Car Privacy Rights Act of 2026

(a) Privacy policy

(1) In general. A covered entity shall provide a privacy policy meeting the requirements described in paragraph (2) to each consumer whose consumer car-related data the covered entity collects, processes, or transfers.

(2) Privacy policy requirements. A privacy policy described in paragraph (1) shall contain—

(A) a detailed and accurate representation of the policies of the covered entity regarding the collection, processing, and transferring of consumer car-related data; and

(B) a prominent description of how a consumer can exercise the rights described in this Act.

(b) Disclosures. Upon request from a consumer, a covered entity shall provide such consumer—

(1) confirmation regarding whether a covered entity is collecting or processing the consumer car-related data of the consumer;

(2) access to such data; and

(3) if a consumer has provided affirmative express consent to allow a covered entity to share or sell such data pursuant to section 4(a)(2), a list of any third party, other than an individual to which the covered entity has transferred such data.