Sponsors (5)
The bill gives vehicle owners much greater control over and access to vehicle data and centralizes FTC enforcement—boosting privacy, competition, and consumer remedies—while imposing new compliance, security, and implementation costs and limiting some state-level protections and public oversight.
Vehicle owners (drivers, homeowners, small-business owners, seniors) get much stronger control over vehicle-generated data: clearer definitions of covered data, explicit consent requirements, the ability to access and delete data in real time, and to authorize third parties.
Independent mechanics, app developers, and other third parties can access vehicle data via open APIs and owner authorization, promoting competition, lower repair costs, and more aftermarket services.
The FTC is designated as the centralized enforcer and violations are treated as unfair/deceptive practices with civil remedies, creating more predictable enforcement and stronger consumer remedies.
Vehicle manufacturers and suppliers face substantial new engineering, compliance, and legal costs from broad data obligations and access requirements, which may increase vehicle prices for consumers.
Real-time open access and mandated APIs increase the risk of unauthorized remote access or data misuse if security standards and safeguards are not robust.
Strict written consent, easy withdrawal, and verification requirements may complicate providing diagnostics, telematics, emergency assistance, and other services, creating operational uncertainty for manufacturers and responders.
Based on analysis of 8 sections of legislative text.
Gives vehicle owners real-time control of vehicle and user data, restricts manufacturer sharing without explicit written consent, and bans transfers of U.S. persons' personal data to five named foreign governments.
Introduced December 16, 2025 by Eric Burlison · Last progress December 16, 2025
Requires automakers to give vehicle owners real-time access to and control over data generated by or transferred to their vehicles, restricts manufacturers from accessing or sharing that data without clear, written consent (with limited safety and legal exceptions), and bans transfer of U.S. persons’ personally identifiable information to five named foreign governments. Enforcement is through the Federal Trade Commission using existing authority, the FTC must report to Congress on industry practices within 180 days, the law takes effect three months after enactment, and no new appropriations are provided for implementation.