Short title

This Act may be cited as the

Car Privacy Rights Act of 2024

Restricting the sharing or selling of consumer car-related data

(a)

In general

Subject to subsections (b) and (c), it shall be unlawful for a covered entity to share or sell any consumer car-related data of a consumer unless— (1)the covered entity provides the consumer— (A)a notice that—(i)the covered entity intends to share or sell such data;(ii)is provided in a clear and conspicuous standalone disclosure that describes each instance the covered entity plans to share or sell such data;(iii)states for each specific category of such data if the covered entity is sharing or selling such data in order to provide a service requested by the consumer or for another purpose;(iv)is written in easy-to-understand language; (v)is provided by a means that would be reasonably anticipated by the consumer given the relationship between the consumer and the covered entity; and(vi)is accessible to persons with disabilities; and(B)an opportunity to explicitly grant affirmative express consent to allow the covered entity to share or sell such data; and(2)the consumer explicitly grants such affirmative express consent.(b)

Revocation of consent

If a consumer grants affirmative express consent to allow a covered entity to share or sell the data of such consumer pursuant to subsection (a)(2), the covered entity shall allow such consumer to easily revoke such consent directly through the website of the covered entity, or application of the covered entity, or through direct mail. (c)

Exception

Subsection (a) shall not apply to any data a covered entity shares with the National Highway Traffic Safety Administration.

Reporting of consumer data privacy practices

(a)

In general

Not later than 120 days after the date of enactment of this Act and annually thereafter, each car manufacturer and motor vehicle insurance company shall submit a report to the Commission regarding their consumer data privacy practices, including any consumer car-related data that are being collected, the purpose behind such data being collected, what entities are being shared or sold such data, and an overview of their data sharing practices.(b)

FTC report

Not later than 180 days after the date described in subsection (a) and annually thereafter, the Commission shall submit to Congress and publish on the website of the Commission a report containing a summary of the information described in subsection (a).

Guidance or rulemaking regarding car manufacturers addressing domestic violence issues related to their applications

Not later than 180 days after the date of enactment of this Act, the Commission, in consultation with the Federal Communications Commission and the National Highway Traffic Safety Administration, shall issue guidance or promulgate regulations regarding how car manufacturers can address domestic violence issues related to any application of a car manufacturer that has the capability to determine the precise geolocation of an individual, consumer car, or device.

Enforcement

(a)

Unfair or deceptive acts or practices

A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).(b)

Powers of the Commission

(1)

In general

The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.(2)

Privileges and immunities

Any person who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).(3)

Authority preserved

Nothing in this section shall be construed to limit the authority of the Commission under any other provision of law.(4)

Rulemaking

The Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.

Definitions

In this Act:(1)

Affirmative express consent

The term affirmative express consent means an affirmative act by a consumer that—(A)clearly communicates the authorization of the consumer for an act or practice;(B)is provided in response to a notice that meets the requirements of section 2(a)(1)(A); and(C)is not— (i)acceptance of general or broad terms of service or a similar document;(ii)accomplished by hovering over, muting, pausing, or closing a given piece of content; or(iii)acceptance of an agreement obtained through the use of false, fraudulent, or materially misleading means.(2)

Application

The term application means a software program that runs on the operating system of a device.(3)

Commission

The term Commission means the Federal Trade Commission. (4)

Consumer

The term consumer means an individual who is a citizen or resident of, or located in, the United States.(5)

Consumer car

The term consumer car means a motor vehicle, as defined in section 30102 of title 49, United States Code, that is owned, leased, or operated by a consumer, but excluding any motor vehicle owned, leased, or operated in a commercial or employment context. (6)

Consumer car-related data

The term consumer car-related data means any information, including derived data and unique identifiers, that is—(A)linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device; and(B)collected or derived from and describes the historic operation, condition, status, or precise geolocation of a consumer car or its occupants.(7)

Covered entity

The term covered entity means any person that collects the consumer car-related data of an individual, including car manufacturers, insurance companies, and companies that collect such data through digital applications. (8)

Device

The term device means any electronic equipment capable of collecting, processing, retaining, or transferring consumer car-related data, including such devices equipped on a consumer car.(9)

Precise Geolocation

The term precise geolocation means information that reveals the past or present physical location of an individual, consumer car, or device with sufficient precision to identify—(A)street-level location information of such individual, consumer car, or device; or(B)the location of such individual, consumer car, or device within a range of 1,850 feet or less.