Introduction
Vehicles have transformed from a simple mode of transportation into another interconnected device in the 21st century. Modern vehicles have been compared to smartphones or computers, which are always online, always tracking, and always sharing information and personal data. From GPS navigation to voice assistants and vehicle-to-infrastructure (V2I) communication, connected vehicles generate massive amounts of personal and behavioural data. The convenience is undeniable, but so are the concerns: who owns this data? Who can access it? And what rights does the driver of the connected vehicle actually have over it?
As we cruise into this increasingly connected era, the spotlight is firmly on data privacy, particularly in countries where regulatory frameworks are catching up. And with tech companies, automakers, and even governments in the mix, the question of data privacy isn’t just theoretical, it’s urgent.
What Data Are We Talking About?
When you hear “vehicle data,” it does not simply refer to maps and mileage. The depth and granularity of the data points collected is staggering. It includes:
- Telematics data: GPS location, route history, vehicle speed, and braking habits.
- Driver behaviour analytics: How fast you accelerate, how often you brake hard, or whether you tend to speed.
- In-vehicle media and communications: Calls, messages, media preferences, and even voice recordings.
- Biometric identifiers: Facial recognition for unlocking, fingerprint-based ignition, or fatigue monitoring.
- Vehicle diagnostics: Engine performance, tyre pressure, fuel consumption, battery health (in EVs), and more.
- Third-party integrations: If you sync your phone or use in-car apps, your contact lists, calendar, and app data may be harvested as well.
This amount of data collected is alarming on its own but the real concerns arise when this data is sent to cloud servers, shared with OEMs (Original Equipment Manufacturers), insurance companies, marketing platforms, or even law enforcement.
Why Should This Worry You?
The primary concern isn’t just the amount of data, but who controls it and how transparent that relationship is with the individuals whose personal data is being collected and shared. Unlike using an app or a website where there’s a clear “accept cookies” or “terms and conditions” banner, car owners and users often have no idea what’s being collected under the hood.
The French data protection authority CNIL, in its compliance guide on connected vehicles, puts it plainly: vehicles should be designed to process as much data as possible locally (within the vehicle) and only transmit it externally with informed user consent. But that’s not how most systems are set up today.
According to a study by the Future of Privacy Forum (FPF), drivers typically lack access to the full list of third parties receiving their data. Furthermore, it was also noted that most users don’t even know if their vehicle is connected or what that implies for their privacy.
The Global Regulatory Landscape: Fragmented and Evolving
The changes in the automobile industry vis-à-vis the collection of large amounts of personal data have occurred primarily over the last decade and thus no clear regulations exist that tackle this issue solely. Oftentimes, regulatory authorities use existing data privacy laws to deal with issues arising from the collection, storage and sharing of said data.
- United States: A Case of Voluntary Ethics over Binding Law
The U.S. does not have a single comprehensive federal data privacy law, especially not one tailored to vehicles. What exists instead is a patchwork of guidelines, mandates and State Level Laws such as:
- Industry-led guidelines, such as the Consumer Privacy Protection Principles from the Alliance for Automotive Innovation.
- Federal Trade Commission (FTC) action under its general mandate to prevent unfair or deceptive trade practices.
- State-level laws like the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
These provide a great starting point. For instance, under CPRA, consumers have the right to know what personal data is collected, request deletion, and opt out of its sale. But enforcement is still largely reactive, and many automakers only offer compliance based on the consumer’s state, not as a uniform policy.
- European Union: GDPR
The General Data Protection Regulation (GDPR) remains the most comprehensive privacy law worldwide. It directly impacts connected vehicle ecosystems by:
- Requiring explicit consent for processing personal data.
- Enforcing data minimization and purpose limitation.
- Granting individuals the right to access, correct, or erase their data.
- Mandating Privacy by Design and by Default in Vehicle Architecture.
- CNIL’s guidance supplements this by emphasizing localized data processing, limiting third-party access, and ensuring user control via in-car interfaces.
The EU also mandates that automakers disclose whether vehicle data is used for marketing, insurance profiling, or resale, giving users actionable rights in real time.
- India
India does not have a vehicle-specific legislation that tackles the privacy issues of connected vehicles, however, The Digital Personal Data Protection Act, 2023 (DPDP Act) does lay out a general consent-based framework for data collection and processing which can be used for regulating data collected by automobile manufacturers. While the Act does not specifically deal with connected vehicles, some of its provisions may apply to personal data collected by the vehicles, such as:
- Explicit, free, and informed consent as the baseline for personal data use.
