A Legal Analysis of Connected-Car Location Data Under Turkish Data Protection Law and the GDPR

Introduction

Modern vehicles are no longer merely mechanical means of transportation. GPS systems, embedded internet connectivity, manufacturer applications, telematics, emergency-call functions, remote vehicle controls, fleet-management systems and insurance technology have transformed the modern car into a continuously operating digital data platform.

A connected vehicle may be capable of recording where a vehicle is located, where it travels, how long it remains at particular locations, its speed and mileage, driving patterns and, in certain systems, the identity or account associated with the vehicle.

This technological development raises an increasingly important legal question:

May a vehicle manufacturer, rental company, employer or connected-car service provider continuously monitor the location of a vehicle?

The answer is not automatically yes.

Nor is location processing automatically unlawful.

Under Turkish data protection law, legality depends upon why the location is collected, which legal basis supports the processing, how intensively it is monitored, how long the data is retained, who controls the data and with whom it is shared.

1. Is Vehicle Location Personal Data?

Where the geographical location of a vehicle can be linked to an identified or identifiable natural person, it constitutes personal data for the purposes of Turkish Personal Data Protection Law No. 6698 (“KVKK”).

The Turkish Personal Data Protection Authority has expressly recognised that location information capable of identifying or making a natural person identifiable falls within the scope of personal data protection law.

Consider a vehicle that repeatedly:

leaves a particular residence at 6:45 a.m.,
arrives at a specific workplace at 7:30 a.m.,
leaves at 6:15 p.m., and
returns to the same residence at 7:00 p.m.

A GPS coordinate may initially appear to describe a vehicle rather than an individual.

Once the vehicle is linked to a driver or customer account, however, the same data can reveal where that person lives, where he or she works and how that individual’s everyday movements are structured.

Connected-car location information is therefore frequently both vehicle data and personal data.

2. Why Is Location Data Particularly Intrusive?

The principal privacy risk does not necessarily arise from a single geographical coordinate.

It arises from building a history of movements over time.

The Turkish Personal Data Protection Board addressed this issue directly in its Decision No. 2021/1303 of 23 December 2021 concerning vehicle-rental software.

The Board observed that vehicle tracking can reveal journeys undertaken by individuals, their workplace and residence and other locations visited by the driver. Such information may allow profiling of a person’s lifestyle and may indirectly reveal sensitive characteristics, including matters relating to religious belief or sexual life.

This finding is particularly important for connected vehicles.

Repeated visits to a hospital, psychiatric clinic, religious institution, political organisation or another location associated with private life may permit highly sensitive inferences even if the vehicle system does not expressly collect medical, religious or political information.

Location data is therefore not necessarily a special category of personal data in itself under the KVKK.

However, systematic location monitoring may reveal or enable inferences concerning special-category data.

3. May Vehicle Manufacturers Collect Location Data?

Potentially, yes.

Location processing may be justifiable where genuinely necessary to provide services such as:

• navigation;
• locating a parked vehicle;
• stolen-vehicle recovery;
• roadside assistance;
• emergency functions; or
• another location-dependent connected-car service.

However, using the same information subsequently to profile consumer behaviour, develop advertising profiles, disclose travel behaviour to unrelated companies or pursue commercial purposes unrelated to the initial service raises a separate legal question.

Under the KVKK, every processing activity must have a legal basis under Article 5.

The Turkish Data Protection Authority also makes clear that consent is only one possible legal basis. Where another legal condition properly supports the processing, consent should not artificially be requested as an additional basis.

Buying a connected vehicle therefore does not give its manufacturer a general legal right to use all location information for any purpose it chooses.

4. Is Express Consent Always Required?

No.

Express consent is one of several processing grounds under Turkish data protection law.

Where processing location information is directly related to and genuinely necessary for the performance of a particular connected-car service, another legal basis under Article 5 may potentially apply.

Legitimate interest may also be relevant in appropriate circumstances.

However, legitimate interest does not constitute an unlimited surveillance exception.

The Turkish Data Protection Authority’s current guidance requires a balancing exercise between the controller’s genuine, current and legitimate interests and the fundamental rights and freedoms of the individual.

The Authority specifically emphasises that legitimate interest cannot be interpreted as a general rule capable of legalising every processing operation.

5. Is “We Track You for Security” a Sufficient Justification?

Not by itself.

Even if a purpose is legitimate, the processing must remain necessary and proportionate.

Using location data to recover a stolen vehicle is materially different from maintaining a detailed ten-year record of every journey undertaken by the vehicle.

The first activity may be genuinely connected with vehicle security.

The second requires an independent explanation of why such extensive retention is necessary.

