Auto Innovators, Massachusetts AG agree to consider Data Access Law suit settlement

The Alliance of Automotive Innovation (Auto Innovators) and the Massachusetts Attorney General’s Office have agreed to pause proceedings in an appealed lawsuit regarding the 2020 Data Access Law to consider a settlement.

In February 2025, a Massachusetts district judge dismissed Auto Innovators’ lawsuit, citing the “plain language” of the new state law and ruled that automakers have options to grant or bar access to what’s necessary for repairs.

The suit was filed in 2020 after the passage of the state’s Data Access Law, which was approved by referendum on the state’s November 2020 ballot. The law expands the state’s right to repair law and requires OEMs to create and implement an onboard, standardized diagnostic system that would be accessible to everyone with or without OEM permission.

Auto Innovators argues that OEMs can’t safely and consistently comply with the legislation and appealed the district court’s decision.

During oral arguments before First Circuit Court of Appeals Judges Jeffrey R. Howard and Lara E. Montecalvo on Feb. 3, Auto Innovators argued that while complying with the law is possible, it isn’t possible at this time.

“Auto manufacturers employ cybersecurity protections to prevent unauthorized access to critical vehicle systems,” said Andrew Pincus, attorney for Auto Innvators. “Those governing functions such as steering, braking, and airbag deployment. The challenge in Massachusetts law provisions states that such access controls are permissible only if they’re applied through standardized cross-manufacturer gateways, and those gateways may not be administered by auto manufacturers.

“Because no such gateways exist, the law’s effect is to require manufacturers to disable the cybersecurity protections that restrict access to these systems. But the Federal Motor Vehicle Safety Act requires manufacturers to recall any vehicle with a safety defect, and eliminating access controls for critical vehicle systems creates serious safety risks and therefore bars sales of vehicles that lack those controls. That’s what NHTSA [National Highway Traffic Safety Administration] said in its June 2023 letter to auto manufacturers: that complying with the Massachusetts law would conflict with your obligations under the Safety Act.”

Howard asked if an automaker decided to do the work and build what’s needed, then hired a third-party entity for its administration, would the law become unpreempted?

“I think the attorney general could go back to the district court and say that circumstances have changed, or NHTSA and the attorney general could go back to court,” Pincus said. “That’s basically what the exchange of letters in August [2023] says. NHTSA says in response to the attorney general’s letter, ‘We think this is possible. It takes some work. It will take some time. We’re willing to work with you.’  I think just stepping back, this was a ballot initiative. I think the problem is it doesn’t have a mechanism for creating the systems that it requires, and that’s a gap. And the auto manufacturers can’t fill that gap because they can’t create and administer the system. There has to be someone else.”

Howard agreed that automakers can’t administer it, but said he doesn’t see the prohibition of building it.

Pincus responded that “administer” is, and the parameters or involvement aren’t clearly defined under the statute.

“I think the question is, if they pick the administrator, is that too much OEM involvement? We don’t know the answer to that,” he said.

He added that, instead, the attorney general could’ve called the parties together to determine whether the proposal made in Auto Innovators’ Aug. 23 letter would work for auto dealers and independent service people as well as NHSTA, and ultimately come up with a solution.

“We think that’s what should happen now,” Pincus said. “The problem is the law doesn’t have that mechanism.”

Howard later asked if some kind of ruling compliance is impossible, and if that would prevent automakers from law violations if they’re faced with enforcement.

“Maybe that would work for the attorney general, but there’s private enforcement also,” Pincus responded. “And so we would be in a whack-a-mole mode of private enforcement all over. And I really question the question of impossibility. In the drug cases, the impossibility is based on the current federal labeling requirements and the fact that there’s no obligation on the drug manufacturer to change the label. The label could change. It could adapt.

“The government changes labels all the time. Parties can, based on new developments, and so the idea that there’s preemption based on a collision between state labeling, state common law tort warning requirements, and the label doesn’t mean that that label is going to last forever. It’s certainly possible that that label could be changed in a way that would eliminate that conflict. So I think this is exactly the same situation.”

Howard asked whether the issues in the case would be resolved if vehicle telematics were turned off.

“We’ve lived a long time without telematics, and no one said cars were unsafe,” he said. “So, where is the obstacle [or problem] if you turned off the telematics until this is resolved?”

Pincus responded that turning off the telematics wouldn’t be a resolution because it would create a sub-product.

