Michigan Enacts New Law Governing Dealer Data Access and Sharing

On October 9, Michigan Governor Gretchen Whitmer signed Senate Bill 198 into law as Act No. 113 of the Public Acts of 2026, enacting the Motor Vehicle Dealer Data Collection Act. The law took effect immediately upon signing and establishes a comprehensive framework governing how manufacturers, third parties, dealer data vendors, and authorized integrators may access, share, and use data generated or stored within a dealer’s systems.

Link to Background Background

The law responds to a recurring point of friction in the auto retail industry: dealers’ concerns that manufacturers and third-party vendors have sought broad, sometimes unilateral, access to data housed in dealer management systems and customer relationship management systems, often as a condition of participation in manufacturer programs or incentive payments. Michigan joins a growing number of states that have enacted “dealer data protection” legislation addressing these issues.

Link to Key Provisions Key Provisions

• No forced system access. The Act prohibits a manufacturer or third party from requiring a dealer to grant direct or indirect access to the dealer’s “dealer data system.” Dealers may instead push data to a manufacturer or third party in a widely accepted electronic format that complies with Standards for Technology in Automotive Retail (STAR) or an equivalent cybersecurity standard.
• Consent requirements for protected dealer data. Third parties, including manufacturers, are barred from accessing, sharing, selling, copying, using, or transmitting “protected dealer data” (personal, financial, or other data relating to a consumer that a consumer provides to a dealer or that a dealer otherwise obtains, and that is stored in the dealer’s dealer data system) without the dealer’s “prior express written consent.” The Act defines this consent narrowly: it must be contained in a document separate from any other agreement, must identify the parties with whom data may be shared, and must specify the scope, data fields, and duration of the sharing arrangement.
• Revocability and anti-conditioning protections. Dealers may revoke or amend consent unilaterally, without cause, with 60 days’ notice, or immediately for cause. Manufacturers are prohibited from making consent a condition of eligibility for any program, bonus, incentive, rebate, or other payment to a dealer, though the Act clarifies that a manufacturer need not pay a benefit if a dealer declines to provide data reasonably necessary to participate in that specific program.
• Limits tied to “required manufacturer data.” The Act distinguishes “protected dealer data” from a narrower category of “required manufacturer data,” which includes data a manufacturer needs to complete transactions, satisfy legal obligations, process warranty claims, evaluate dealer performance, or support marketing and product development. Manufacturers may not reach beyond this defined category without consent, and any charge for data access must be limited to actual, disclosed third-party costs.
• Anti-ransom and anti-restriction provisions. Manufacturers and third parties are barred from engaging in “cyber ransom” (using data access restrictions to extract payment outside agreed contract terms) and from imposing unreasonable fees or technical restrictions that limit a dealer’s or authorized integrator’s ability to access, share, or use dealer data.
• Indemnification. Manufacturers, authorized integrators, and other third parties must indemnify a dealer for damages arising from violations of the Act’s access and disclosure provisions, including violations committed by their vendors or agents, or by vendors the third party required the dealer to use. The dealer bears the burden of proof in any such action.
• Standardized integration framework. Dealer data vendors must adopt a standardized framework, including open application programming interfaces (APIs) (or a comparable open-access method), to enable authorized integrators to exchange and retrieve protected dealer data using STAR-compliant standards.
• Termination and data portability. Agreements between a dealer and a dealer data vendor or authorized integrator must be terminable within 90 days of notice. Upon termination, the vendor or integrator must provide a secure transition of data to a successor, delete or return data per the dealer’s instructions, disclose any third parties with whom data has been shared, and permit the dealer to audit the vendor’s or integrator’s data access and use.
• Scope limitations. The Act does not extend to data generated outside a dealer data system, including vehicle-generated or connected-device data. It also does not alter existing obligations under other data protection laws, and it does not grant dealers ownership of motor vehicle diagnostic data beyond what is necessary to fulfill warranty, repair, or service obligations to consumers.

Link to Takeaways for Auto Finance and Consumer Lending Professionals Takeaways for Auto Finance and Consumer Lending Professionals

For manufacturers, dealer data vendors, and third-party integrators operating in Michigan, the Act introduces specific contractual and technical compliance obligations: consent documentation practices, fee transparency and justification requirements, integration and API standards, and defined termination and data-portability procedures. Entities that provide financing, service, or data-related products to dealers in Michigan may need to review existing agreements and data-sharing practices against these new requirements.