity; (7) user data, meaning data transferred to a covered vehicle by its owner or user; (8) user preference, meaning any choice with respect to a configurable setting of a covered vehicle made by or for its owner or user; and (9) vehicle-generated data, meaning all electronic data generated or processed onboard a covered vehicle (e.g., by sensors or computer processing units), including its geolocation data.

This section prohibits manufacturers of covered vehicles from (1) accessing covered data without affirmative owner consent that is freely given, informed, specific, unambiguous, in writing, and easily withdrawn—or without the owner's next of kin in cases of death or incapacity—or unless accessed solely to improve vehicle performance or safety; (2) selling, leasing, or sharing such data without a lawfully executed warrant, court order with notice and 48 hours to object, emergency response requirement, or qualifying owner consent; and (3) selling, licensing, renting, trading, transferring, releasing, disclosing, providing access to, or otherwise making available personally identifiable information of U.S. citizens or lawful permanent residents to North Korea, China, Russia, Iran, or Venezuela. This section further directs the Commission, in consultation with the Attorney General, Secretary of Homeland Security, Secretary of Transportation, and Federal Communications Commission, to submit to Congress, not later than 180 days after enactment, a report describing covered data types accessed by manufacturers; other individuals or entities accessing such data; federal and state government access and uses; entities to whom data is sold or shared; foreign governments receiving such data and their uses; cybersecurity capabilities and risks for covered vehicles; data compromise occurrences (including prevalence and foreign government ties); and feasibility of a technology-neutral, standards-based secure interface for owner access to such data.

This section requires manufacturers of covered vehicles to provide owners with access to and control over all covered data generated, processed onboard, or transferred to the vehicle (1) at no cost beyond the purchase price, (2) in real time, (3) without restrictions on use or third-party access authorization, (4) without fees or licenses for decryption or manufacturer-provided devices, (5) via the vehicle’s interface port and wireless transmission (if equipped), and (6) through an open application programming interface that enables user data deletion and preference settings. The section supersedes any conflicting state or local laws.

This section establishes Federal Trade Commission (FTC) enforcement of the Act by treating violations as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act (15 U.S.C. 57a(a)(1)(B)). It further (1) directs the FTC to enforce the Act using all applicable terms, jurisdiction, powers, and duties of the FTC Act (15 U.S.C. 41 et seq.); (2) subjects violators to the penalties, privileges, and immunities of the FTC Act; and (3) preserves the FTC's authority under other laws.

This section exempts manufacturers of covered vehicles from disclosing confidential business information (as defined in 49 CFR § 512.3(c)), except as provided in section 4.