SenateS. 5673119th Congress
Car Privacy Rights Act of 2026
Full Text
Official text as published. Use Ctrl+F / Cmd+F to search within the document.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 5673 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
2d Session
S. 5673
To restrict car manufacturers and other companies from selling consumer
car-related data, to increase transparency regarding data practices,
and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
September 30, 2026
Mr. Merkley (for himself, Mr. Lujan, and Ms. Warren) introduced the
following bill; which was read twice and referred to the Committee on
Commerce, Science, and Transportation
_______________________________________________________________________
A BILL
To restrict car manufacturers and other companies from selling consumer
car-related data, to increase transparency regarding data practices,
and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Car Privacy Rights Act of 2026''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Affirmative express consent.--The term ``affirmative
express consent'' means an affirmative act by a consumer that--
(A) clearly communicates the authorization of the
consumer for an act or practice;
(B) is provided in response to a notice that meets
the requirements of section 4(a)(1)(A); and
(C) is not--
(i) acceptance of general or broad terms of
service or a similar document;
(ii) accomplished by hovering over, muting,
pausing, or closing a given piece of content;
(iii) acceptance of an agreement obtained
through the use of false, fraudulent, or
materially misleading means; or
(iv) in response to a notice that only
provides the choice to accept or agree to the
act or practice.
(2) Application.--The term ``application'' means a software
program that runs on the operating system of a device.
(3) Collect.--The term ``collect'' means, with respect to
consumer car-related data, to buy, rent, gather, obtain,
receive, access, or otherwise acquire such data by any means.
(4) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(5) Consumer.--The term ``consumer'' means an individual
who is a citizen or resident of, or located in, the United
States.
(6) Consumer car.--The term ``consumer car'' means a motor
vehicle, as defined in section 30102 of title 49, United States
Code, that is owned, leased, or operated by a consumer, but
excluding any motor vehicle owned, leased, or operated in a
commercial or employment context.
(7) Consumer car-related data.--The term ``consumer car-
related data'' means any information, including derived data
and unique identifiers, that--
(A) is linked or reasonably linkable, alone or in
combination with other information, to an individual or
a device; and
(B) is--
(i) collected or derived from and describes
the current or historic operation, condition,
status, or precise geolocation of a consumer
car or its occupants;
(ii) electronic data generated or processed
onboard a consumer car, such as data generated
by sensors, receivers, computer processing
units, or other vehicle components, including
diagnostic, repair, and maintenance data; or
(iii) stored, or capable of being stored,
in a consumer car generated by the user of such
consumer car.
(8) Covered entity.--The term ``covered entity'' means any
person that collects, processes, or transfers the consumer car-
related data of an individual, including a car manufacturer,
insurance company, or a company that collects such data through
an application.
(9) De-identified data.--The term ``de-identified data''
means consumer car-related data that--
(A) has been processed so as to not be linked or
reasonably linkable, alone or in combination with other
information, to an individual or a device; and
(B) is in possession of a covered entity, and such
covered entity--
(i) takes reasonable physical,
administrative, and technical measures to
ensure that such data cannot be associated with
an individual or be used to re-identify an
individual or a device reasonably linkable to
an individual;
(ii) has publicly committed to not process
any data described in subparagraph (A) that is
in its possession so as to make such data
linked or reasonably linkable, alone or in
combination with other information, to an
individual or a device; and
(iii) contractually obligates any recipient
of such data to satisfy the requirements
described in clauses (i) and (ii).
(10) Device.--The term ``device'' means any electronic
equipment capable of collecting, processing, retaining, or
transferring consumer car-related data, including any such
device equipped on a consumer car.
(11) Precise geolocation.--The term ``precise geolocation''
means information that reveals the past or present physical
location of an individual, consumer car, or device with
sufficient precision to identify--
(A) street-level location information of such
individual, consumer car, or device; or
(B) the location of such individual, consumer car,
or device within a range of 1,850 feet or less.
