Car Privacy Rights Act of 2024

Subject to subsections (b) and (c), it shall be unlawful for a covered entity to share or sell any consumer car-related data of a consumer unless—

(1) the covered entity provides the consumer—

(A) a notice that—

(i) the covered entity intends to share or sell such data;

(ii) is provided in a clear and conspicuous standalone disclosure that describes each instance the covered entity plans to share or sell such data;

(iii) states for each specific category of such data if the covered entity is sharing or selling such data in order to provide a service requested by the consumer or for another purpose;

(iv) is written in easy-to-understand language;

(v) is provided by a means that would be reasonably anticipated by the consumer given the relationship between the consumer and the covered entity; and

(vi) is accessible to persons with disabilities; and

(B) an opportunity to explicitly grant affirmative express consent to allow the covered entity to share or sell such data; and

(2) the consumer explicitly grants such affirmative express consent.

If a consumer grants affirmative express consent to allow a covered entity to share or sell the data of such consumer pursuant to subsection (a)(2), the covered entity shall allow such consumer to easily revoke such consent directly through the website of the covered entity, or application of the covered entity, or through direct mail.

Subsection (a) shall not apply to any data a covered entity shares with the National Highway Traffic Safety Administration.

Not later than 120 days after the date of enactment of this Act and annually thereafter, each car manufacturer and motor vehicle insurance company shall submit a report to the Commission regarding their consumer data privacy practices, including any consumer car-related data that are being collected, the purpose behind such data being collected, what entities are being shared or sold such data, and an overview of their data sharing practices.

Not later than 180 days after the date described in subsection (a) and annually thereafter, the Commission shall submit to Congress and publish on the website of the Commission a report containing a summary of the information described in subsection (a).

A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

Any person who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

Nothing in this section shall be construed to limit the authority of the Commission under any other provision of law.

The Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.

The term affirmative express consent means an affirmative act by a consumer that—

(A) clearly communicates the authorization of the consumer for an act or practice;

(B) is provided in response to a notice that meets the requirements of section 2(a)(1)(A); and

(C) is not—

(i) acceptance of general or broad terms of service or a similar document;

(ii) accomplished by hovering over, muting, pausing, or closing a given piece of content; or

(iii) acceptance of an agreement obtained through the use of false, fraudulent, or materially misleading means.

The term application means a software program that runs on the operating system of a device.

The term Commission means the Federal Trade Commission.

The term consumer means an individual who is a citizen or resident of, or located in, the United States.

The term consumer car means a motor vehicle, as defined in section 30102 of title 49, United States Code, that is owned, leased, or operated by a consumer, but excluding any motor vehicle owned, leased, or operated in a commercial or employment context.

The term consumer car-related data means any information, including derived data and unique identifiers, that is—

(A) linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device; and

(B) collected or derived from and describes the historic operation, condition, status, or precise geolocation of a consumer car or its occupants.

The term covered entity means any person that collects the consumer car-related data of an individual, including car manufacturers, insurance companies, and companies that collect such data through digital applications.

The term device means any electronic equipment capable of collecting, processing, retaining, or transferring consumer car-related data, including such devices equipped on a consumer car.

The term precise geolocation means information that reveals the past or present physical location of an individual, consumer car, or device with sufficient precision to identify—

(A) street-level location information of such individual, consumer car, or device; or

(B) the location of such individual, consumer car, or device within a range of 1,850 feet or less.