H.R. 6687

119 HR 6687 IH: Data Rights for Information and Vehicle Electronics in Real-time Act
 U.S. House of Representatives
 2025-12-12
 text/xml
 EN
 Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
 I  119th CONGRESS  1st Session  H. R. 6687  IN THE HOUSE OF REPRESENTATIVES   December 12, 2025   Mrs. Harshbarger  (for herself,  Mr. Weber of Texas , and  Mr. Perry ) introduced the following bill; which was referred to the  Committee on Energy and Commerce    A BILL
To require manufacturers of motor vehicles to provide motor vehicle owners with access to and use of motor vehicle data of motor vehicles, and for other purposes.
1.
Short title
This Act may be cited as the   Data Rights for Information and Vehicle Electronics in Real-time Act   or the   DRIVER Act  .
2.
Motor vehicle owner access to motor vehicle data
A manufacturer of a motor vehicle shall provide to a motor vehicle owner secure access to, and joint control of, any motor vehicle data of the motor vehicle of such motor vehicle owner as follows:
(1)
At no cost beyond the purchase price of such motor vehicle.
(2)
In real time.
(3)
Without any restriction or limitation with respect to the manner in which such motor vehicle owner, for any lawful purpose—
(A)
uses such motor vehicle data; or
(B)
authorizes access to or use of such motor vehicle data by a third party, other than a person owned or controlled by a foreign adversary (as defined in section 791.2 of title 15, Code of Federal Regulations).
(4)
Without a requirement that such motor vehicle owner pay a fee or purchase a license to decrypt such motor vehicle data or use a device provided by such manufacturer to access and use such motor vehicle data.
(5)
Through a motor vehicle interface port (such as an on-board diagnostics port) of such motor vehicle and through wireless transmission of such motor vehicle data (to the extent such motor vehicle is equipped with technology to wirelessly transmit such motor vehicle data).
(6)
In a manner that facilitates the deletion of any user data stored in such motor vehicle.
(7)
In compliance with any voluntary automotive industry cybersecurity standards requirements (such as ISO/SAE 24134).
3.
Additional motor vehicle owner data access controls
(a)
Vehicle owners’ data access control with respect to motor vehicle manufacturers
A manufacturer of a motor vehicle may not, with respect to a motor vehicle manufactured by such manufacturer, sell any covered data unless the manufacturer provides to the motor vehicle owner of such motor vehicle a clear and conspicuous opportunity to opt out of any such sale.
(b)
Fleet vehicle drivers’ data access control with respect to motor vehicle fleet owners
(1)
In general
A motor vehicle fleet owner may not, with respect to a motor vehicle that such motor vehicle fleet owner leases or in which such motor vehicle fleet owner has an ownership or contracted beneficial interest, sell any covered data, unless the motor vehicle fleet owner provides to the driver or operator of such motor vehicle a clear and conspicuous opportunity to opt out of any such sale.
(2)
Limitation
The requirement to provide an opportunity to opt out described in paragraph (1) does not apply if the relevant data is generated by a commercial or governmental fleet vehicle driven by a driver in the course of the employment of the driver, except if such driver behavior data is to be sold for the purpose of profiling in furtherance of decisions that knowingly cause negative legal or similarly significant harmful effects concerning the conduct of a person outside the course of the employment of the person.
(c)
National security
A manufacturer of a motor vehicle or a motor vehicle fleet owner may not knowingly sell motor vehicle data to any of the following:
(1)
The Democratic People’s Republic of Korea.
(2)
The People’s Republic of China.
(3)
The Russian Federation.
(4)
The Islamic Republic of Iran.
(5)
The Bolivarian Republic of Venezuela.
(d)
Exceptions
For purposes of this section, a sale does not include any of the following activities:
(1)
Transferring covered data to emergency responders.
(2)
Responding to an owner-initiated communication originating from within a motor vehicle or an app, where covered data may be transferred only to provide the response.
(3)
Responding to a vehicle-initiated communication related to the safe operation of a motor vehicle, where covered data may be transferred only to provide the response.
(4)
Responding to a driver or user-initiated communication originating from within a motor vehicle or an app, where covered data may be transferred only to provide the response.
(5)
Conducting research or efforts to improve, repair, enhance the safety of, or develop products, services, or technology.
(6)
Investigating or defending claims and losses.
(7)
Conducting investigations of potential product quality, fraud, theft, or safety issues.
(8)
Determining or effectuating vehicle field actions, including customer satisfaction campaigns, technical service bulletins, compliance recalls, and safety recalls.
(9)
Detecting or responding to cybersecurity incidents.
(10)
Administering and fulfilling motor vehicle warranties.