Turkish data protection law follows principles including purpose limitation, proportionality and retention only for as long as necessary. Once the legal grounds requiring personal data to be retained disappear, applicable Turkish deletion and destruction rules require appropriate deletion, destruction or anonymisation.

6. Can the Vehicle Be Tracked Every Second?

The fact that technology permits continuous tracking does not establish that continuous tracking is legally necessary.

If hourly location information is sufficient for a particular purpose, collecting second-by-second coordinates may become difficult to justify under proportionality and data-minimisation principles.

Similarly, a stolen-vehicle system does not necessarily require the manufacturer to build a permanent and detailed travel diary during ordinary vehicle use.

The Turkish Board’s rental-car decision expressly recognises that extensive vehicle tracking can reveal an individual’s lifestyle and places visited.

A more privacy-compatible principle for the automotive industry is therefore:

collect the minimum amount of location information genuinely required for the identified service, rather than collecting the maximum technically available information.

7. May Rental-Car Companies Track Their Customers?

Vehicle-rental companies have legitimate interests in protecting valuable assets.

Location processing may therefore be strongly justifiable in situations involving theft, unauthorised removal of a vehicle from a permitted territory or another serious contractual or security event.

That does not automatically give the rental company an unrestricted right to observe every movement of every customer throughout the rental period.

The Turkish Personal Data Protection Board’s 2021/1303 decision specifically warned that rental-vehicle tracking may reveal residences, workplaces and other visited places and thus create substantial privacy risks.

A compliant system should therefore clearly establish matters such as the purpose of monitoring, circumstances in which tracking is activated, retention periods, authorised access and information given to the customer.

8. Can Employers Continuously Track Company Vehicles?

Fleet management presents another difficult legal scenario.

An employer may have legitimate objectives relating to:

vehicle security,
logistics,
delivery management, or
organisation of working activities.

However, continuous monitoring outside working hours, particularly where private use of the company vehicle is permitted, has a significantly greater impact on the employee’s private life.

Under the Turkish legitimate-interest framework, a genuine balancing exercise must therefore be carried out between the employer’s interests and the employee’s fundamental rights.

Depending on the circumstances, privacy-protective alternatives might include disabling ordinary location monitoring outside working hours, reducing precision or allowing location information to become accessible only following a specific security event.

9. Is a Privacy Notice Saying “We Process Location Data” Enough?

Not necessarily.

Transparency requires meaningful information.

Under Article 10 KVKK, the controller must provide information concerning its identity, the purposes for which personal data will be processed, potential recipients and purposes of transfers, the method and legal basis of collection and the statutory rights of the data subject. The Turkish Data Protection Authority’s guidance reflects these requirements.

A generic statement such as:

“We may process personal data in order to improve our services”

may therefore be insufficiently informative in a sophisticated location-tracking environment.

The user should be able to understand whether real-time location is collected, whether journey histories are stored and whether those histories are disclosed to manufacturers, service providers or other companies.

10. Does Buying the Vehicle Amount to Consent?

No.

Purchasing a vehicle should not be treated as blanket consent to every future connected-car processing activity.

The Turkish Data Protection Authority explains that valid express consent must be specific, informed and freely given.

It also rejects broad and undefined permissions covering “all data” and “all purposes” as invalid blanket consent.

Where consent is genuinely required for connected-car processing, separate purposes should therefore be distinguished rather than bundled into a single compulsory acceptance.

11. What If Several People Use the Same Vehicle?

This is one of the structural privacy challenges of connected cars.

The vehicle owner and actual driver may be different people.

The vehicle might be driven by a spouse, child, employee, friend, rental customer or valet.

A system based exclusively on the vehicle owner’s choices may therefore result in personal information about other drivers being processed without those individuals necessarily understanding what is happening.

The European Data Protection Board has issued dedicated Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility-related applications, expressly placing connected vehicles within the framework of basic data-protection principles and privacy by design and by default.

Functions such as guest mode, privacy mode and location sharing controls therefore represent increasingly important privacy-by-design mechanisms.

12. May Location Data Be Shared with an Insurance Company?

Secondary uses require a separate legal analysis.

Sharing location and driving behaviour with an insurer for risk scoring or premium calculation is a fundamentally different purpose from using location data to provide navigation.

The legal basis supporting the original connected-car function does not automatically legalise this additional processing.

The individual should therefore be informed about which information is being disclosed, to whom, for which purposes and on what legal basis.

13. What Happens When Turkish Vehicle Data Is Sent to Foreign Servers?

Many global vehicle manufacturers operate international cloud infrastructures.

A vehicle operating in Türkiye may therefore transmit telematics and location information to servers located abroad.

