The Fight Over Your Car’s Data Is Really A Fight Over One Word: Telematics
Ask a room full of drivers whether they own the data their car generates and you will get unanimous agreement in about four seconds. Ask Congress the same question and you get a five-year legislative knife fight that is currently down to its final weeks.
Rep. Neal Dunn’s REPAIR Act has been the vehicle for that argument. The bill would bar automakers from putting technological or legal barriers between a vehicle owner and the data their own car produces, and it defines that data with unusual precision. Read the bill text and you find “vehicle-generated data” limited to direct, real-time, in-vehicle information tied to diagnostics, repair, service, wear and calibration needed to return a vehicle to spec under federal safety and emissions rules. Automated driving system data is explicitly carved out. Enforcement sits with the Federal Trade Commission, NHTSA writes the security standards, and an independent entity not controlled by automakers would administer access.
Then the machinery of Congress got hold of it.
How a right-to-repair bill became a footnote in a highway bill
The REPAIR Act cleared an Energy and Commerce subcommittee in February. In May, the full committee did something more interesting than killing it: the committee swapped it for a narrower right-to-repair title inside H.R. 7389, the Motor Vehicle Modernization Act, which advanced 48-1 and is expected to ride along with the surface transportation reauthorization. That matters because the current authorization runs out September 30, which is why H.R. 8870 and everything bolted to it is on a hard clock right now.
Related Articles
- An Iowa Dealer Allegedly Financed the Same Cars Twice — Stellantis Just Won $5.5 Million By Default
- GM’s Wireless Update Failed So Badly, Dealers Now Have to Fix These 7 SUVs By Hand Before Selling Them
The substitute language does two things. It takes the 2014 voluntary memorandum of understanding between automakers and independent repair groups and makes it federal law for vehicles under 14,000 pounds, does the same with the heavy-duty agreement above that weight, and hands the FTC enforcement power plus a mandate to study the issue further.
Dunn was not thrilled. In a statement from his office he said the committee version does not fully reflect the original bill and pushed for the stronger provisions on the House floor, framing it in one line: “If you own your car, you should own its data.”
The National Automobile Dealers Association took the opposite position, urging Congress to keep the committee language exactly as written and arguing that further federal intervention hasn’t been justified. Its public position paper also notes that the committee declined to adopt what it calls insurer-backed repair provisions from the original bill, and flags that supporters may try to add them back on the floor. That is worth sitting with. Some of the loudest voices for expansive data access are backed by insurers, who would very much like claims to get cheaper. This is not a clean morality play.
What the 2014 agreement actually covers, and what it doesn’t
Here is the crux, and almost nobody spells it out.
The 2014 MOU obligates automakers to make the same diagnostic and repair information and tools available to independent shops that they provide their dealers, at fair market cost. That was a meaningful win when it was signed, because diagnostics meant a cable plugged into an OBD-II port.
It is silent on telematics. Data that leaves the vehicle over a cellular modem and lands in a manufacturer’s cloud was not a commercial reality worth fighting over in 2014, and the agreement was not written to reach it. Codifying it in 2026 locks in a snapshot of a world that no longer exists. That is precisely why the committee version drew the objection it did, and precisely why automakers are comfortable with it. The Alliance for Automotive Innovation has been asking legislatures to do exactly this for years; after Maine’s 2023 right-to-repair referendum passed, the group urged lawmakers to codify the existing national agreement instead, arguing that a data mandate is a marketing grab rather than a repair fix.
The federal baseline that already exists
An underappreciated fact: parts of this fight were settled in 2003, and by the EPA rather than by Congress.
EPA’s service information final rule required manufacturers to publish full-text emissions-related service and training information on the web, to sell their OEM-specific diagnostic tools to anyone who wants one, to release enhanced diagnostic information to tool companies, and to give equipment makers what they need to build pass-through reprogramming capability. That last item is the origin of the SAE J2534 pass-thru device sitting on the bench at every serious independent shop.
Notice the boundary. Emissions-related repair information is federally open because the Clean Air Act gave EPA a hook. Everything outside the emissions envelope — body control modules, restraint systems, ADAS calibration routines, telematics — has no equivalent mandate. The gap in the law maps almost exactly onto the systems that have gotten expensive.
What “digital lockout” means at the bay level
The phrase gets used loosely, so let’s be concrete about the layers a shop hits on a late-model car.
First, the security gateway. Several manufacturers route the OBD-II port through a module that permits reads but blocks bidirectional commands until the tool authenticates. Plug in without credentials and you can see codes but cannot command an actuator, bleed an ABS module or reset an adaptation.
Second, security-sensitive functions. Keys, immobilizers and theft-related module replacement run through a credentialing system administered by the National Automotive Service Task Force, whose Vehicle Security Professional registry vets technicians and locksmiths and has grown past 11,000 participants. This is genuinely useful infrastructure — a key programmer in the wrong hands steals a car through the OBD port in minutes — but it is also a gate, with fees and a background check.
Related Articles
- Honda and Nissan’s Merger Collapsed — So They’re Quietly Merging Their Computers Instead
- China’s #1 Bestselling Car Just Failed Its Own Safety Audit — And That’s Not Even the Scary Part
Third, module programming. Replacing a control unit usually means an OEM subscription, a J2534 device, a stable power supply and a calibration file pulled from the manufacturer’s server. Fourth, calibration. Anything that touches a camera bracket, radar mount or steering angle sensor requires an OEM-specified procedure that increasingly demands targets, floor space and lighting a two-bay shop may not have.
None of that is malice. All of it is cost, and it lands on the same invoice you sign.
Where the money shows up
The federal data supports the premise even if you distrust everyone lobbying on it. Headline inflation ran 3.4 percent over the twelve months through July 2026. The Bureau of Labor Statistics’ motor vehicle maintenance and repair index has been posting year-over-year increases in the five-to-seven percent range, running consistently ahead of the broader basket for years. Repair is getting more expensive faster than almost everything else you buy for the car.
The state laws already on the books
If you want to see what a telematics mandate looks like in statute rather than in a press release, read Massachusetts. Chapter 93K Section 2 requires manufacturers using telematics on model year 2022 and later vehicles to provide an interoperable, standardized, open access platform, accessible to the owner through a mobile app and, with the owner’s authorization, to an independent shop — including the ability to send commands to in-vehicle components. The same section carves out immobilizer and security module resets and points them to the NASTF secure data release model, which is a more thoughtful piece of drafting than the debate usually acknowledges.
Massachusetts also gave owners a document most people ignore. If you buy a 2022-or-newer car with telematics in the state, the dealer must hand you a telematics notice and collect your signature confirming you read it. It explains what data the car collects and your right to route it to the shop of your choosing.
Practical takeaways
For owners: before you commit to a repair on a car under six years old, ask the shop directly whether it holds the manufacturer subscription for your brand and whether it can perform the required calibrations in-house or sublets them. A shop that sublets calibration is not a bad shop, but the sublet is a line item and a delay you should know about up front. If your car has an app that surfaces diagnostic data, look at what it actually reports before your next visit.
For anyone watching the bill: the tell is one word. If the floor version of the highway package includes an enforceable telematics access mandate, the aftermarket won something real. If it codifies the 2014 agreement and orders a study, the industry did.
The clock runs out at the end of the month.