Car Privacy Rights Act of 2026

Covered entities could collect or use consumer car-related data only when reasonably necessary for specified purposes, such as providing a requested service, complying with law, protecting safety or security, or conducting certain research. The bill also allows some internal product work using data that has been de-identified under its requirements.

Before sharing or selling consumer car-related data, covered entities would generally have to give consumers a clear, standalone notice and obtain their affirmative express consent, which consumers could later revoke. Sharing or selling data about precise geolocation would be prohibited; the bill makes an exception for sharing data with the National Highway Traffic Safety Administration.

Covered entities would have to provide a privacy policy explaining their data practices and how consumers can use their rights. On request, a consumer could ask whether their data is being collected or processed, access that data, and—if they consented to sharing or selling—get a list of recipients other than individuals.

Covered entities would report their data practices to the Federal Trade Commission, including what data they collect, why they collect it, and with whom they share or sell it. The FTC would summarize those reports for Congress and the public, and issue guidance or regulations on car manufacturers’ apps and domestic violence concerns involving precise geolocation.

The FTC and state officials could enforce the requirements. A consumer whose data was handled in violation of the bill could sue; a court could award at least $5,000 per violation, adjusted annually for inflation, or actual damages if greater, as well as other listed remedies.