II 

118TH CONGRESS 

2D SESSION S. 5579 

To prevent covered vehicle manufacturers from accessing, selling, or otherwise 

selling certain covered vehicle data, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

DECEMBER 18 (legislative day, DECEMBER 16), 2024 

Mr. LEE (for himself and Mr. MERKLEY) introduced the following bill; which 

was read twice and referred to the Committee on Commerce, Science, and 

Transportation 

A BILL 

To prevent covered vehicle manufacturers from accessing, 

selling, or otherwise selling certain covered vehicle data, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Auto Data Privacy 

5 and Autonomy Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 

8 (1) COMMISSION.—The term ‘‘Commission’’ 

9 means the Federal Trade Commission. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 5579 IS

1 (2) COVERED VEHICLE.—The term ‘‘covered ve2 hicle’’ means a motor vehicle or a vehicle primarily 

3 used for farming or construction. 

4 (3) DIRECTOR.—The term ‘‘Director’’ means 

5 the Director of the National Institute of Standards 

6 and Technology. 

7 (4) MOTOR VEHICLE.—The term ‘‘motor vehi8 cle’’ has the same meaning given such term in sec9 tion 30102(a) of title 49, United States Code, and 

10 includes a motor vehicle trailer. 

11 (5) OPERATOR DATA.—The term ‘‘operator 

12 data’’ means— 

13 (A) all electronic data generated or proc14 essed onboard a covered vehicle, such as data 

15 generated by sensors, receivers, computer proc16 essing units, or other vehicle components; and 

17 (B) data stored in a covered vehicle gen18 erated by the user of such covered vehicle. 

19 (6) PERSONALLY IDENTIFIABLE INFORMA20 TION.—The term ‘‘personally identifiable informa21 tion’’ means information that— 

22 (A) directly identifies an individual such as 

23 the name, address, social security number or 

24 other identifying number or code, telephone 

25 number, or email address of an individual; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 5579 IS

1 (B) indirectly identifies an individual such 

2 as the gender, race, or date of birth of an indi3 vidual; or 

4 (C) reveals the physical location or internet 

5 activity of an individual. 

6 (7) SECRETARY.—The term ‘‘Secretary’’ means 

7 the Secretary of Transportation. 

8 (8) SECURE.—The term ‘‘secure’’ means, with 

9 respect to the interface for access and control of op10 erator data described in section 4(c), designed to 

11 prevent malicious or unauthorized use or access of 

12 such data. 

13 (9) TECHNOLOGY-NEUTRAL.—The term ‘‘tech14 nology-neutral’’ means, with respect to the interface 

15 for access and control of operator data described in 

16 section 4(c), designed without preference or preju17 dice towards any technology or service used to access 

18 and control such data by a covered vehicle owner, 

19 and not contingent on ownership or licensing of pro20 prietary technologies by a covered vehicle owner or 

21 manufacturer. 

22 (10) USER PREFERENCE.—The term ‘‘user 

23 preference’’ means any choice with respect to a 

24 configurable setting of a covered vehicle made by or 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 5579 IS

1 for the benefit of the owner or user of such covered 

2 vehicle. 

3 SEC. 3. OPERATOR DATA PRIVACY AND SECURITY. 

4 (a) PROHIBITION ON MANUFACTURERS.—A manu5 facturer of a covered vehicle may not, with respect to the 

6 covered vehicle of a covered vehicle owner that is manufac7 tured by such manufacturer— 

8 (1) access operator data, unless— 

9 (A) the covered vehicle owner affirmatively 

10 consents to such manufacturer accessing such 

11 data and such consent— 

12 (i) is freely given; 

13 (ii) is informed, specific, and unam14 biguous; 

15 (iii) is in writing; and 

16 (iv) may be easily withdrawn; or 

17 (B) such data is accessed solely to improve 

18 covered vehicle performance or safety; 

19 (2) sell, lease, or otherwise share operator data, 

20 unless— 

21 (A) required to do so— 

22 (i) pursuant to a lawfully executed 

23 warrant; 

24 (ii) pursuant to a court order that 

25 provides the covered vehicle owner notice 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 5579 IS

1 of the order and at least 48 hours to object 

2 and request a hearing; or 

3 (iii) to facilitate an emergency re4 sponse; or 

5 (B) expressly permitted to do so by the 

6 covered vehicle owner or, in the event of the 

7 death or incapacity of such person, the next of 

8 kin of such owner; or 

9 (3) sell, license, rent, trade, transfer, release, 

10 disclose, provide access to, or otherwise make avail11 able personally identifiable information of a United 

12 States citizen or lawful permanent resident to the 

13 following: 

14 (A) The Democratic People’s Republic of 

15 Korea. 

16 (B) The People’s Republic of China. 

17 (C) The Russian Federation. 

18 (D) The Islamic Republic of Iran. 

19 (E) The Bolivarian Republic of Venezuela. 

20 (b) REPORT.— 

21 (1) IN GENERAL.—Not later than 180 days 

22 after the date of the enactment of this Act, the 

23 Commission shall submit to Congress a report that 

24 describes, with respect to operator data— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 5579 IS

1 (A) the types of such data that a manufac2 turer of a covered vehicle accesses; 

3 (B) the individuals and entities, other than 

4 a manufacturer of a covered vehicle, that access 

5 such data; 

6 (C) the Federal or State government enti7 ties that access such data and how such entities 

8 use such data; 

9 (D) the individuals and entities to whom 

10 such data may be sold or otherwise shared; 

11 (E) the foreign governments to whom such 

12 data may be sold or otherwise shared and how 

13 such data is used by such foreign governments; 

14 (F) the cybersecurity capabilities and risks 

15 associated with covered vehicles; and 

16 (G) occurrences of such data being com17 promised, including the prevalence of such oc18 currences and any entities with ties to foreign 

19 governments associated with such occurrences. 

