AN ACT to amend Tennessee Code Annotated, Title 4; Title 5; Title 6; Title 47 and Title 55, relative to data privacy.
HB0367 creates a new Tennessee consumer privacy rule focused on vehicle-generated data. It defines terms such as “driving data,” “infotainment system,” “telematics system,” and “advanced driver assistance system,” and then prohibits an entity from sharing, selling, or otherwise distributing a vehicle’s driving data without the vehicle owner’s express written consent. The bill also requires disclosures to buyers or owners explaining that driving data will be collected, how it will be collected, and why, along with notice that the data cannot be shared without explicit written consent.
The bill further requires renewed consent one year after the initial consent is obtained, or by January 1 of the following year, whichever is later, and annually thereafter. It also requires entities to provide an easy-to-access way for owners to revoke consent, including through websites and apps. The bill exempts disclosures to NHTSA and other state or federal entities when required by law, and it takes effect July 1, 2025, applying prospectively to conduct on or after that date.
HB0367 amends Tennessee’s consumer protection laws by adding a new section to Title 47 and by making violations of the new vehicle-data privacy requirements an unfair or deceptive act or practice under the Tennessee Consumer Protection Act. This means businesses that collect or handle vehicle driving data could face the Act’s penalties and remedies if they share or sell that data without proper consent. The bill primarily affects vehicle manufacturers, connected-car service providers, telematics companies, and other entities handling data from modern vehicle systems.
No committee transcripts or recorded votes were provided, so there is no direct evidence of debate or formal support/opposition in the supplied materials. Based on the bill text, the measure appears to be framed as a consumer privacy protection bill, suggesting a generally privacy-protective policy approach rather than a controversial regulatory expansion. The absence of recorded discussion makes it impossible to assess whether the bill was broadly supported, opposed, or amended in committee.
The main potential point of contention is the scope of consent and compliance obligations imposed on vehicle manufacturers and related entities, especially the requirement for express written consent, annual renewal, and an accessible revocation mechanism. Businesses that rely on connected-vehicle analytics, telematics, or data-sharing arrangements may view the bill as burdensome or disruptive to existing data practices. On the other hand, consumer advocates would likely support the bill’s restrictions on sharing sensitive location, driving behavior, and vehicle-health data without clear permission.