France's CNIL issues new consent rules for location data from connected vehicles

The French data‑protection authority (CNIL) has released a formal recommendation governing the use of location data collected by connected vehicles such as cars, scooters and e‑bikes. The guidance follows a public consultation with manufacturers, fleet operators and telematics providers and aims to tighten consent requirements, improve transparency and reinforce drivers’ privacy rights.

Key points require that operators obtain explicit user consent before processing location data, except when the data are strictly necessary for a service the driver has personally requested (e.g., navigation). The recommendation applies to private‑use vehicles and covers manufacturers, fleet managers, telematics‑device suppliers and data aggregators, but it does not extend to company‑provided cars, which were addressed in earlier CNIL advice. It also advises on handling multi‑user vehicles, encouraging authenticated personal accounts and remote disconnect options to better manage data access.

The move responds to recent high‑profile leaks of vehicle‑location information and seeks to provide a clear legal framework that aligns with the ePrivacy directive and French data‑protection law.