Car Privacy Rights Act of 2026

individual or be used to re-identify an individual or a device reasonably linkable to an individual; (ii) has publicly committed to not process any data described in subparagraph (A) that is in its possession so as to make such data linked or reasonably linkable, alone or in combination with other information, to an individual or a device; and (iii) contractually obligates any recipient of such data to satisfy the requirements described in clauses (i) and (ii). (10) Device.--The term ``device'' means any electronic equipment capable of collecting, processing, retaining, or transferring consumer car-related data, including any such device equipped on a consumer car. (11) Precise geolocation.--The term ``precise geolocation'' means information that reveals the past or present physical location of an individual, consumer car, or device with sufficient precision to identify-- (A) street-level location information of such individual, consumer car, or device; or (B) the location of such individual, consumer car, or device within a range of 1,850 feet or less. (12) Process.--The term ``process'', with respect to consumer car-related data, means any operation or set of operations performed, whether by manual or automated means, on such data, including the use, storage, disclosure, analysis, deletion, or modification of such data. SEC. 3. RESTRICTING THE COLLECTION AND PROCESSING OF CONSUMER CAR- RELATED DATA. A covered entity may only collect or process consumer car-related data if such collection or processing is reasonably necessary to-- (1) provide or maintain a specific product or service requested by the consumer, including any routine administrative, operational, or account-servicing activity, such as billing, shipping, delivery, storage, or accounting; (2) provide a communication (not including an advertisement) to the consumer that a reasonable consumer would anticipate within the context of the relationship between the covered entity and the consumer; (3) comply with Federal, State, or local law; (4) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a Federal, State, municipal, or other governmental authority; (5) investigate, establish, defend, or prepare for a legal claim that has been filed against the covered entity; (6) perform under a contract to which the consumer is a party, including fulfilling the terms of a written warranty; (7) take immediate action to protect an interest that is essential for the life or physical safety of the consumer or another individual, including by effectuating a product recall; (8) identify theft, fraud, harassment, a malicious or deceptive activity, or any illegal activity targeted at or involving the covered entity; (9) investigate, report, or prosecute an individual responsible for any action described in paragraph (8); (10) preserve the integrity or security of systems of the covered entity; (11) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all relevant laws and regulations governing such research, and is approved, monitored, and governed by an institutional review board or similar independent oversight entity that determines that-- (A) the expected benefits of the research outweigh the privacy risks; and (B) the covered entity has implemented reasonable safeguards to mitigate privacy risks associated with such research, including any risks associated with the identification of a consumer; (12) assist another covered entity with any of the obligations under this Act; (13) ensure the security and integrity of consumer car- related data; (14) make such data de-identified data; or (15) if such data has been processed to make such data de- identified data-- (A) conduct internal research to develop, improve, or repair a product, service, or technology of the covered entity, including through diagnostics, debugging, and repairs; (B) identify and repair technical errors that impair existing or intended functionality of a product, service, or technology of the covered entity; or (C) perform solely internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the covered entity. SEC. 4. RESTRICTING THE SHARING OR SELLING OF CERTAIN DATA. (a) In General.--Subject to the succeeding subsections of this section, it shall be unlawful for a covered entity to share or sell any consumer car-related data unless-- (1) the covered entity provides the consumer-- (A) a notice that-- (i) states that the covered entity intends to share or sell such data; (ii) is provided in a clear and conspicuous standalone disclosure that describes each instance the covered entity plans to share or sell such data; (iii) for each specific category of such data, states if the covered entity is sharing or selling such data in order to provide a service requested by the consumer; (iv) is written in easy-to-understand language; (v) is provided in a manner that would be reasonably anticipated by the consumer given the relationship between the consumer and the covered entity; and (vi) is accessible to individuals with disabilities; and (B) an opportunity to explicitly grant affirmative express consent to allow the covered entity to share or sell such data; and (2) the consumer explicitly grants such affirmative express consent. (b) Revocation of Consent.--If a consumer grants affirmative express consent to allow a covered entity to share or sell consumer car-related data pursuant to subsection (a)(2), the covered entity shall allow such consumer to easily revoke such consent directly through the website or application of the covered entity. (c) Retaliation Prohibited.-- (1) In general.--A covered entity may not deny a consumer access to a good or service or discriminate or retaliate against a consumer for withholding affirmative express consent under subsection (a)(2) or revoking consent under subsection (b). (2) Retaliation.--With respect to a consumer withholding affirmative express consent under subsection (a)(2) or revoking consent under subsection (b), a covered entity shall be considered in violation of paragraph (1) if such covered entity charges a different price or rate for a good or service or provides a different level of quality of a good or service to such consumer compared to the price, rate, or quality the covered entity typically charges or provides to other consumers unless it is reasonably necessary for the covered entity to sale or share the consumer's consumer car-related data in order to provide the good or service or the value of such data is reasonably related to the difference in price or quality of the good or service. (d) Exception.--Subsection (a) shall not apply to any consumer car- related data a covered entity shares with the National Highway Traffic Safety Administration. (e) Precise Geolocation Data.