- Data fiduciaries must inform users of data purpose, storage duration, and sharing.
- Hefty penalties for breaches or non-compliance.
However, the gap left by the lack of specific legislation has been attempted to be bridged by sectoral initiatives under the Ministry of Road Transport and Highways, most notably the draft AIS-189, a Cyber Security and Cyber Security Management System (CSMS) standard prepared by the Automotive Industry Standards Committee (AISC). This standard aligns broadly with UN Regulation No. 155 and lays out a formal process for cyber security approval of vehicles, particularly those integrating autonomous driving capabilities.
AIS-189 adopts a systems-based approach to managing cyber threats across the lifecycle of a vehicle—from development and production to post-sale operations. It mandates robust risk assessments, logging for forensic analysis, and cyberattack detection protocols, all of which are crucial for protecting vehicle-generated personal data. Crucially, it places responsibility on manufacturers to implement cyber resilience both within the vehicle architecture and across the supply chain. While the draft AIS-189 focuses on cyber security rather than data privacy per se, its implications are closely tied—especially in how real-time driving data, location patterns, and user behaviours are stored, processed, and safeguarded.
In effect, the draft AIS-189 was created as an attempt to establish a technical standard that will likely be enforced in tandem with India’s broader data governance laws.
Moreover, India’s dependency on foreign automotive technology raises questions about cross-border data flows and data sovereignty, terms that are quickly moving from policy papers into real-world regulation.
As connected vehicles penetrate deeper into the markets, many countries in the Global South, including India, are now reevaluating whether importing connected vehicles without stringent data localization standards is worth the risk. When data generated inside a country is processed abroad, it creates blind spots for governance, national security, and user protection.
Ownership and Control: Who Really Owns Your Data?
The concerns regarding connected vehicles and the data they collect get murkier as many OEMs operate under the implicit assumption that vehicle-generated data is their property, particularly if it’s de-identified or aggregated. Yet, it has been noted that de-identified data can often be re-identified, especially when combined with other datasets.
So even if companies claim not to collect “personally identifiable information,” the combination of geolocation, driving patterns, and voice data can easily create a unique profile.
The core issue of the privacy of personal data arises from the fact that users expect to control their personal data but the manufacturers and service provide function under a default collection model, which offers limited opt-out mechanisms to the user, thus limiting the choice a user has, and taking away the power of consent.
Best Practices to Safeguard Driver Privacy
If we want to balance innovation with privacy, the road ahead has to be paved with clear, enforceable principles. Some of the most critical practices include:
- Data Localization: Wherever feasible, data should be processed and stored within the jurisdiction where the vehicle operates. This not only reduces latency but increases transparency and accountability.
- In-Vehicle Consent Dashboards: Users should be able to manage privacy settings directly from their infotainment screens, with options to opt in or out of specific features.
- Granular Consent: Blanket consent doesn’t cut it anymore. Users must be able to allow some data uses (like navigation) while rejecting others (like behavioural advertising).
- Anonymization and Minimization: Only data that are absolutely necessary should be collected, and wherever possible, it should be anonymized properly—beyond just removing names or phone numbers.
- Clear Retention Policies: Data shouldn’t be stored indefinitely. Automakers and service providers need to disclose how long each type of data is kept and why.
- Regular Privacy Audits and Third-Party Accountability: Just because data is handed off to a third party (say, for analytics or cloud storage) doesn’t mean the responsibility ends there. Liability and compliance must extend across the chain.
The Road Ahead: Privacy, Power, and the Right to Drive Untracked
The world is at a pivotal moment with regard to automobiles as we witness a rise of ‘smart’ cars and autonomous driving vehicles, which have undeniably made driving more convenient. They reduce accidents, cut emissions, and make driving easier. But we cannot afford to ignore the price the users of such vehicles are paying in terms of their privacy. Ideally, owning a connected car would not mean surrendering your data to a web of service providers with little or no option to ‘opt-out’. Instead, it would mean engaging with a transparent, user-first system where you control the flow of your data like you do your steering wheel.
For that to happen, countries especially in the Global South must not merely import vehicles but also import or create strong, contextualized regulatory frameworks. These should align with global best practices while responding to domestic challenges and expectations.
