WASHINGTON – Senators Mike Lee (R-UT) and Jeff Merkley (D-OR) introduced the bipartisan Auto Data Privacy and Autonomy Act, legislation to restore vehicle owners’ control over their personal data in an era of rapidly advancing automotive technology. With connected vehicles projected to make up 95% of all new vehicles on the road by 2030, this bill ensures Americans retain the right to privacy and autonomy over their vehicle data. Representative Eric Burlison (R-MO) leads the companion bill in the House.

“Ownership should mean control,” said Senator Lee. “Americans deserve to decide who has access to their personal data and how it is used—whether they are driving to work, harvesting crops, or operating machinery on a construction site. This bill empowers individuals to regain control of their vehicle data and restores transparency to a system that has left too many in the dark.”

“You shouldn’t be worried about billionaire corporations invading your privacy and stealing your data every time you start your car,” said Senator Merkley. “Our bipartisan bill is a common-sense solution to ensure every American has control over their vehicle data and the freedom to choose how it is used.”

“Americans shouldn’t have to trade their privacy for convenience when driving their cars,” said Representative Burlison. “This legislation prioritizes the rights of consumers, safeguarding their sensitive personal information from exploitation. I’m grateful to Sen. Mike Lee for leading this effort in the Senate. The Auto Data Privacy and Autonomy Act puts Americans back in the driver’s seat when it comes to their personal data.  Americans should control their own data.”

“NAFA, the national association of public and private fleet managers, is pleased to see progress on the important subject of data access for vehicle owners and lessees” said Bill Schankel, the CEO of NAFA. “We appreciate the efforts of Senator Lee and Representative Burlison in developing legislation to ensure that vehicle owners and lessees have unrestricted access to the data generated by the vehicles they operate, data that is critical to ongoing improvements in efficient fleet operations. We look forward to working with the Congress and other stakeholders in developing effective bipartisan legislation on vehicle data access.”

"The American Car Rental Association (ACRA) strongly supports the Auto Data Privacy and Autonomy Act, which aims to protect consumer data privacy and give vehicle owners greater control over their data. The data access for vehicle owners and data deletion provisions for consumers are crucial for ensuring transparency, fairness, and privacy protection. Facilitating open APIs (application programming interfaces) allows consumers and vehicle owners to delete data from the vehicle’s infotainment system that may have been downloaded during the consumer’s use. This provision helps maintain consumer privacy and ensures that sensitive information is effectively managed. Both the vehicle owner data access and consumer data deletion provisions align with ACRA's mission to drive growth and innovation while safeguarding customer privacy. This legislation will help ensure fair competition by removing unnecessary barriers imposed by manufacturers and giving car rental companies more flexibility to innovate. We thank Senator Mike Lee and Representative Eric Burlison for their leadership and are committed to working with Congress and the administration to ensure swift passage of this legislation." -Sharkey Laguana, President of the Board of Directors of the American Car Rental Association

A recent Salesforce survey of over 2,000 U.S. car owners and lessors revealed significant confusion about what constitutes a connected car and the extent of data these vehicles collect. As connected vehicles communicate with manufacturers, insurers, and other entities, their owners face increasing challenges in managing data privacy. Currently, the separation of vehicle ownership and data ownership leaves drivers vulnerable to opaque data-sharing practices, invasive surveillance, and a lack of control over their own property.

The Auto Data Privacy and Autonomy Act provides vehicle owners with essential rights and protections by:

• Requiring Informed Consent: Mandating that original equipment manufacturers (OEMs) establish opt-in features for vehicle data collection.
• Restricting Data Sharing: Prohibiting OEMs from sharing, selling, or leasing collected customer data without explicit consent, with narrow exceptions required by law.
• Protecting National Security: Barring data sharing with adversarial nations.
• Ensuring Transparency: Directing the Federal Trade Commission (FTC) to report to Congress on data collection practices.
• Empowering Owners: Allowing vehicle owners access to their vehicle’s data through technology-neutral standards set by the National Institute of Standards and Technology (NIST).
• Enabling Data Deletion: Giving owners the right to delete their data after connecting to a vehicle.
• Balancing Interests: Protecting OEM confidential business information while safeguarding consumer rights.