Summary of H.R. 6734 — Auto Data Privacy and Autonomy Act

Overview

• Bill: H.R. 6734, Auto Data Privacy and Autonomy Act
• Introduced in the House: December 16, 2025 by Mr. Burlison
• Status: Introduced and referred to the House Committee on Energy and Commerce
• Purpose: To limit manufacturers of covered vehicles from accessing, selling, or sharing covered data without owner consent, and to guarantee owners access to and control over data generated by or processed within their vehicles.

What the bill seeks to do

• Prohibits manufacturers of covered vehicles from accessing, selling, or sharing covered data without explicit owner consent.
• Requires manufacturers to provide vehicle owners with access to and control over all covered data, in real time and at no net cost beyond the purchase price or standard access fees.
• Establishes a framework for consent, data access, and data use, with specific protections for owner autonomy and privacy.
• Includes restrictions on the sale or sharing of covered data with certain foreign governments, absent consent or lawful authorization.
• Directs a government agency reporting process to assess data types, access, sharing, cybersecurity risks, and feasibility of a standardized, technology-neutral interface for owner access.

Key Definitions (Section 2)

• Commission: Federal Trade Commission (FTC).
• Covered Data: Both user data and vehicle-generated data.
• Covered Vehicle: Any motor vehicle, including vehicles used for farming or construction.
• Geolocation Data: Data showing past or present physical location of a person, vehicle, or device.
• Personally Identifiable Information (PII): Data that directly or indirectly identifies an individual or reveals geolocation or internet activity.
• User Data: Data transferred to the vehicle by the owner or user.
• Vehicle-Generated Data: Data produced onboard the vehicle (sensors, processors, etc.), including geolocation data.
• User Preference: Configurable settings chosen by or for the owner/user.

Key Provisions on Data Access, Use, and Consent (Section 3)

• Prohibition on Manufacturer Access: A covered-vehicle manufacturer may not access covered data unless:
  • Written, informed, specific, unilateral consent from the owner (or next of kin in the event of death/incapacity), freely given and easily withdrawn; or
  • The data is accessed solely to improve vehicle performance or safety.
• Prohibition on Data Sales/Sharing: A manufacturer may not sell, lease, or otherwise share covered data unless:
  • Required by law via a warrant or court order (with notice and a right to object/hear within 48 hours); or
  • To facilitate emergency response; or
  • The owner/next of kin provides written, informed, freely given consent (and withdrawal rights).
• Prohibition on PII Disclosure to Certain Nations: Prevents sale or disclosure of U.S. citizen or lawful permanent resident PII to specified countries (e.g., North Korea, China, Russia, Iran, Venezuela).
• Reporting Requirement: Within 180 days of enactment, the FTC (in consultation with the Attorney General, DHS, DOT, and FCC) must report to Congress on:
  • Types of data accessed and parties with access (other than the manufacturer),
  • Government and foreign-government access and usage,
  • Cybersecurity risks and data breach occurrences,
  • Feasibility of a technology-neutral, standards-based secure interface to enable owner access and control.

Vehicle Owner’s Data Access and Control (Section 4)

• Manufacturers must provide owners with access to and control over all covered data generated or processed in real time.
• Access must be unrestricted by additional payment or licensing requirements.
• Access should be available via the vehicle’s interface and wireless transmission if applicable.
• No requirement for owners to decrypt data or purchase special devices beyond standard ownership.

Potential Impact

• Strengthens consumer privacy by mandating explicit consent for data access and limiting data sharing.
• Empowers owners with real-time visibility and control over their vehicle data.
• Introduces compliance obligations for manufacturers, including privacy-by-design considerations and secure data interfaces.
• Creates potential friction for data-driven business models that rely on vehicle data sharing, unless owners opt in.
• Sets up a federal reporting framework to assess data practices and cybersecurity risks in the auto sector.