HB 357: Amendments to Motor Vehicle Data Privacy - Utah

Amended 2/26/2026 12:02:214 → Substitute #1 · 6 edits

MODERATE

This bill introduces new definitions and requirements specifically for motor vehicle manufacturers under the Utah Consumer Privacy Act. It mandates that vehicles manufactured in 2030 or later include in-vehicle privacy controls allowing consumers to view data collection, opt out of targeted advertising, and delete data. The bill also creates exemptions for safety and operational data, requiring manufacturers to collect only the minimum necessary information for vehicle safety and function without needing consumer consent.

Scope change

The bill expands the scope of the Utah Consumer Privacy Act to explicitly include motor vehicle manufacturers as covered entities, whereas the original text did not contain these specific provisions.

DEFINITION

Added new definitions for 'Connected device', 'In-vehicle interface', and 'Readily accessible data' to establish the technical scope of the new privacy rules.

REQUIREMENT

Added a requirement for motor vehicle manufacturers to provide in-vehicle privacy controls in model year 2030 or later vehicles, enabling consumers to manage data sharing and advertising preferences directly from the car.

Added a requirement for manufacturers to delete personal data within five business days if ordered by a court or legally issued protective order.

EXEMPTIONS

Added exemptions allowing manufacturers to collect personal data for vehicle safety, operation, and legal compliance without obtaining consumer consent.

ENFORCEMENT

Added a requirement for the Motor Vehicle Division to publish information on its website regarding consumer data privacy rights for vehicle owners.

TIMELINE

Modified the effective date to January 1, 2027, and added a provision allowing manufacturers to delay compliance for specific models that are not yet technologically capable of meeting the new privacy control requirements.

Amended Excerpts 2/26/2026 12:02:214 → Amended 2/26/2026 12:02:214 · 4 edits

MODERATE

The bill text was reformatted from a list of line-by-line edits into a complete legislative substitute bill. Substantively, the bill defines new terms for motor vehicle data privacy, applies Utah's consumer privacy laws to vehicle manufacturers, mandates in-vehicle privacy controls, and creates specific exemptions for safety and operational data.

Scope change

The bill now explicitly applies the Utah Consumer Privacy Act to motor vehicle manufacturers and introduces new definitions tailored to vehicle data.

DEFINITION

Added specific definitions for 'Account', 'Affiliate', 'Aggregated data', 'Air carrier', 'Authenticate', 'Biometric data', 'Business associate', 'Child', 'Consent', 'Consumer', 'Control', 'Controller', 'Covered entity', 'Deidentified data', 'Director', 'Division', 'Governmental entity', 'Health care facility', 'Health care provider', 'Identifiable individual', 'Institution of higher education', and 'Motor vehicle data collection system'.

REQUIREMENT

Added requirements for in-vehicle privacy controls and exemptions for data collected solely for vehicle safety, operation, or legal compliance.

ENFORCEMENT

Added a requirement for the Motor Vehicle Division to provide information to consumers about their privacy rights.

TECHNICAL

Changed the document format from a list of line edits to a full bill text including a long title, general description, and affected code sections.

Enrolled → Amended Excerpts 2/26/2026 12:02:214 · 1 edit

MINOR

The bill was amended to correct a formatting error in the exemptions section, which originally listed 'operational safety' before 'passenger safety.' The amendment reorders these terms to ensure the list of vehicle safety features is logically structured and easier to read.

TECHNICAL

Reordered the list of vehicle safety exemptions in Section 13-61-503 to place 'operational safety' before 'passenger safety' for better logical flow.

Introduced → Enrolled · 6 edits · Mar 19, 2026

MODERATE

This bill amends the Utah Consumer Privacy Act to specifically include motor vehicle manufacturers as covered entities. It mandates that vehicles manufactured in 2029 or later must have in-vehicle privacy controls allowing consumers to view data collection, opt out of data sales, and delete personal data. The bill also exempts certain safety and operational data from consent requirements and requires the Motor Vehicle Division to inform new owners of their privacy rights.

Scope change

The bill expands the scope of the Utah Consumer Privacy Act to explicitly apply to motor vehicle manufacturers, whereas previous versions focused on general data controllers and processors.

DEFINITION

Added new definitions for 'Connected device', 'In-vehicle interface', and 'Readily accessible data' to clarify the scope of vehicle data privacy.

REQUIREMENT

Requires motor vehicle manufacturers to provide in-vehicle privacy controls for model year 2029 or later, enabling consumers to view data categories, opt out of sales, and delete data.

Mandates that the Motor Vehicle Division provide website information and notices to new vehicle owners regarding their data privacy rights.

EXEMPTIONS

Exempts personal data collected solely for vehicle safety, operation, or legal compliance from consent requirements.

ELIGIBILITY

Modified applicability rules to explicitly include motor vehicle manufacturers that sell or lease vehicles in the state and collect data via vehicle systems.

TIMELINE

Established a specific effective date of May 6, 2026, for the new provisions.

Amendments to Motor Vehicle Data Privacy

What changed between versions

How they voted

Actions timeline

Sponsors