A modern connected car generates a stream of data as you drive: your location, your braking habits, how fast you take corners, which apps you open, even how much you weigh (via seat sensors). A single vehicle can produce many gigabytes of data per hour. The question nobody agreed on before the car left the factory: who owns all of it?
Here is the uncomfortable truth for 2026: there is no clean legal answer to "who owns car data." Ownership is fragmented across parties, and each has a different claim.
The OEM (Original Equipment Manufacturer, meaning the car brand like Toyota or BMW) designs the sensors and the telematics unit, so it controls the pipepipeAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →. Data flows to the manufacturer's cloud first.
The dealer wants service and maintenance data to sell you your next oil change, tire set, or car.
The driver generated the data by living their life inside the vehicle, and increasingly expects a say.
Third parties (insurers, fleet operators, mapping companies) want to buy access.
In most jurisdictions, raw data is not "property" you can own like a chair. Instead, control comes from two places: contracts (the terms you clicked to accept) and data protection law. So the real question is not "who owns it" but "who has the legal right to use it, and under what conditions."
This distinction drives everything that follows.
Personal data is any information relating to an identified or identifiable person. Location history, driving behavior tied to your account, and voice commands are personal data. This triggers privacy law.
Non-personal data is aggregated or anonymized information with no link to an individual. "Average battery degradation across 40,000 vehicles in cold climates" is non-personal. This is far freer to monetize.
The catch: true anonymization is hard. Location traces are notoriously re-identifiable. Four location points can often uniquely identify a person. So a lot of "anonymized" automotive data is legally still personal data, which means the privacy rules still apply.
The GDPR (General Data Protection Regulation) is the EU privacy law that sets the global benchmark. Even a US or Asian OEM must comply when handling EU drivers' data. Fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → up to 4% of global annual revenue, so this is a board-level risk.
GDPR requires a lawful basis for processing personal data. For automotive monetization, two matter most:
A safety recall notification can rely on legitimate interest or legal obligation. Selling driving-behavior data to an insurer almost always requires explicit consent.
The European Data Protection Board has published specific guidance on connected vehicles that is worth bookmarking: EDPB Guidelines on connected vehicles.
Bad consent is the most common failure. A single checkbox saying "I agree to data processing" buried in a 40-page terms document will not survive a regulator's review.
Valid consent under GDPR must be:
Practical design pattern: a layered consent dashboard in the infotainment system and companion app, with toggles per data category (diagnostics, location, driving behavior, in-car commerce). Each toggle maps to a documented purpose.
{
"vehicle_id": "hashed_vin_a1b2c3",
"consent_records": [
{ "purpose": "safety_diagnostics", "basis": "legitimate_interest", "status": "active" },
{ "purpose": "usage_based_insurance", "basis": "consent", "status": "granted", "timestamp": "2026-03-14T09:22Z" },
{ "purpose": "third_party_advertising", "basis": "consent", "status": "withdrawn", "timestamp": "2026-05-02T18:10Z" }
]
}This kind of structured consent record is what you show a regulator to prove compliance. If you cannot produce it, you effectively have no lawful basis.
New for the mid-2020s: the EU Data Act started applying in September 2025. It is a major shift for automotive.
The core idea: users of connected products have a right to access the data they generate and to share it with third parties of their choice. A driver can now ask their OEM to send maintenance data to an independent repair shop instead of the brand's own dealer network.
Why this matters for strategy: OEMs can no longer assume they hold exclusive access to vehicle data. The independent aftermarket (repairers, parts sellers, insurers) gains leverage. Your monetization model cannot depend on locking others out.
Do not assume GDPR covers everything.
A global OEM needs a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → model that meets the strictest applicable standard per region, then relaxes only where local law clearly permits.
Knowledge check
1. According to the lesson, why is 'who owns car data' considered the wrong question to ask in most jurisdictions?
2. Why does the personal vs. non-personal data distinction 'drive everything that follows' in data monetization?
3. The lesson notes that 'four location points can often uniquely identify' someone. What broader concept does this illustrate?
4. Select ALL correct answers about why the OEM has a strong practical position over connected car data.
Select all the correct answers.
5. Select ALL correct answers that correctly classify data as personal under the lesson's framework.
Select all the correct answers.
Now the applied part. How do you actually make money from vehicle data without creating legal and reputational risk?
Sort every data stream into three buckets:
Drivers say yes when they get something back. Usage-based insurance works because the driver sees a discount. A concierge service that pre-books charging works because it saves time. Frame consent as an offer, not fine print.
Instead of hoarding data, build paid APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → access for third parties who the driver authorizes. If a repair shop needs diagnostics, sell them a clean, permissioned data feed. You can monetize access and interoperability rather than exclusivity.
Privacy by design is a GDPR requirement, not a nice-to-have. Minimize what you collect, process on the edge (in the car) where possible, and pseudonymize early. Data you never collect cannot be breached or fined.
Maintain records of processing, consent logs, and balancing tests. When a regulator or a driver asks, you answer with documentation, not promises.
An OEM wants to launch a predictive maintenance service that also generates parts revenue.