Connected Cars, Telematics, In-Car Cameras, EV Charging Data and the Emerging Law of Automotive Privacy
Introduction
The modern vehicle is no longer simply a mechanical machine designed to transport people from one place to another.
Internet connectivity, mobile applications, GPS systems, telematics, in-car cameras, microphones, driver-monitoring technologies, remote software updates and electric-vehicle charging infrastructure have transformed cars into sophisticated mobile digital platforms capable of generating and transmitting substantial quantities of data.
A connected vehicle may potentially know where the driver travels, when the vehicle moves, how fast it is driven, which mobile phone is connected, which destinations are entered into the navigation system, when and where the vehicle is charged and, in certain cases, information concerning the driver’s face, voice or physical condition.
This raises one of the central legal questions of modern automotive law:
Who controls the data generated by a connected vehicle, and for what purposes may that data lawfully be used?
In Türkiye, the principal legal framework is Law No. 6698 on the Protection of Personal Data (“KVKK”). The Turkish Personal Data Protection Authority has itself addressed the intersection of autonomous vehicles, artificial intelligence, personal data protection and privacy.
At European level, the European Data Protection Board has adopted Guidelines 01/2020 on Processing Personal Data in the Context of Connected Vehicles and Mobility Related Applications, specifically addressing the privacy challenges created by connected mobility.
What Data Can a Connected Vehicle Collect?
The range of data generated by modern vehicles can be extensive.
It may include:
GPS and location data;
driving behaviour;
speed, acceleration and braking records;
mileage;
technical fault information;
maintenance history;
battery and charging information;
charging-station locations;
mobile-application account information;
Bluetooth and contact data;
voice commands;
in-car camera recordings;
driver-monitoring information;
navigation history; and
sensor data generated by advanced driver-assistance systems.
Describing information as “vehicle data” or “technical data” does not automatically remove it from data-protection law.
Where data can be associated with an identified or identifiable natural person, it may constitute personal data.
The Turkish Data Protection Board has previously treated the integration of vehicle-number-plate and related information into another system as a separate personal-data-processing activity.
Accordingly, there is no absolute legal boundary between vehicle data and personal data.
Location Data and Continuous Tracking
Location information is one of the most privacy-sensitive categories generated by connected vehicles.
Long-term GPS history can reveal much more than the position of a vehicle.
It may allow inferences concerning a person’s home, workplace, children’s school, frequently visited locations, medical appointments, social relationships and daily routines.
The EDPB’s connected-vehicle guidance therefore gives significant attention to location and behavioural data and emphasises principles including data minimisation and privacy by design.
Under Turkish law, personal-data processing must also comply with the general principles of legality, purpose limitation, relevance, proportionality and limited retention. The Turkish Data Protection Authority emphasises that controllers should first determine whether processing can rely on a lawful ground other than consent.
A navigation service may legitimately require real-time location information.
That does not automatically justify retaining a driver’s complete location history for years for unrelated profiling or advertising purposes.
Consent Is Not a Universal Solution
Automotive companies should not assume that every processing activity becomes lawful simply because the driver has pressed an “I agree” button.
Under Turkish data-protection law, the controller should first identify the appropriate legal basis for each processing activity. Where another statutory basis exists, obtaining unnecessary consent may itself create transparency problems.
Processing technical fault data required to provide a warranty service, for example, may be legally different from processing long-term location history for behavioural advertising.
Consent must also be freely given.
The Turkish Data Protection Authority has warned against making a service conditional upon consent where such consent is not genuinely necessary for the relevant service.
A connected-car interface stating:
“You must accept marketing location tracking in order to use your vehicle”
would therefore create substantial legal risk.
Transparency and the Vehicle Interface
Connected-car ecosystems commonly involve several actors:
the vehicle manufacturer;
Turkish distributor;
mobile-app provider;
navigation provider;
cloud-services company;
telematics operator; and
authorised service network.
The driver should therefore be able to understand:
who the data controller is;
which data is collected;
why it is processed;
with whom it is shared; and
whether it is transferred outside Türkiye.
