HB2418 Summary - Protected Data for Motor Vehicle Dealers

• Prohibits manufacturers and third parties from requiring dealers to grant direct access to dealer data systems; dealers may instead submit data through widely acceptable electronic formats that comply with STAR standards or equivalent security standards.

• Requires prior express written consent (in a separate document) before any third party can access, share, sell, copy, or use protected dealer data, and allows dealers to revoke consent with 30 days' notice or immediately for cause.

• Prohibits cyber ransom activities (encrypting or restricting access to dealer data for monetary gain) and prevents third parties from imposing unreasonable fees, restrictions on integration, or limitations on a dealer's ability to protect, store, copy, or share protected dealer data.

• Limits manufacturers to accessing only "Required Manufacturer Data" needed for safety recalls, vehicle sales, incentive validation, warranty claims, performance evaluation, analytics, and marketing purposes; prohibits use of financial information or dealer notes unrelated to transactions.

• Requires dealer data vendors and authorized integrators to adopt standardized frameworks compatible with STAR standards, provide open API access, allow 90-day termination of agreements, securely transition data to successors, disclose data sharing arrangements, and permit dealer audits of data access and use.