(12) Process.--The term ``process'', with respect to
consumer car-related data, means any operation or set of
operations performed, whether by manual or automated means, on
such data, including the use, storage, disclosure, analysis,
deletion, or modification of such data.
SEC. 3. RESTRICTING THE COLLECTION AND PROCESSING OF CONSUMER CAR-
RELATED DATA.
A covered entity may only collect or process consumer car-related
data if such collection or processing is reasonably necessary to--
(1) provide or maintain a specific product or service
requested by the consumer, including any routine
administrative, operational, or account-servicing activity,
such as billing, shipping, delivery, storage, or accounting;
(2) provide a communication (not including an
advertisement) to the consumer that a reasonable consumer would
anticipate within the context of the relationship between the
covered entity and the consumer;
(3) comply with Federal, State, or local law;
(4) comply with a civil, criminal, or regulatory inquiry,
investigation, subpoena, or summons by a Federal, State,
municipal, or other governmental authority;
(5) investigate, establish, defend, or prepare for a legal
claim that has been filed against the covered entity;
(6) perform under a contract to which the consumer is a
party, including fulfilling the terms of a written warranty;
(7) take immediate action to protect an interest that is
essential for the life or physical safety of the consumer or
another individual, including by effectuating a product recall;
(8) identify theft, fraud, harassment, a malicious or
deceptive activity, or any illegal activity targeted at or
involving the covered entity;
(9) investigate, report, or prosecute an individual
responsible for any action described in paragraph (8);
(10) preserve the integrity or security of systems of the
covered entity;
(11) engage in public or peer-reviewed scientific or
statistical research in the public interest that adheres to all
relevant laws and regulations governing such research, and is
approved, monitored, and governed by an institutional review
board or similar independent oversight entity that determines
that--
(A) the expected benefits of the research outweigh
the privacy risks; and
(B) the covered entity has implemented reasonable
safeguards to mitigate privacy risks associated with
such research, including any risks associated with the
identification of a consumer;
(12) assist another covered entity with any of the
obligations under this Act;
(13) ensure the security and integrity of consumer car-
related data;
(14) make such data de-identified data; or
(15) if such data has been processed to make such data de-
identified data--
(A) conduct internal research to develop, improve,
or repair a product, service, or technology of the
covered entity, including through diagnostics,
debugging, and repairs;
(B) identify and repair technical errors that
impair existing or intended functionality of a product,
service, or technology of the covered entity; or
(C) perform solely internal operations that are
reasonably aligned with the expectations of the
consumer or reasonably anticipated based on the
consumer's existing relationship with the covered
entity.
SEC. 4. RESTRICTING THE SHARING OR SELLING OF CERTAIN DATA.
(a) In General.--Subject to the succeeding subsections of this
section, it shall be unlawful for a covered entity to share or sell any
consumer car-related data unless--
(1) the covered entity provides the consumer--
(A) a notice that--
(i) states that the covered entity intends
to share or sell such data;
(ii) is provided in a clear and conspicuous
standalone disclosure that describes each
instance the covered entity plans to share or
sell such data;
(iii) for each specific category of such
data, states if the covered entity is sharing
or selling such data in order to provide a
service requested by the consumer;
(iv) is written in easy-to-understand
language;
(v) is provided in a manner that would be
reasonably anticipated by the consumer given
the relationship between the consumer and the
covered entity; and
(vi) is accessible to individuals with
disabilities; and
(B) an opportunity to explicitly grant affirmative
express consent to allow the covered entity to share or
sell such data; and
(2) the consumer explicitly grants such affirmative express
consent.
(b) Revocation of Consent.--If a consumer grants affirmative
express consent to allow a covered entity to share or sell consumer
car-related data pursuant to subsection (a)(2), the covered entity
shall allow such consumer to easily revoke such consent directly
through the website or application of the covered entity.
