Your car's location and driving data now require your explicit permission to sell

What it does

This bill restricts car manufacturers and other companies from collecting, processing, and selling data about consumers' vehicles and driving habits without explicit permission. It requires companies to get clear, affirmative consent before sharing or selling car data, prohibits selling precise location data entirely, mandates transparent privacy policies, and gives consumers the right to access their data and revoke consent. The FTC enforces the law, and consumers can sue companies that violate it.

Why we flagged it

The bill's operative mechanism is a comprehensive restriction on data collection, processing, and sale by car manufacturers and related entities, coupled with affirmative consent requirements and a private right of action. It is fundamentally a consumer protection and privacy measure, not a deregulation or industry carve-out.

What the text implies

• Domestic violence protection: Section 7 requires FTC guidance on how car manufacturers can address domestic violence through location-tracking features in vehicle apps—recognizing that precise geolocation data can enable stalking and abuse, the bill implicitly acknowledges this harm and mandates protective measures.
• Insurance industry impact: Insurance companies are named as covered entities; restrictions on data collection and sale may limit their ability to use driving behavior data for pricing, potentially affecting risk-based premium models and data-driven underwriting practices.
• Repair and diagnostics: Section 3(15) permits internal use of de-identified data for product repair and diagnostics, preserving manufacturers' ability to improve vehicles while restricting external data sales—a balance that may limit third-party repair and aftermarket diagnostic services.
• NHTSA exception: Section 4(d) exempts data sharing with the National Highway Traffic Safety Administration, preserving government access to safety data for recalls and investigations without consumer consent.
• De-identification loophole: The bill's de-identification standard (Section 2(9)) requires reasonable measures and contractual obligations, but re-identification risk remains if de-identified data is combined with other datasets—enforcement depends on FTC rulemaking and private litigation.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Consumers gain enforceable rights to control their vehicle data, access it, and revoke consent; they can sue for violations with statutory damages of at least $5,000 per violation. Companies are prohibited from selling precise location data and cannot retaliate against consumers who withhold consent. The bill shifts power from data collectors to individuals over sensitive information linked to their movements and vehicle use.

Named in the bill

Federal Trade Commission (FTC), National Highway Traffic Safety Administration (NHTSA), Federal Communications Commission (FCC), Car manufacturers, Insurance companies, Data brokers and aggregators, State attorneys general

Where it stands

2 cosponsors: 2 Democrats.

• Sep 30, 2026 — Introduced · Congress.gov: “Introduced in Senate”
• Sep 30, 2026 — Referred to Senate Committee on Commerce, Science, and Transportation · Congress.gov: “Read twice and referred to the Committee on Commerce, Science, and Transportation”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.