Can a rental company track your rental car by GPS? Privacy rules for connected cars

Modern rental cars are computers on wheels. They know where they are, how fast they go, when the doors open and which phone was connected. Some rental companies use that data to recover stolen cars, check mileage or manage their fleet. European privacy rules treat location data as high-risk, and that limits how a rental company can use it. Knowing those limits helps you protect your privacy and challenge a charge based on data you were never told about.

What a connected rental car can record

Not every car records all of this, and not every company uses what is recorded. The point is that the data can exist, and the GDPR applies when it relates to you.

What the European Data Protection Board says

In June 2026, the European Data Protection Board (EDPB) published a summary of its guidelines on connected vehicles and mobility data. Several points matter for rental cars:

• Location data is high-risk. It can reveal a lot about a person's life, so it should not be collected continuously by default. Users must be informed and be able to switch it off.
• No tracking just in case. In the example of a stolen vehicle, tracking cannot run continuously in case of theft. Location data should only be shared once a theft is declared.
• Offence data stays in the car. Data such as speeding should generally be processed only within the vehicle, with strong protection against access or changes.
• Consent must be real. Consent cannot be bundled with renting or buying the car, and a driver who refuses data collection should still be able to use the vehicle.
• Easy deletion. When a car changes hands, including in rental, the next driver should not see the previous driver's location or call history. Cars should offer a simple way to delete personal data such as navigation history, contacts and profiles.
• Transparency. Drivers should be told clearly what is processed, for example through dashboard icons showing when location is active.

The EDPB document is guidance, not a law in itself, but it explains how the GDPR and the ePrivacy rules apply to cars, and supervisory authorities use it.

1Read the privacy notice before you sign

The rental contract or the company's privacy notice should say whether the car is connected, what is collected and why. If it says the company uses location data, look for the purpose: theft recovery, mileage, cross-border checks or something else. The terms check helps you find such clauses.

2Delete your data at return

Before you hand back the keys:

• unpair your phone in the Bluetooth settings of the car;
• delete your contacts and call history if they were synced;
• clear the navigation history and saved addresses, especially your home address;
• log out of any apps or accounts you used in the car.

3Ask for your data if a charge depends on it

If the company charges you based on vehicle data, such as a cross-border fee, a speeding penalty or a mileage dispute, you can ask which data it holds about you and how it was used. Send an access request under Article 15 of the GDPR. The EDPB guidelines on the right of access explain that the company generally has to answer within one month and give you a copy free of charge. Our guide on a GDPR access request to a rental company includes a sample letter.

When data is used against you

If a charge is based on telematics data, ask:

• what data was collected, when and by which system;
• on which legal basis and contract clause the company relies;
• whether you were informed about the collection before the rental.

If the data shows you drove into a country your contract excluded, read driving a rental car to another country to understand what that means for fees and cover.

Where to complain

For a privacy issue, you can complain to the data protection authority in your country of residence. For a dispute about a charge with a company in another EU country, your European Consumer Centre can help. ECC-Net's general advice still applies: object in writing and keep copies of everything.

A short example

After a rental in Germany, the company charges a 150 euro penalty for driving to a country not allowed in your contract, based on GPS data. You did drive through that country for 20 minutes on a detour. You ask the company for the GPS records it used and the contract clause, and you ask in a separate access request which location data it holds about you. The contract does mention the country restriction, but the privacy notice does not mention location tracking for this purpose. You raise that point in your objection, and keep your chargeback deadline in view.