Introduction: the tracker you're sitting on
On this site, we devote a great deal of energy to disciplining our phones: permissions, advertising identifiers, encrypted messaging, alternative operating systems. Meanwhile, most of us climb every morning into an object that generates more personal data than a smartphone, that almost never asks for clear consent, and whose settings nobody ever thinks to check: our car.
A saloon sold in 2026 carries between sixty and a hundred sensors, a built-in SIM card, a GPS unit, one or more microphones, and often an interior driver-assistance camera. It knows where you sleep, what time you leave, whether you brake sharply, how many people are on board, and — the moment you plug in your phone just once — the names of all your contacts.
In September 2023, the Mozilla Foundation published a study that has since become a benchmark, "Privacy Not Included", after examining twenty-five car brands. The conclusion: cars are the worst product category ever reviewed by its researchers when it comes to privacy. Not one of the twenty-five brands met the minimum criteria for data security and control.
This guide is for anyone who drives — private car, company vehicle, holiday rental, car-sharing scheme — and who would rather their movements didn't become an archive available to third parties.
What your vehicle actually records
Technical data: the EDR and the onboard log
Every new vehicle sold in the European Union since July 2024 must be fitted with an event data recorder (EDR), mandated by European Regulation 2019/2144 on general vehicle safety. The device keeps, on a rolling loop, the few seconds preceding an impact: speed, acceleration, brake pedal position, seatbelt use, airbag deployment.
The regulation specifies that this data must be anonymous and must not allow the driver to be identified. In practice, it is read via the vehicle's diagnostic port — and a vehicle identified by its VIN means an owner identified in the vehicle registration database.
Alongside the EDR, the onboard computer permanently records a mass of far less tightly regulated information:
| Data collected | Its official purpose | What it reveals |
|---|---|---|
| Time-stamped GPS position | Navigation, emergency call | Home, workplace, habits |
| Mileage and engine cycles | Predictive maintenance | Frequency and range of journeys |
| Seat occupancy sensors | Airbags, seatbelt warning | Number of passengers, regularity |
| Phone book and call log | Hands-free kit | Complete social circle |
| Destination history | User convenience | Doctor, lawyer, place of worship, a relative's home |
| Driving style | Safety, warranty | A marketable risk profile |
eCall: a useful service, a permanent SIM
Since 2018, every new vehicle type-approved in Europe carries the eCall system, which automatically dials 112 in the event of a serious accident and transmits the vehicle's position. The system was designed with safeguards: Regulation 2015/758 requires the data to be held in a buffer memory and continuously overwritten, and prohibits permanent tracking through this channel.
The problem is not eCall itself. It is that its SIM card sits alongside the manufacturer's proprietary connected services, which are subject to no anonymisation requirement whatsoever. Mobile app, over-the-air updates, unlocking the doors from a phone, roadside assistance: all of them are channels through which location data flows continuously to a server, usually hosted outside the vehicle and sometimes outside Europe.
Who receives this data
The manufacturer, first in line
The terms and conditions for connected services, accepted with a single tap at handover, almost always authorise the transfer of data to the manufacturer, its subsidiaries, and to "partners". The CNIL, in its "Connected vehicles and personal data" compliance pack published in 2017 and later supplemented by the European Data Protection Board (EDPB) guidelines in 2021, restates a simple principle: a vehicle's location is personal data as soon as it can be linked to an individual, and it requires a clear legal basis.
The EDPB explicitly recommends local processing, inside the vehicle, wherever that is technically feasible. Commercial reality points the other way: automotive data has become an asset, and several manufacturers have set up subsidiaries dedicated to monetising it.
The insurer and the telematics box
"Pay how you drive" policies offer a premium discount in exchange for a box or an app that grades your driving. The CNIL framed these schemes as early as 2010 with a dedicated standard, now replaced by an impact assessment regime. Three points deserve thought before you sign:
- Refusing the device must not be punished by a disguised penalty in the pricing.
- Fine-grained geolocation is not necessary to assess driving style: acceleration and braking data are enough.
- A journey history makes formidable evidence in a dispute — including against you, and including in proceedings that have nothing to do with driving.
Third parties: garages, rental firms, resellers
A single visit to the workshop is enough for a technician to read the computer's memory. A three-day rental is enough for your phone book to remain in the infotainment system for the next customer. A second-hand sale, if you have erased nothing, hands the buyer your home address saved as the "Home" destination.
Public space: automated plate reading
Finally, your car is identifiable from the outside, with no onboard electronics at all. Automatic number plate recognition (ANPR) systems are installed at free-flow tolls, in some car parks, at low-emission zone checkpoints and in various police devices governed by the French internal security code. La Quadrature du Net regularly documents the spread of these uses. A number plate is not something you can encrypt: it is a permanent identifier, displayed in large characters, front and back.
The steps that actually make a difference
1. Take stock of your own vehicle
Before adjusting anything, find out what you are driving. In the central screen's menus, look for headings such as "Connected services", "Privacy" or "Data sharing". Depending on the brand, you may find a master switch to turn off data sharing, and sometimes a "minimal data" mode that keeps eCall running and cuts everything else.
Write down what you find on paper rather than in a phone note — a simple hardcover notebook does the job nicely for keeping the list of accounts, settings and credentials linked to the vehicle, to be stored with the car's paperwork and not in the glovebox.
