S. 3494 — Auto Data Privacy and Autonomy Act

This section defines nine terms used in the Act: (1) Commission, meaning the Federal Trade Commission; (2) covered data, meaning user data and vehicle-generated data; (3) covered vehicle, meaning a motor vehicle or a vehicle primarily used for farming or construction; (4) geolocation data, meaning information revealing the past or present physical location of an individual, covered vehicle, or device; (5) motor vehicle, having the meaning given in 49 U.S.C. §30102(a) and including a motor vehicle trailer; (6) personally identifiable information, meaning information that directly identifies an individual (e.g., name, address, Social Security number, telephone number, or email address), indirectly identifies an individual (e.g., gender, race, or date of birth), or reveals an individual's geolocation data or internet activity; (7) user data, meaning data transferred to a covered vehicle by its owner or user; (8) user preference, meaning any choice with respect to a configurable setting of a covered vehicle made by or for the benefit of its owner or user; and (9) vehicle-generated data, meaning all electronic data generated or processed onboard a covered vehicle (e.g., by sensors, receivers, computer processing units, or other components) and including such vehicle's geolocation data.

This section prohibits manufacturers of covered vehicles from (1) accessing covered data without the vehicle owner's affirmative, informed, specific, unambiguous, written consent that may be easily withdrawn (or next of kin's consent upon owner's death or incapacity), unless solely to improve vehicle performance or safety; (2) selling, leasing, or sharing such data without equivalent owner consent or as required by lawfully executed warrant, court order with notice and 48-hour objection period, or to facilitate emergency response; and (3) selling, licensing, renting, trading, transferring, releasing, disclosing, providing access to, or otherwise making available personally identifiable information of U.S. citizens or lawful permanent residents to North Korea, China, Russia, Iran, or Venezuela. This section also directs the Commission, in consultation with the Attorney General, Secretary of Homeland Security, Secretary of Transportation, and Federal Communications Commission, to submit to Congress, not later than 180 days after enactment, a report on covered data that describes (1) types accessed by manufacturers; (2) non-manufacturer individuals and entities accessing such data; (3) federal and state government entities accessing and using such data; (4) individuals and entities to whom such data may be sold or shared; (5) foreign governments receiving such data and their uses; (6) cybersecurity capabilities and risks for covered vehicles; (7) data compromises, including prevalence and foreign government ties; and (8) feasibility of a technology-neutral, standards-based secure interface for owner access to such data.

This section requires manufacturers of covered vehicles to provide owners with access to and control over all covered data generated, processed onboard, or transferred to the vehicle, at no cost beyond the purchase price; in real time; without restrictions on use or third-party access; without fees or licenses for decryption or manufacturer devices; through the vehicle's interface port and wireless transmission (if equipped); and via an open application programming interface that enables data deletion and user preference settings. The section preempts any conflicting state or local laws.

This section establishes Federal Trade Commission (FTC) enforcement of the Act by (1) treating violations as unfair or deceptive acts or practices under FTC rulemaking authority (15 U.S.C. 57a(a)(1)(B)), and (2) incorporating all applicable terms, jurisdiction, powers, duties, penalties, privileges, and immunities of the FTC Act (15 U.S.C. 41 et seq.). It preserves the FTC's authority under other laws.

This section exempts manufacturers of covered vehicles from disclosing confidential business information under this Act, except as provided in section 4 (i.e., as defined in 49 CFR 512.3(c)).