Under the KVKK, the information obligation applies independently from consent and must be fulfilled regardless of the legal basis relied upon for processing.
This issue became even more significant following the Turkish Data Protection Board’s Principle Decision No. 2026/347 of 18 February 2026, which expressly reaffirmed that privacy notices and consent mechanisms should not be merged into a single undifferentiated text.
Connected-vehicle applications should therefore avoid a single “Accept All” mechanism covering essential telematics, marketing, location analytics and international transfers without meaningful separation.
In-Car Cameras and Driver Monitoring
Modern vehicles increasingly incorporate Driver Monitoring Systems and interior cameras.
Such systems may determine whether the driver is looking at the road, appears fatigued or whether occupants are present inside the vehicle.
Where identifiable individuals are recorded, camera use constitutes personal-data processing. The Turkish Data Protection Authority has expressly recognised identifiable camera recordings as personal-data-processing activities.
A system that analyses images locally and immediately deletes them may create a different level of privacy risk from one that continuously uploads interior video to the manufacturer’s servers.
The preferred legal and technical principle should therefore be privacy by design.
Where feasible, processing should remain inside the vehicle and central transmission should be limited to what is genuinely required.
Voice Assistants and Microphones
Voice-controlled assistants create an additional privacy challenge.
Commands such as:
“Take me home,”
“Call my mother,” or
“Find the nearest hospital”
may involve processing not only voice data but also location information, contact details and usage patterns.
Continuous audio collection is particularly intrusive.
In other contexts, the Turkish Data Protection Board has distinguished the additional privacy impact created by audio recording in systems that already process video data.
For connected-car systems, there is therefore an important difference between a microphone that continuously records the cabin and one activated only after a specific wake command.
Biometric and Health Information
Some vehicles can identify drivers through facial recognition, monitor eye movement or use sensors capable of producing information related to physical condition.
These technologies may trigger the rules applicable to special categories of personal data.
Türkiye substantially amended Article 6 of the KVKK governing special-category data in 2024, with the new regime entering into force on 1 June 2024.
Where facial characteristics are converted into a biometric template for unique identification, for example, the analysis may differ substantially from ordinary video recording.
Similarly, data relating to heart rate or another medical condition may require the special protection applicable to health information.
Electric Vehicles and Charging Data
Electric vehicles introduce additional actors into the automotive data ecosystem.
Information may move between:
the vehicle manufacturer;
charging-station operator;
charging application;
payment institution;
energy provider; and
roaming platform.
Charging data may reveal considerably more than the amount of electricity consumed.
If a particular vehicle charges almost every night at the same location, that information may strongly indicate where the owner lives. Repeated charging activity can similarly reveal travel patterns and routine movements.
Where charging information can be associated with an identifiable individual, it should therefore be analysed under personal-data law rather than regarded merely as anonymous electricity-consumption information. This is consistent with the Turkish authority’s broader approach to vehicle-linked identifiers.
International Transfers of Vehicle Data
Many connected-car manufacturers operate global cloud infrastructures.
Vehicle data originating in Türkiye may consequently be transmitted to servers or corporate entities located in Germany, the United States or another jurisdiction.
This creates an international data-transfer issue under Article 9 of the KVKK.
Türkiye materially reformed its international-transfer regime in 2024. The current framework allows transfers through mechanisms including adequacy decisions and appropriate safeguards. One important safeguard is the use of the standard contractual clauses adopted by the Turkish Data Protection Board.
Four standard contractual models are currently available, addressing controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller transfers.
A global automotive privacy policy is therefore not necessarily sufficient by itself.
The legal mechanism supporting each transfer from Türkiye to an overseas OEM headquarters, cloud provider or analytics service must be identified separately.
The Second-Hand Connected Car Problem
Connected vehicles create a new issue when the vehicle is sold.
The infotainment system may still contain:
the former owner’s home address;
work address;
navigation history;
contact list;
Bluetooth pairings;
call history;
music accounts; and
personal profiles.