2. Never sync your phone book
This is the single most rewarding step of all. When you connect a phone over Bluetooth, the vehicle invariably offers to import contacts, messages and call history. Decline. The hands-free kit works perfectly well without it: you can make and receive calls, only the display of names disappears.
If you insist on full pairing, do it in your own car, never in a shared, rented or company vehicle. For music, a simple USB stick with your files, or a standalone Bluetooth audio adapter plugged into the auxiliary socket, avoids any link between your phone and the onboard computer.
3. Wipe the system before returning or selling
France's ADEME and consumer associations regularly point out this much-neglected issue: a second-hand vehicle is sold with its memory intact. Before you hand over the keys:
- Delete the paired devices (Bluetooth menu → "Known devices" → delete).
- Erase the destination history and saved points of interest, especially "Home" and "Work".
- Clear the connected accounts: streaming sessions, EV charging accounts, driver profiles.
- Run a factory reset on the infotainment system, often tucked away under "Settings → System → Reset".
- From the manufacturer's mobile app, unlink your account from the vehicle's VIN. This is the most commonly forgotten step, and the one that leaves remote access in the previous owner's hands the longest… or lets them watch the new owner's life unfold.
Conversely, when you buy second-hand, work through the same list: nothing guarantees the seller did so, and you may have inherited a third-party account capable of geolocating your car.
4. Take back control of navigation
The vehicle's built-in GPS feeds the manufacturer. Navigation used from a car phone mount, with a mapping app that works offline, transmits nothing to anyone: the map is downloaded, the route is calculated locally, and no request leaves for a server. Organic Maps and OsmAnd, both built on OpenStreetMap, are the best-documented open-source options.
If you do use the built-in navigation anyway, get into the habit of never saving your exact address as the "Home" destination. Enter a point five hundred metres away — a roundabout, a public car park. You know the way from there.
5. Deal with the telematics box and dashcams
Onboard cameras raise a mirror-image question. A dashcam films public space and, potentially, faces and number plates. The CNIL is clear: strictly private use is lawful, but posting the footage on social media is not without blurring, and recording the cabin with passengers inside requires informing them. Choose a model with a short recording loop, no mandatory cloud connection and no online account: a dashcam that records locally to a microSD card is preferable to one that automatically uploads your journeys.
As for insurance boxes, reread the contract with an eye on the stated purpose. If the box reports permanent geolocation when the declared purpose is assessing driving behaviour, you are entitled to demand data minimisation, with Article 5 of the GDPR to back you up.
Exercising your rights: the letter that shifts things
The GDPR applies in full to vehicle data. Three rights are particularly effective here:
The right of access (Article 15) lets you obtain a copy of all data attached to your VIN and your manufacturer account: location histories, technical events, recipients. The replies are often enlightening — and sometimes embarrassing for the sender.
The right to object (Article 21) lets you refuse processing based on legitimate interest, which covers a good share of the commercial exploitation of driving data.
The right to erasure (Article 17) is particularly useful when selling the vehicle, to purge the manufacturer's servers of the journeys made during your period of ownership.
Address your request to the data protection officer (DPO) of the manufacturer or rental company — their contact details must appear in the privacy policy. The data controller has one month to reply. Beyond that deadline, or in the event of an evasive answer, filing an online complaint with the CNIL takes about ten minutes and triggers a genuine investigation.
Keep a record of your exchanges: registered electronic mail, or failing that a paper letter with acknowledgement of receipt, is infinitely better than a web form with no copy. For sensitive requests, it is sometimes easier to give a callback channel that is not your main line — a secondary number or an anonymous SMS is enough to open a dialogue without immediately handing over your most permanent phone identifier.
Three real-world situations
The holiday rental
You pick up a car at the airport, plug in your phone, and enter the address of your holiday let. Two weeks later, all of it is still there. The right reflex: don't pair, use a cigarette-lighter charger with cable and your own offline navigation, and when you return the car, run a factory reset on the multimedia system — it takes two minutes in the car park.
The company car
An employer may geolocate a work vehicle, but the CNIL sets strict limits: employees must be informed beforehand, the works council must be consulted, tracking outside working hours is prohibited, and there is an absolute ban on geolocating a staff representative while carrying out their mandate. Employees must be able to switch the system off during personal journeys. If they can't, the system is unlawful.
The used car sold to a stranger
The worst-case scenario is not commercial, it is personal: an acrimonious break-up, an ex-partner still linked to the manufacturer account, and an app showing the vehicle's position in real time. Unlinking the account is not an administrative detail, it is a safety measure. If you can't manage it yourself, the manufacturer's customer service can force the disconnection on presentation of the registration document.
Key takeaways
- A recent car is a connected terminal: it collects, stores and transmits, often without explicit consent.
- eCall is tightly regulated; proprietary connected services far less so.
- The most effective step is a refusal: don't sync your phone book.
- Selling, returning a rental and ending a company car agreement are critical moments: reset the system and unlink the account.
- The GDPR gives you real rights, free of charge; the CNIL handles complaints.
Complete anonymity behind the wheel no longer exists: a number plate is a public identifier, and that is the accepted trade-off for the right to drive. But between a plate readable by the authorities and a full log of your journeys, braking, contacts and destinations sitting on a company's servers, there is a gulf — and that gulf is one you can dig yourself in an afternoon of tweaking settings.
