Michigan law limits how automakers and vendors can access and use car dealers' data

A third party may not access, share, sell, copy, or use protected dealer data without the dealer's prior express written consent, and automakers and third parties may not force a dealer to grant direct access to its data system. Protected dealer data includes customer personal and financial data, vehicle diagnostic data, and business data stored in the dealer's data system. Consent must be in a separate document that names the parties, data fields, and how long sharing lasts. A dealer can cancel consent on 60 days' notice without cause, or immediately for cause. The act took effect October 9, 2026.

A third party may not use cyber ransom, charge fees beyond its direct costs for access to protected dealer data, or block a dealer from using the data or from linking an authorized integrator. Cyber ransom means locking or threatening to lock a dealer out of its data to get payment that was not agreed to in writing. Authorized integrators are outside companies the dealer hires to do specific work with its data. A charge is not treated as a fee if the third party discloses it and documents the costs, and the dealer agreed to it in writing or the contract provides for it.

A manufacturer may not access or require a dealer to share protected dealer data beyond required manufacturer data without prior express written consent, and may charge only its actual third-party costs, disclosed in writing. Required manufacturer data includes data that law or a transaction requires, vehicle diagnostic data, and data reasonably needed for safety and recall notices, sales, incentives, warranty claims, and dealer performance reviews. Consent cannot be required to take part in a manufacturer's bonus, incentive, or rebate program. Manufacturers and certain third parties must repay a dealer's claims or damages from their violations.

A dealer data vendor must use a standard framework and open interfaces so authorized integrators can connect. It must allow a dealer to end the agreement within 90 days, move the data safely, and let the dealer audit its use. It applies to dealer software companies and authorized integrators that store or use a dealer's protected data. A vendor must list who it shares the dealer's data with on request.