Michigan has sharply limited access to dealer data systems with the adoption of the Motor Vehicle Dealer Data Collection Act (the “Act”), enacted through S.B. 198 on October 9, 2026 with immediate effect. In so doing, Michigan joins other states—including Arizona, Delaware, Florida, Georgia, Montana, North Carolina, Oklahoma, Oregon, Utah, Washington, and West Virginia—in regulating access to dealer data and dealer data systems, although the approach each state takes to the issue varies in many ways.

The Act, codified at Mich. Comp. Laws §§ 445.2601-445.2621, prohibits manufacturers and third parties from requiring direct or indirect access to a dealer’s data system; requires dealer consent for specified uses of protected dealer data; provides dealers with statutory indemnification rights; and imposes new obligations on dealer data vendors and authorized integrators. Manufacturers and vendors cannot compel access to those systems, and a manufacturer cannot tie program or incentive eligibility to a dealer’s consent to share data.

Michigan Limits Access and Defines “Protected Dealer Data”

In general, the Act prevents a manufacturer or third party from requiring a dealer to grant direct or indirect access to its “dealer data system.”  Mich. Comp. Laws § 445.2605(1). The Act defines the term “dealer data system” to mean software, hardware, or firmware owned, leased, or licensed from a third party by a dealer that stores or provides access to “protected dealer data,” and includes dealership management systems and consumer relations management systems, whether stored at the dealership or remotely. Instead, a dealer may submit information using a widely acceptable electronic file format or protocol that complies with Standards for Technology in Automotive Retail (STAR) standards or other generally accepted cybersecurity standards that are at least as comprehensive. Id., §§ 445.2603(p), 445.2605(2).

The Act defines the term “protected dealer data” broadly to include qualifying personal, financial, or other consumer-related information stored in the dealer data system, motor vehicle diagnostic data stored in the system, and other information concerning the dealer’s business operations stored there. At the same time, the Act contains express limits on its scope and does not apply to data existing outside of a dealer data system, including data generated by a motor vehicle and data generated by a device a consumer connects to a vehicle. Mich. Comp. Laws § 445.2621(a). In addition, “protected dealer data” excludes publicly available information and information a manufacturer or third party obtains from another source. Id., § 445.2603(m).

Limits On Data Use And Fees

The Act also shifts the cost of data misuse. A manufacturer, authorized integrator, or other third party must indemnify a dealer for claims or damages resulting from a violation involving accessing, providing access to, using, or disclosing protected dealer data, where the claims or damages directly result from a violation by: (1) the party from which the dealer seeks indemnification; (2) a vendor or contractor acting as that party’s agent; or (3) a vendor or other service provider a dealer is required to use. Mich. Comp. Laws § 445.2613(1).

A third party may not access, share, sell, copy, use, or transmit protected dealer data, or permit access to it, without the dealer’s prior express written consent. Mich. Comp. Laws § 445.2607(1)(a), (d). Manufacturers are subject to a parallel rule, and may not access, share, sell, copy, use, or transmit protected dealer data, or require a dealer to share or provide access to it, beyond “required manufacturer data” without the dealer’s prior express written consent. Id., § 445.2611(1). The Act defines “required manufacturer data” to include specified information needed to satisfy legal obligations, complete or verify dealer-manufacturer transactions, and support activities such as safety and recall notices, dealer performance evaluations, market analytics, and warranty claims. Id., § 445.2603(n).

The Act preserves a manufacturer’s right to obtain, use, or control required manufacturer data, data proprietary to or created by the manufacturer, information obtained from another source, and public information. Mich. Comp. Laws § 445.2611(5). A manufacturer may not make a dealer’s consent a condition of, or a factor in determining eligibility for, a manufacturer program, standard, or policy, but a manufacturer is not required to pay a benefit if the dealer refuses to provide data reasonably necessary to participate in the particular program. Id., § 445.2609(2)-(3).

A manufacturer may charge a dealer its actual third-party costs for providing access to protected dealer data to the dealer, an authorized integrator, or another third party if the manufacturer discloses the charge in writing and, on the dealer’s written request, documents that the dealer agreed to it. Mich. Comp. Laws § 445.2611(2)(a)-(b). Separately, the Act limits fees when a manufacturer requires a dealer to share required manufacturer data through a third party the manufacturer selects. In that case, neither the manufacturer nor that third party may require the dealer to pay an unreasonable fee for the sharing, as long as the data is in a format compatible with the manufacturer’s required file format and the third-party vendor meets STAR or comparable cybersecurity standards. Id., § 445.2611(4)(a)-(c).

Vendors And Others Face Integration and Exit Rules

Under the Act, dealer data vendors must adopt and make available a standardized framework for exchanging, integrating, and sharing protected dealer data with authorized integrators and for integrators’ retrieval of that data, and must provide authorized integrators access to open application programming interfaces (“APIs”). Mich. Comp. Laws § 445.2615(1)-(2). If APIs are not the reasonable commercial or technical standard for secure data integration, a vendor may instead provide a similar open access integration method that provides the same or better access and uses the required standardized framework. Id., § 445.2615(3).

Dealer data vendors and authorized integrators may access, use, store, or share data from a dealer data system only as permitted by their written agreement with the dealer. Agreements involving protected dealer data must be terminable no more than 90 days after notice. Mich. Comp. Laws § 445.2617(1)–(2). On notice of the dealer’s intent to terminate, the vendor or integrator must ensure a secure transition to a successor by providing access to, or an electronic copy of, the data stored in the dealer data system and by deleting or returning protected dealer data before termination, in accordance with the dealer’s written directions. Id., § 445.2617(3). On a dealer’s request, vendors and integrators also must disclose the entities with which they share protected dealer data or to which they provide access and must permit dealers to audit access to and use of protected dealer data. Id., § 445.2617(4)-(5).

Impact Of and Open Questions Under The Act

Because the Act took immediate effect, businesses that work with the data of Michigan dealers will need to evaluate their processes to ensure compliance with these new statutory requirements. The Act also leaves several practical questions open, including what qualifies as “cause” for immediate revocation and what data is “reasonably necessary” for program participation.