--It shall be unlawful for a covered entity to share or sell any data relating to a precise geolocation. SEC. 5. CONSUMER RIGHTS. (a) Privacy Policy.-- (1) In general.--A covered entity shall provide a privacy policy meeting the requirements described in paragraph (2) to each consumer whose consumer car-related data the covered entity collects, processes, or transfers. (2) Privacy policy requirements.--A privacy policy described in paragraph (1) shall contain-- (A) a detailed and accurate representation of the policies of the covered entity regarding the collection, processing, and transferring of consumer car-related data; and (B) a prominent description of how a consumer can exercise the rights described in this Act. (b) Disclosures.--Upon request from a consumer, a covered entity shall provide such consumer-- (1) confirmation regarding whether a covered entity is collecting or processing the consumer car-related data of the consumer; (2) access to such data; and (3) if a consumer has provided affirmative express consent to allow a covered entity to share or sell such data pursuant to section 4(a)(2), a list of any third party, other than an individual to which the covered entity has transferred such data. SEC. 6. REPORTING OF CONSUMER DATA PRIVACY PRACTICES. (a) In General.--Not later than 120 days after the date of enactment of this Act and annually thereafter, each covered entity shall submit a report to the Commission regarding their consumer data privacy practices, including any consumer car-related data that is collected, the purpose of such collection, what entities are being shared or sold such data, and an overview of the data sharing practices of any such entity. (b) FTC Report.--Not later than 180 days after the submission of each report under subsection (a), the Commission shall submit to Congress and publish on the website of the Commission a report containing a summary of the information described in each such report. SEC. 7. GUIDANCE OR RULEMAKING REGARDING CAR MANUFACTURERS ADDRESSING DOMESTIC VIOLENCE ISSUES RELATED TO THEIR APPLICATIONS. Not later than 180 days after the date of enactment of this Act, the Commission, in consultation with the Federal Communications Commission and the National Highway Traffic Safety Administration, shall issue guidance or promulgate regulations regarding how car manufacturers can address domestic violence issues related to any application of a car manufacturer that has the capability to determine the precise geolocation of an individual, consumer car, or device. SEC. 8. ENFORCEMENT. (a) Enforcement by the Commission.-- (1) Unfair or deceptive acts or practices.--A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (2) Powers of the commission.-- (A) In general.--The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. (B) Privileges and immunities.--Any person who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.). (C) Authority preserved.--Nothing in this subsection shall be construed to limit the authority of the Commission under any other provision of law. (D) Rulemaking.--The Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act. (b) Enforcement by States.-- (1) In general.--In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by an act or practice in violation of this Act or a regulation promulgated under this Act, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States or an appropriate State court to-- (A) enjoin such act or practice; (B) enforce compliance with this Act or the regulations promulgated under this Act; (C) obtain civil penalties; (D) obtain damages, restitution, or other compensation on behalf of the residents of the State; (E) obtain reasonable attorney's fees and other litigation costs reasonably incurred; or (F) obtain such other relief as the court may consider to be appropriate. (2) Rights of the commission.-- (A) Notice to the commission.-- (i) In general.--Except as provided in clause (iii), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring a civil action under paragraph (1) before initiating the civil action. (ii) Contents.--The notification required by clause (i) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action. (iii) Exception.--If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action. (B) Intervention by the commission.--The Commission may-- (i) intervene in any civil action brought by the attorney general of a State under paragraph (1); and (ii) upon intervening-- (I) remove the civil action to the appropriate district court of the United States, if the action was not originally brought in such court; (II) be heard on all matters arising in the civil action; and (III) file petitions for appeal of a decision in the civil action. (C) Investigatory powers.--Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence. (3) Action by the commission.--If the Commission institutes a civil action with respect to a violation of this Act or a regulation promulgated under this Act, the attorney general of a State may not, during the pendency of such action, bring a civil action under paragraph (1) against any defendant named in the complaint of the Commission for the violation with respect to which the Commission instituted such action. (4) Actions by other state officials.-- (A) In general.--In addition to civil actions brought by attorneys general under paragraph (1), any other officer of a State who is authorized by the State to do so may bring a civil action under such paragraph, subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general. (B) Savings provision.--Nothing in this subsection may be construed to prohibit an attorney general or authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State. (5) Venue; service of process.-- (A) Venue.--Any action brought under paragraph (1) may be brought in any Federal district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code. (B) Service of process.--In an action brought under paragraph (1), process may be served in any district in which the defendant-- (i) is an inhabitant; or (ii) may be found. (c) Private Right of Action.-- (1) In general.--A consumer whose consumer car-related data has been processed, collected, shared, or sold in violation of this Act may bring a civil action in a court of competent jurisdiction against the covered entity alleged in such violation. (2) Relief.--In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award-- (A) damages in an amount of not less than $5,000 per violation, as adjusted annually to reflect any increase in the Consumer Price Index, or actual damages, whichever is greater; (B) punitive damages; (C) declaratory or equitable relief; and (D) reasonable attorney's fees and litigation costs. <all>