In such a case, establishing a lawful processing ground under Article 5 KVKK is not sufficient by itself. The transfer must also comply with the international-transfer regime under Article 9 KVKK.

Türkiye substantially reformed Article 9 in 2024. The new framework introduced mechanisms including adequacy decisions, standard contracts and binding corporate rules as possible routes for providing appropriate safeguards for international personal-data transfers. The implementing Regulation entered into force on 10 July 2024.

For multinational automotive manufacturers, cloud architecture is therefore also a cross-border data-transfer compliance issue.

14. What Happens to Location Data When the Car Is Sold?

Used connected vehicles introduce a separate privacy challenge.

The vehicle or associated online account may retain:

home addresses,
favourite destinations,
recent journeys,
phone contacts,
navigation histories and
user profiles.

Transfer of ownership of the physical vehicle should not automatically transfer the former driver’s digital history.

Where there is no continuing lawful reason for retention, Turkish data-protection rules require deletion, destruction or anonymisation as appropriate.

Manufacturers should therefore develop reliable ownership-transfer and factory-reset protocols for used connected vehicles.

15. Can the Driver Request Their Location History From the Manufacturer?

Potentially, yes.

Article 11 KVKK provides data subjects with important rights against controllers.

Individuals may ask whether their personal data has been processed, request information about processing, learn the purposes of processing, identify third-party recipients and, where legal conditions are satisfied, request correction, deletion or destruction.

A connected-car user may therefore have grounds to ask:

“What location information linked to me or my vehicle do you hold, how long do you retain it and to whom has it been disclosed?”

16. The European Approach: GDPR and Connected Cars

Connected vehicles in the European Union are subject to the general principles of the GDPR.

The European Data Protection Board adopted its dedicated Guidelines 01/2020 on Processing Personal Data in the Context of Connected Vehicles and Mobility Related Applications on 9 March 2021. The Guidelines expressly address connected mobility through the concepts of basic data-protection principles, technology and privacy by design and by default.

The GDPR requires personal data to be processed lawfully, fairly and transparently and incorporates principles including purpose limitation, data minimisation and storage limitation. Article 25 additionally establishes the obligation of data protection by design and by default.

This is particularly significant for vehicle manufacturers.

Privacy compliance should therefore not exist solely in a lengthy privacy policy.

It increasingly needs to be built directly into vehicle software architecture and user controls.

17. The EU Data Act and Connected Vehicles

The European regulatory landscape also includes Regulation (EU) 2023/2854 – the Data Act.

The Data Act creates harmonised rules concerning access to and use of data generated by connected products and related services. Connected vehicles are an important part of this broader connected-product ecosystem.

However, rights concerning economic access to connected-product data do not mean that GDPR protection disappears whenever the data also constitutes personal data.

The future legal framework for connected vehicles therefore involves two distinct questions:

Who is entitled to access and use vehicle-generated data as an economic asset?

and

Where that data relates to an identifiable person, what privacy and data-protection restrictions govern its use?

18. Building a Privacy-Compliant Connected Vehicle

A legally sophisticated connected-car architecture should begin with a simple principle:

continuous location surveillance should not be the default merely because it is technologically possible.

Manufacturers should separate different processing purposes, minimise location collection, establish justified retention periods, avoid unnecessary historical tracking, provide effective privacy controls, accommodate multiple vehicle users and address international transfers under the applicable legal framework.

Because systematic movement histories can reveal lifestyles and potentially highly sensitive characteristics, privacy by design is becoming more than a technical best practice.

It is increasingly a central component of automotive legal risk management.

Conclusion: Your Car May Know Where You Are — But That Does Not Mean Everyone May Know

The collection of vehicle location data is not inherently unlawful.

Nevertheless, the presence of a GPS module does not give a manufacturer, employer, rental company or digital-service provider an unlimited licence to record an individual’s movements.

Lawfulness depends upon a combination of:

legal basis, defined purpose, necessity, proportionality, transparency, data minimisation, retention, security and lawful domestic or international disclosure.

Continuous location history deserves particularly careful scrutiny. As the Turkish Personal Data Protection Board itself has recognised, vehicle tracking can reveal a person’s home, workplace, journeys and other visited locations and may enable inferences concerning highly sensitive areas of private life.

The next generation of vehicle manufacturers will therefore not be judged solely by horsepower, battery range, software performance or autonomous-driving capabilities.

They will increasingly carry legal responsibility for how effectively their vehicles protect the digital privacy of the people sitting behind the wheel.

Because in the connected-car era, the vehicle may know considerably more than where you are.

Over time, it may be able to understand how you live.