A modern vehicle therefore requires more than transfer of physical keys and registration documents.
A secure digital factory-reset procedure should form part of the ownership-transfer process.
If the new owner obtains access to the previous owner’s personal information, the incident may constitute a data-security issue.
Employee and Fleet Monitoring
Connected fleet vehicles can allow employers to monitor employees in real time.
An employer may potentially determine:
where the vehicle is;
how fast it is being driven;
how long it has stopped; and
whether the driver deviated from a planned route.
Ownership of the vehicle by the employer does not automatically permit unlimited surveillance of the employee.
The Turkish Data Protection Board has emphasised in electronic-monitoring cases that a fair balance must be established between an employer’s legitimate purposes and the employee’s reasonable expectation of privacy, while the principle of proportionality must be respected.
Continuous GPS tracking becomes particularly problematic where an employee is permitted to use the company vehicle privately outside working hours.
Automotive Cybersecurity Is Also Data-Protection Law
Connected vehicles represent one of the clearest examples of physical security and information security becoming inseparable.
A cyberattack against a telematics platform may expose location or identity information, but it may also potentially target vehicle functionality.
For this reason, automotive cybersecurity has become a separate international regulatory field.
UN Regulation No. 155 establishes an international framework concerning vehicle cybersecurity and Cyber Security Management Systems. UNECE describes the regime as addressing cybersecurity risks through vehicle type-approval and manufacturer-level cybersecurity management.
Under Turkish data-protection law, controllers must also take appropriate technical and administrative measures to prevent unlawful access to personal data and ensure its security.
Where a personal-data breach occurs, the Turkish system requires notification to the Data Protection Authority without undue delay and, as a rule, within 72 hours after the controller becomes aware of the breach. Affected individuals must also be informed within the appropriate timeframe.
A major connected-vehicle cyberattack may therefore simultaneously generate automotive-product, cybersecurity, contractual and personal-data liability.
A Compliance Model for Connected-Car Companies
A meaningful privacy programme cannot consist solely of a lengthy privacy policy.
Connected-vehicle compliance should be built into the technical architecture of the product.
Automotive manufacturers and mobility companies should therefore implement:
Data Mapping — identifying every category of data generated by the vehicle and where it is transmitted;
Role Mapping — identifying which entities act as controller or processor;
Legal Basis Mapping — determining the legal basis for each processing purpose;
Data Minimisation — avoiding unnecessary collection of location and telematics information;
Privacy by Design — processing information locally within the vehicle where feasible;
Retention Governance — establishing defined retention periods;
International Transfer Compliance — implementing Article 9 mechanisms for overseas cloud and group-company transfers;
Cybersecurity Controls — protecting vehicles and backend platforms against unauthorised access; and
Incident Response — maintaining procedures capable of meeting the Turkish 72-hour data-breach notification framework.
Conclusion: The Modern Car Is a Data Centre on Wheels
Connected and electric vehicles are changing the subject matter of automotive law.
Future automotive disputes will no longer concern only:
engines,
batteries,
warranties,
defective products,
or traffic accidents.
They will increasingly concern questions such as:
Who controls GPS data?
How extensively may the manufacturer monitor the driver?
Where are cabin-camera recordings stored?
Can EV charging history be shared with third parties?
On what legal basis is vehicle data transferred outside Türkiye?
Who is responsible when a connected vehicle platform is hacked?
The EDPB’s dedicated connected-vehicle guidance and UNECE’s UN Regulation No. 155 cybersecurity framework demonstrate that the modern automobile can no longer be treated solely as a mechanical product.
In Türkiye, the KVKK rules concerning lawful processing, transparency, data minimisation, special-category information, international transfers and data security now form an essential part of connected-car compliance. The Turkish Data Protection Board’s February 2026 principle decision separating privacy notices from consent mechanisms further illustrates how these obligations must influence the design of vehicle interfaces and mobile applications.
The automotive manufacturer of the future will therefore have to do more than build a safe and reliable vehicle.
It must also build a secure, transparent and legally compliant data ecosystem around that vehicle.
No Responses