20 (2) CONSULTATION.—In completing the report 

21 required under paragraph (1), the Commission shall 

22 consult with— 

23 (A) the Attorney General; 

24 (B) the Secretary of Homeland Security; 

25 (C) the Secretary of Transportation; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•S 5579 IS

1 (D) the Federal Communications Commis2 sion. 

3 SEC. 4. OPERATOR DATA ACCESS. 

4 (a) IN GENERAL.—A manufacturer of a covered vehi5 cle shall provide to a covered vehicle owner access to, and 

6 control of, operator data— 

7 (1) at no cost beyond the purchase price of 

8 such vehicle; 

9 (2) without any restriction or limitation, con10 sistent with subsection (c); and 

11 (3) without a requirement that the covered ve12 hicle owner— 

13 (A) pay a fee or purchase a license to 

14 decrypt operator data; or 

15 (B) use a device provided by such manu16 facturer to access and use operator data. 

17 (b) DATA DELETION AND USER PREFERENCES.—To 

18 facilitate the access and control of operator data described 

19 in subsection (a), a manufacturer of a covered vehicle shall 

20 enable the operation of open application programming 

21 interfaces that— 

22 (1) facilitate deletion of all data stored in a cov23 ered vehicle generated by the user of such covered 

24 vehicle; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•S 5579 IS

1 (2) enable the setting of any user preference by 

2 the covered vehicle owner or another user of the cov3 ered vehicle. 

4 (c) TECHNOLOGY-NEUTRAL, SECURE, STANDARDS5 BASED INTERFACE.—The manufacturer of a covered vehi6 cle shall provide to a covered vehicle owner the access and 

7 control required by subsection (a) by means of a tech8 nology-neutral and secure interface that meets the stand9 ards set by the Commission pursuant to section 5. 

10 SEC. 5. STANDARDS. 

11 (a) STANDARDS REPORT.—Not later than 180 days 

12 after the date of enactment of this Act, the Commission 

13 shall submit to the Committee on Commerce, Science, and 

14 Transportation of the Senate and the Committee on En15 ergy and Commerce of the House of Representatives a re16 port on the current practices employed for operator data 

17 generation, storage, transmission, and cybersecurity. 

18 (b) STANDARDS SETTING.—Not later than 1 year 

19 after the date on which the Commission submits the report 

20 under subsection (a), the Commission shall, in coordina21 tion with the Director, relevant industry stakeholders, in22 cluding manufacturers of covered vehicles and covered ve23 hicle owners, and with other agencies as necessary, estab24 lish 1 or more standards for the technology-neutral, stand25 ards-based, secure interface required by section 4(c). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•S 5579 IS

1 (c) STANDARDS REVIEW AND REVISION.—Not later 

2 than 5 years after the date on which the Commission, in 

3 coordination with the Director, establishes the standards 

4 required under subsection (b), and not less frequently than 

5 once every 5 years thereafter, the Commission shall review 

6 and revise such standards as appropriate. 

7 SEC. 6. ENFORCEMENT. 

8 (a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—A 

9 violation of this Act shall be treated as a violation of a 

10 rule defining an unfair or deceptive act or practice under 

11 section 18(a)(1)(B) of the Federal Trade Commission Act 

12 (15 U.S.C. 57a(a)(1)(B)). 

13 (b) POWERS OF THE COMMISSION.— 

14 (1) IN GENERAL.—The Commission shall en15 force this Act in the same manner, by the same 

16 means, and with the same jurisdiction, powers, and 

17 duties as though all applicable terms and provisions 

18 of the Federal Trade Commission Act (15 U.S.C. 41 

19 et seq.) were incorporated into and made a part of 

20 this Act. 

21 (2) PRIVILEGES AND IMMUNITIES.—Any person 

22 who violates this Act shall be subject to the penalties 

23 and entitled to the privileges and immunities pro24 vided in the Federal Trade Commission Act (15 

25 U.S.C. 41 et seq.). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

•S 5579 IS

1 (3) AUTHORITY PRESERVED.—Nothing in this 

2 Act shall be construed to limit the authority of the 

3 Commission under any other provision of law. 

4 SEC. 7. RELATION TO OTHER LAWS. 

5 This Act supersedes any statute, rule, requirement, 

6 or other legal obligation of a State or political subdivision 

7 thereof, or any Federal law or regulation, that relates to 

8 the requirements in this Act. 

9 SEC. 8. DISCLOSURE OF CONFIDENTIAL BUSINESS INFOR10 MATION. 

11 Except as provided in section 4, nothing in this Act 

12 shall require a manufacturer of a covered vehicle to di13 vulge confidential business information (as that term is 

14 defined in section 512.3(c) of title 49, Code of Federal 

15 Regulations). 

16 SEC. 9. EFFECTIVE DATE. 

17 This Act shall take effect on the date that is 3 

18 months after the date of enactment of this Act. 

19 SEC. 10. NO NEW APPROPRIATIONS. 

20 The Commission shall carry out this Act using unob21 ligated funds appropriated to the Commission and avail22 able as of the date of the enactment of this Act. 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB