Motor Vehicle Dealer Data Collection Act, protected dealer data

The Motor Vehicle Dealer Data Collection Act regulates data collection by motor vehicle dealers, manufacturers and third parties, prescribes requirements for the collection, sharing and use of protected dealer data, and regulates dealer data vendors and authorized integrators (2026 PA 113, title).

Protected dealer data includes personal, financial or other data relating to a consumer that a consumer provides to a dealer or that a dealer otherwise obtains and that is stored in the dealer's dealer data system, together with motor vehicle diagnostic data and data about the dealer's business operations stored in that system (section 3(l)).

Protected dealer data does not include data that is otherwise publicly available or that a manufacturer or third party obtains through another source (section 3(m)). A third party is a service provider, vendor, dealer data vendor, authorized integrator or any person other than a dealer, a government entity acting under federal, state or local law, an entity acting in accordance with a valid court order, a manufacturer, or an affiliate thereof (section 3(q)).

A manufacturer or a third party may not require a dealer to grant the manufacturer or the third party, or a person acting on behalf of either, direct or indirect access to the dealer's dealer data system (section 5(1)). A third party may not access, share, sell, copy, use or transmit protected dealer data without the dealer's prior express written consent (section 7(1)(a)). A third party may not engage in an act of cyber ransom (section 7(1)(b)).

A third party may not take an action by contract, technical means or any other means to prohibit or limit a dealer's ability to protect, store, copy, share or use protected dealer data (section 7(1)(c)). A dealer may unilaterally revoke or amend its prior express written consent without cause on 60 days' notice, or immediately for cause (section 9(1)).

Prior express written consent must not be a condition of or a factor for consideration or eligibility for any manufacturer program, standard or policy, including one that offers a bonus, incentive, rebate or other payment or benefit to a dealer (section 9(2)). A manufacturer may not access, share, sell, copy, use or transmit protected dealer data, or require a dealer to share or provide access to it, beyond the required manufacturer data without prior express written consent (section 11(1)).

A manufacturer and a third party may not engage in an act of cyber ransom or take an action by contract, technical means or any other means to prohibit or limit a dealer's ability to protect, store, copy, share or use protected dealer data (section 11(3)).

A manufacturer, authorized integrator or other third party must indemnify a dealer for claims or damages that directly result from its violation, from a violation by its vendor or contractor acting as its agent, or from a violation by a vendor or service provider it required the dealer to use, where the violation concerns accessing, providing access to, using or disclosing protected dealer data (section 13(1)).

A dealer bringing a cause of action against a manufacturer, authorized integrator or other third party for a violation has the burden of proof (section 13(2)). A dealer data vendor must adopt and make available a standardized framework for the exchange, integration and sharing of protected dealer data with an authorized integrator and for the retrieval of that data by an authorized integrator using star standards or a compatible standard (section 15(1)).

A dealer data vendor must provide access to open application programming interfaces to an authorized integrator (section 15(2)). A dealer data vendor or an authorized integrator may access, use, store or share protected dealer data or any other data from a dealer data system only to the extent allowed in a written agreement with the dealer (section 17(1)).

An agreement on access to, sharing, selling, copying, using or transmitting protected dealer data must be terminable not more than 90 days after the dealer data vendor or authorized integrator receives notice from the dealer (section 17(2)).

On notice of the dealer's intent to terminate, a dealer data vendor or an authorized integrator must give a successor access to or an electronic copy of all protected dealer data in a commercially reasonable time and format, and must delete or return all protected dealer data to the dealer before the agreement ends, in accordance with the dealer's written directions (section 17(3)).

On a dealer's request, a dealer data vendor or an authorized integrator must give the dealer a list of any entity it is sharing protected dealer data with or has allowed to access protected dealer data (section 17(4)). A dealer data vendor or an authorized integrator must allow a dealer to audit its access to and use of any protected dealer data (section 17(5)).

The Act does not govern, restrict or apply to data that exists outside a dealer data system, including data generated by a motor vehicle or by a device that a consumer connects to a motor vehicle (section 21(a)). The Act took effect on October 9, 2026, the day the Governor approved it.