(11)
Performing diagnostics and prognostics of a motor vehicle or a component of a motor vehicle.
(12)
Identifying and addressing issues that impair functionality.
(13)
Disclosing covered data to a processor that processes such covered data on behalf of a manufacturer of a motor vehicle or a motor vehicle fleet owner.
(14)
Disclosing or transferring covered data to an affiliate of a manufacturer of a motor vehicle or a motor vehicle fleet owner.
(15)
Disclosing information that a consumer—
(A)
intentionally makes available to the general public through a channel of mass media; and
(B)
does not restrict to a specific audience.
(16)
Disclosing or transferring covered data to a third party as an asset that is part of a proposed or an actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the assets of a controller.
(17)
Complying with a lawfully executed warrant.
(18)
Complying with a court order.
4.
Enforcement by Commission
(a)
Unfair or deceptive acts or practices
A violation of section 2 shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ) regarding unfair or deceptive acts or practices.
(b)
Powers of Commission
The Commission shall enforce section 2 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ) were incorporated into and made a part of this Act, and any person who violates such section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
5.
Disclosure of confidential business information
Except as provided in section 2, nothing in this Act shall be construed to require a motor vehicle manufacturer to divulge confidential business information (as defined in section 512.3(c) of title 49, Code of Federal Regulations).
6.
Relationship to State law
No State, or political subdivision of a State, may maintain, enforce, prescribe, or continue in effect any law, rule, regulation, requirement, standard, or other provision having the force and effect of law that relates to section 2 of this Act.
7.
Definitions
In this Act:
(1)
Biometric identifier
The term  biometric identifier  means motor vehicle data generated by automatic measurements relating to biological characteristics of an individual that are any of the following:
(A)
Fingerprints.
(B)
Facial features.
(C)
Iris or retina patterns.
(D)
Gait.
(E)
Voice.
(F)
Body measurements.
(G)
Weight.
(2)
Commission
The term  Commission  means the Federal Trade Commission.
(3)
Covered data
(A)
In general
The term  covered data —
(i)
means personal data that relates to a biometric identifier, precise geolocation, or driver behavior with respect to a motor vehicle owner (or a driver or other user of a motor vehicle of such motor vehicle owner); and
(ii)
includes personal data received by such motor vehicle from a personal device of such motor vehicle owner, driver, or other user of a motor vehicle.
(B)
Exclusion
The term  covered data  does not include deidentified, pseudonymous, aggregate, or publicly available information.
(4)
Driver behavior
The term  driver behavior  means motor vehicle data that is used for the purpose of profiling in furtherance of decisions that knowingly cause a negative legal or similarly significant harmful effect concerning the conduct of a motor vehicle owner outside the course of the employment of the motor vehicle owner.
(5)
Motor vehicle
The term  motor vehicle —
(A)
has the meaning given such term in section 30102(a) of title 49, United States Code; and
(B)
includes a motor vehicle trailer.
(6)
Motor vehicle data
The term  motor vehicle data  means electronic data generated or processed onboard a motor vehicle, including data generated by sensors, receivers, computer processing units, and other components of the motor vehicle.
(7)
Motor vehicle fleet owner
The term  motor vehicle fleet owner —
(A)
means a person—
(i)
with an ownership or contracted beneficial interest in 5 or more motor vehicles; or
(ii)
who is the lessee of a motor vehicle under a lease agreement with a term of at least 180 days; and
(B)
includes a designee of a motor vehicle owner.
(8)
Motor vehicle owner
The term  motor vehicle owner —
(A)
means an owner of a motor vehicle; and
(B)
includes—
(i)
a designee of such owner;
(ii)
a person with an ownership or contracted beneficial interest in a motor vehicle; and
(iii)
a lessee of a motor vehicle under a lease agreement with a term of at least 180 days.
(9)
Personal data
The term  personal data —
(A)
means any motor vehicle data that is linked to an identified or identifiable natural person; and
(B)
does not include deidentified, pseudonymous, aggregate, or publicly available information.
(10)
Precise geolocation
The term  precise geolocation  means motor vehicle data that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet.
(11)
Sell; sells; sale
The terms  sell ,  sells , and  sale —
(A)
mean the exchange of data for monetary consideration; and
(B)
do not include when a driver or user of a motor vehicle requests a specific product or service from a manufacturer of a motor vehicle or a motor vehicle fleet owner that is necessary for such manufacturer or motor vehicle fleet owner to disclose such motor vehicle data to a third party to provide such service or product to such driver or user.
(12)
User data
The term  user data —
(A)
means data transferred from a personal or external device to a motor vehicle by a motor vehicle owner or user of such motor vehicle; and
(B)
does not include motor vehicle data.