CNIL Connected Vehicles: Complete Guide to Location Data GDPR Compliance

Introduction

Connected vehicles—cars, bikes, scooters—generate vast amounts of location data. This data is highly personal: it can reveal home addresses, workplaces, daily habits, and even sensitive locations like medical clinics or political gatherings. Recognizing these privacy risks, the French data protection authority (CNIL) published new recommendations on the use of geolocation data from connected vehicles in 2025, following a public consultation in March 2025. These recommendations supplement the 2017 'connected vehicles' compliance pack and align with EDPB guidelines.

This guide covers everything you need to know about CNIL connected vehicles recommendations, location data GDPR requirements, and practical steps for connected car privacy compliance. Whether you are a vehicle manufacturer, fleet manager, telematics provider, or data aggregator, you'll learn how to comply with French data protection authority recommendations and ensure proper geolocation data consent.

This content is for informational purposes only and does not constitute legal advice.

Prerequisites

Before diving into compliance steps, ensure your organization has:

• Understanding of GDPR basics – Familiarity with key concepts like data controller, processor, consent, and data subject rights.
• Knowledge of the ePrivacy Directive – Especially Article 5(3) regarding consent for storing/accessing information on user devices.
• Existing data protection framework – A Data Protection Officer (DPO) and basic privacy policies in place.
• Inventory of connected vehicle data processing – What location data is collected, for what purposes, and by whom.

Step 1: Understand the CNIL's Scope and Key Principles

The CNIL's recommendations apply to all actors involved in processing location data from connected vehicles used by private individuals (owners or lessees). This includes:

• Vehicle manufacturers
• Fleet managers (for private vehicles, not company cars)
• Telematics service providers
• Data aggregators

The CNIL emphasizes that location data is highly personal and can reveal intimate details. Therefore, processing must adhere to three core principles:

1. Strict necessity – Only collect data that is strictly necessary for the declared purpose.
2. Proportionality – Collection frequency, quantity, and retention must be proportionate.
3. Transparency – Users must be clearly informed about what data is collected and why.

Consent Requirements Under the ePrivacy Directive

A critical aspect is when consent is required. Under the ePrivacy Directive (transposed into French law), consent is needed for accessing or storing information on a user's device (including vehicle telematics systems) unless the processing is strictly necessary for providing a service explicitly requested by the user. For example:

• Consent needed: Using location data for product improvement, marketing, or aggregated analytics.
• Consent may not be needed: If location data is essential for an emergency assistance service that the user has activated.

The CNIL's recommendations clarify these boundaries, helping you determine when to obtain geolocation data consent.

Step 2: Map Your Data Processing and Purposes

Create a detailed record of all location data processing activities. For each processing, document:

• Purpose – Is it for navigation, emergency assistance, fleet management, theft prevention, product improvement, or insurance telematics?
• Legal basis – Consent or legitimate interest? If legitimate interest, conduct a Legitimate Interest Assessment (LIA).
• Data collected – GPS coordinates, speed, trip history, geofencing events, etc.
• Retention period – How long is data kept? The CNIL recommends limiting retention to what is strictly necessary.
• Recipients – Who has access? Third-party service providers, insurers, data aggregators?

The CNIL provides concrete guidance for common use cases:

• Assistance services – Emergency call (eCall) and roadside assistance. Data should be used only for the duration of the incident.
• Fleet management – For private vehicles, only with explicit consent. Data must be limited to operational needs (e.g., fuel consumption, maintenance).
• Theft prevention – Location tracking after theft report. Must be deactivated when not needed.
• Product improvement – Requires consent. Data must be anonymized or aggregated where possible.

Step 3: Implement Data Minimization and Retention Limits

The CNIL strongly recommends limiting the frequency, quantity, and retention of location data. Practical steps:

• Reduce collection frequency – Instead of real-time tracking, collect data at intervals (e.g., every 5 minutes) unless real-time is essential (e.g., theft tracking).
• Minimize data fields – Only collect the specific data points needed. For example, for navigation, you may not need speed or trip history.
• Set retention schedules – Define maximum retention periods for each purpose. For example: trip data for navigation can be deleted after trip completion; product improvement data can be kept for 12 months; theft prevention data deleted after vehicle recovery.
• Implement automated deletion – Use technical measures to automatically purge data after the retention period.

Step 4: Enhance Transparency and User Information

Transparency is a cornerstone of the CNIL recommendations. Users must be clearly informed about location data processing. The CNIL suggests:

• Clear privacy policies – Provide a concise, layered privacy notice. Avoid legal jargon.
• In-vehicle indicators – Use icons, QR codes, or pop-up messages on the vehicle's display to inform users when location data is being collected. For example, a small icon showing a satellite dish when GPS is active.
• Multi-user profiles – Offer user profiles so different drivers (e.g., family members) can manage their own data and exercise their rights (right of access, erasure, portability).