(c) Retaliation Prohibited.--
(1) In general.--A covered entity may not deny a consumer
access to a good or service or discriminate or retaliate
against a consumer for withholding affirmative express consent
under subsection (a)(2) or revoking consent under subsection
(b).
(2) Retaliation.--With respect to a consumer withholding
affirmative express consent under subsection (a)(2) or revoking
consent under subsection (b), a covered entity shall be
considered in violation of paragraph (1) if such covered entity
charges a different price or rate for a good or service or
provides a different level of quality of a good or service to
such consumer compared to the price, rate, or quality the
covered entity typically charges or provides to other consumers
unless it is reasonably necessary for the covered entity to
sale or share the consumer's consumer car-related data in order
to provide the good or service or the value of such data is
reasonably related to the difference in price or quality of the
good or service.
(d) Exception.--Subsection (a) shall not apply to any consumer car-
related data a covered entity shares with the National Highway Traffic
Safety Administration.
(e) Precise Geolocation Data.--It shall be unlawful for a covered
entity to share or sell any data relating to a precise geolocation.
SEC. 5. CONSUMER RIGHTS.
(a) Privacy Policy.--
(1) In general.--A covered entity shall provide a privacy
policy meeting the requirements described in paragraph (2) to
each consumer whose consumer car-related data the covered
entity collects, processes, or transfers.
(2) Privacy policy requirements.--A privacy policy
described in paragraph (1) shall contain--
(A) a detailed and accurate representation of the
policies of the covered entity regarding the
collection, processing, and transferring of consumer
car-related data; and
(B) a prominent description of how a consumer can
exercise the rights described in this Act.
(b) Disclosures.--Upon request from a consumer, a covered entity
shall provide such consumer--
(1) confirmation regarding whether a covered entity is
collecting or processing the consumer car-related data of the
consumer;
(2) access to such data; and
(3) if a consumer has provided affirmative express consent
to allow a covered entity to share or sell such data pursuant
to section 4(a)(2), a list of any third party, other than an
individual to which the covered entity has transferred such
data.
SEC. 6. REPORTING OF CONSUMER DATA PRIVACY PRACTICES.
(a) In General.--Not later than 120 days after the date of
enactment of this Act and annually thereafter, each covered entity
shall submit a report to the Commission regarding their consumer data
privacy practices, including any consumer car-related data that is
collected, the purpose of such collection, what entities are being
shared or sold such data, and an overview of the data sharing practices
of any such entity.
(b) FTC Report.--Not later than 180 days after the submission of
each report under subsection (a), the Commission shall submit to
Congress and publish on the website of the Commission a report
containing a summary of the information described in each such report.
SEC. 7. GUIDANCE OR RULEMAKING REGARDING CAR MANUFACTURERS ADDRESSING
DOMESTIC VIOLENCE ISSUES RELATED TO THEIR APPLICATIONS.
Not later than 180 days after the date of enactment of this Act,
the Commission, in consultation with the Federal Communications
Commission and the National Highway Traffic Safety Administration,
shall issue guidance or promulgate regulations regarding how car
manufacturers can address domestic violence issues related to any
application of a car manufacturer that has the capability to determine
the precise geolocation of an individual, consumer car, or device.
SEC. 8. ENFORCEMENT.
(a) Enforcement by the Commission.--
(1) Unfair or deceptive acts or practices.--A violation of
this Act or a regulation promulgated under this Act shall be
treated as a violation of a rule defining an unfair or
deceptive act or practice under section 18(a)(1)(B) of the
Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Commission shall enforce this
Act in the same manner, by the same means, and with the
same jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this Act.
(B) Privileges and immunities.--Any person who
violates this Act or a regulation promulgated under
this Act shall be subject to the penalties and entitled
to the privileges and immunities provided in the
Federal Trade Commission Act (15 U.S.C. 41 et seq.).
(C) Authority preserved.--Nothing in this
subsection shall be construed to limit the authority of
the Commission under any other provision of law.