“It’s not the whole product,” he said. “Because the labeling is applied to the whole product here, the part of the car where there’s a conflict is the telematics… Here, you’re saying you can’t sell telematics unless you violate federal law… We are selling telematics as part of a package. It’s part of the package that attracts customers… Massachusetts is conditioning access to its market on a requirement that violates federal law.”

Assistant Attorney General Christine Fimognari, on behalf of the appellee, former Attorney General Campbell, said the court should affirm the district court’s decision that the Federal Motor Vehicle Safety Act does not preempt the Massachusetts Data Access Law, Auto Innovators lacks associational standing to bring the claim, and it was unnecessary to recall witnesses after the case was transferred to a successor judge.

“The district court properly held that this case can be resolved as a matter of law,” she said. “And a fundamental problem with the alliance’s argument is that they ignore the actual requirements of both the state and federal laws at issue. It is axiomatic that there cannot be preemption where there is simply no federal standard with which to comply. And here, Your Honor, there is no Federal Motor Vehicle Safety Standard that governs telematics or mechanical access to mechanical repair data.”

Montecalvo commented that she’s “a little troubled” by the authorization versus authentication argument.

“Let’s say that we’re persuaded by your argument on that, or by any argument that leaves the statute open to other means of cybersecurity protection beyond authorization,” she said. “Do we then remand this to the district court to sort of figure out what authentication or what other means are adequate for authentication?”

Fimognari responded that she doesn’t believe that would be necessary.

“That jumps the steps because that is based on the theory that the defect recall provision of the Motor Vehicle Safety Act can be preemptive, and our position is that it cannot be,” she said. “But if we jump to that point and accept the alliance’s theory, then no, Your Honor, there’s no need to resolve that dispute because there was unrebutted evidence at trial that there are abilities for an unaffiliated entity to administer an authorization system.

“There is unrebutted testimony from Greg Potter, who works for the Equipment and Tool Institute, which develops the scan tools that are used for the wired access under Section II [of the law]. And his testimony was that some OEMs or manufacturers allow the specific key that’s needed to do authorization to be coded onto scan tools. So the tool itself is plugged in, and it recognizes the person is authorized.”

Fimognari added that it’s the plaintiff’s burden to show preemption, which she contends hasn’t been shown because they haven’t proven that there’s no set of circumstances in which it would be impossible for all OEM alliance members to comply with the law.

Judge Howard noted that some manufacturers don’t require authorization at all and that an unaffiliated entity could be used for authorization, as is done in multiple other industries. He said Pincus’s argument in court that day wasn’t that compliance would be impossible or that OEMs would never consider it. He then asked if that was the first time Fimognari had heard that from Pincus or the alliance.

“As he mentioned, they did send a letter asking to discuss, but from our position, it was not appropriate to discuss because the case was pending, and additionally, there were disputes about how the law could be interpreted,” Fimognari responded. “Manufacturers such as GM have chosen to interpret the law in a way that is overly broad, even with the judge’s limiting construction.”

Howard then asked if the parties want the court to pause the case so they can confer on a settlement. Fimognari said the defendant would like the case decided. Pincus said the plaintiff would be pleased to participate in a discussion with the attorney general, NHTSA , the aftermarket repairers, and other interested parties to try and come to a resolution.

“I think the critical question is everyone agrees now that the law has been interpreted that it’s possible, but it’s not possible now to comply because the entities don’t exist,” Pincus said. “On the scan tool question, it’s clear that there are authorization limits on what that scan tool that my friend referred to can do.”

He also said that Subaru has disabled vehicle telematics in Massachusetts, meaning that enforcement of the state law does exist.

Montecalvo asked the parties to update the court with its progress toward a settlement in three to four weeks.

Auto Innovators also filed suit last year to challenge Maine Attorney General Aaron Frey over the enforcement of the state’s 2023 Data Law because the “independent entity” it calls for “to establish and administer access to vehicle-generated data” via a standardized and owner-authorized platform doesn’t exist.

Under the law, effective Jan. 5, 2025, all automakers must provide access to vehicle data via the platform.

That case was stayed in July pending state legislation. In January, the House voted to override Janet Mills’s veto of LD 1228 — a bill meant to amend the state’s new “automotive right to repair” law while also protecting consumer data privacy. The Senate later voted to sustain the veto.

Images

Featured image credit: gorodenkoff/iStock