Example: When a user first starts the vehicle, a notification could appear: "Location data is being used for navigation. Tap here to learn more and manage your preferences."

Step 5: Strengthen Security Measures

Location data is sensitive and must be protected against breaches and unauthorized access. The CNIL recommends:

• Encryption – Encrypt data both in transit (TLS) and at rest (AES-256).
• Access controls – Limit access to location data on a need-to-know basis. Implement role-based access controls (RBAC).
• Regular security audits – Conduct penetration testing and vulnerability assessments.
• Incident response plan – Have a plan for data breaches, including notification to CNIL within 72 hours under GDPR.

Step 6: Manage Data Subject Rights in Multi-User Contexts

Connected vehicles often have multiple users (owner, family members, occasional drivers). The CNIL emphasizes that each individual must be able to exercise their data rights. This includes:

• Right of access – Each user should be able to request their own location data.
• Right to erasure – Users can request deletion of their data, but this must be balanced with legal obligations (e.g., safety recalls).
• Right to data portability – Users can export their location data in a machine-readable format.

To enable this, implement user profiles that associate data with a specific user account. Provide a dashboard or mobile app where users can view and manage their data.

Step 7: Align with Other EU Data Protection Authorities

While the CNIL's recommendations are French-specific, they align with broader European guidance. The EDPB has issued guidelines on connected vehicles and location data (adopted in 2020). Other EU DPAs have also published guidance:

• ICO (UK) – The ICO's guidance on connected vehicles emphasizes transparency and consent, similar to CNIL.
• Garante (Italy) – The Italian DPA has issued specific rules on telematics insurance boxes, requiring clear consent and data minimization.
• APD (Belgium) – The Belgian DPA focuses on proportionality and the need for a legal basis beyond contract for most location processing.

If your operations span multiple EU countries, you must comply with each DPA's specific requirements. The CNIL recommendations are a good starting point but should be supplemented with local guidance.

Common Pitfalls in Connected Vehicle Compliance

• Assuming consent is always the default – Consent is not always required if processing is necessary for a service the user requested. However, over-reliance on legitimate interest is risky; the CNIL expects strict necessity.
• Ignoring multi-user contexts – Failing to provide individual user profiles can lead to non-compliance with data subject rights.
• Collecting too much data – Collecting all available data 'just in case' violates data minimization. Always justify each data point.
• Insufficient transparency – Relying only on a lengthy privacy policy buried in a manual is not enough. In-vehicle indicators are expected.
• Neglecting security – Location data breaches can have severe consequences. Implement robust security from the start.

FAQ

When do the CNIL recommendations take effect?

The recommendations were published in 2025. There is no specific enforcement date, but the CNIL expects compliance immediately. Organizations should verify the latest timeline as enforcement may evolve.

Do the recommendations apply to company cars?

No, the recommendations focus on private vehicles owned or leased by individuals. Company cars used by employees may be subject to different rules (e.g., employee monitoring regulations).

What are the penalties for non-compliance?

Under GDPR, fines can reach up to €20 million or 4% of global annual turnover, whichever is higher. The CNIL can also issue public warnings and orders to cease processing.

How does the ePrivacy Directive interact with GDPR?

The ePrivacy Directive (implemented in France as the Law on Confidence in the Digital Economy) requires consent for storing/accessing information on a user's device, including vehicle telematics. This is in addition to GDPR requirements. The CNIL recommendations clarify this interplay.

Can I use location data for product improvement without consent?

Generally, no. Product improvement is not a service explicitly requested by the user, so consent is required. Anonymization can help, but fully anonymized data is difficult to achieve with location data.

How AIGovHub Can Help

Managing multi-jurisdictional privacy compliance across the EU is complex. The AIGovHub platform provides a centralized solution to track regulatory changes, map requirements, and automate compliance workflows. Key features include:

• Regulatory alerts – Stay updated on CNIL, EDPB, and other DPA guidance across 47+ jurisdictions.
• Privacy Impact Assessment (PIA) tool – Conduct automated PIAs for connected vehicle data processing.
• Policy mapper – Map your data processing activities to GDPR and CNIL requirements.
• Vendor due diligence – Assess third-party telematics providers against privacy standards.

For organizations deploying connected vehicles across Europe, AIGovHub's unified compliance dashboard helps ensure you meet French DPA expectations and beyond.

Next Steps

1. Audit your current processing – Use the steps above to map all location data processing.
2. Update privacy notices – Implement in-vehicle indicators and clear consent mechanisms.
3. Implement user profiles – Enable multi-user data rights management.
4. Review retention policies – Set and automate data deletion schedules.
5. Consult with legal counsel – Ensure your compliance program is robust and up-to-date.

For a deeper dive, explore related resources on EU AI Act compliance and AI governance for emerging technologies.