(D) Rulemaking.--The Commission shall promulgate in
accordance with section 553 of title 5, United States
Code, such rules as may be necessary to carry out this
Act.
(b) Enforcement by States.--
(1) In general.--In any case in which the attorney general
of a State has reason to believe that an interest of the
residents of the State has been or is threatened or adversely
affected by an act or practice in violation of this Act or a
regulation promulgated under this Act, the attorney general of
the State may, as parens patriae, bring a civil action on
behalf of the residents of the State in an appropriate district
court of the United States or an appropriate State court to--
(A) enjoin such act or practice;
(B) enforce compliance with this Act or the
regulations promulgated under this Act;
(C) obtain civil penalties;
(D) obtain damages, restitution, or other
compensation on behalf of the residents of the State;
(E) obtain reasonable attorney's fees and other
litigation costs reasonably incurred; or
(F) obtain such other relief as the court may
consider to be appropriate.
(2) Rights of the commission.--
(A) Notice to the commission.--
(i) In general.--Except as provided in
clause (iii), the attorney general of a State
shall notify the Commission in writing that the
attorney general intends to bring a civil
action under paragraph (1) before initiating
the civil action.
(ii) Contents.--The notification required
by clause (i) with respect to a civil action
shall include a copy of the complaint to be
filed to initiate the civil action.
(iii) Exception.--If it is not feasible for
the attorney general of a State to provide the
notification required by clause (i) before
initiating a civil action under paragraph (1),
the attorney general shall notify the
Commission immediately upon instituting the
civil action.
(B) Intervention by the commission.--The Commission
may--
(i) intervene in any civil action brought
by the attorney general of a State under
paragraph (1); and
(ii) upon intervening--
(I) remove the civil action to the
appropriate district court of the
United States, if the action was not
originally brought in such court;
(II) be heard on all matters
arising in the civil action; and
(III) file petitions for appeal of
a decision in the civil action.
(C) Investigatory powers.--Nothing in this
subsection may be construed to prevent the attorney
general of a State from exercising the powers conferred
on the attorney general by the laws of the State to
conduct investigations, to administer oaths or
affirmations, or to compel the attendance of witnesses
or the production of documentary or other evidence.
(3) Action by the commission.--If the Commission institutes
a civil action with respect to a violation of this Act or a
regulation promulgated under this Act, the attorney general of
a State may not, during the pendency of such action, bring a
civil action under paragraph (1) against any defendant named in
the complaint of the Commission for the violation with respect
to which the Commission instituted such action.
(4) Actions by other state officials.--
(A) In general.--In addition to civil actions
brought by attorneys general under paragraph (1), any
other officer of a State who is authorized by the State
to do so may bring a civil action under such paragraph,
subject to the same requirements and limitations that
apply under this subsection to civil actions brought by
attorneys general.
(B) Savings provision.--Nothing in this subsection
may be construed to prohibit an attorney general or
authorized official of a State from initiating or
continuing any proceeding in a court of the State for a
violation of any civil or criminal law of the State.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1)
may be brought in any Federal district court of the
United States that meets applicable requirements
relating to venue under section 1391 of title 28,
United States Code.
(B) Service of process.--In an action brought under
paragraph (1), process may be served in any district in
which the defendant--
(i) is an inhabitant; or
(ii) may be found.
(c) Private Right of Action.--
(1) In general.--A consumer whose consumer car-related data
has been processed, collected, shared, or sold in violation of
this Act may bring a civil action in a court of competent
jurisdiction against the covered entity alleged in such
violation.
(2) Relief.--In a civil action brought under paragraph (1)
in which the plaintiff prevails, the court may award--
(A) damages in an amount of not less than $5,000
per violation, as adjusted annually to reflect any
increase in the Consumer Price Index, or actual
damages, whichever is greater;
(B) punitive damages;
(C) declaratory or equitable relief; and
(D) reasonable attorney's fees and litigation
costs.
<all>