Data, privacy, and cybersecurity for connected cars

In July 2022, a rule quietly changed what it takes to sell a car in Europe. Under UNECE Regulation No. 155, any automaker seeking type approval (the license to sell a vehicle model in a market) must prove it runs a certified cybersecurity management system. No certificate, no approval, no sale. Volkswagen reportedly pulled several models, including versions of the up! and certain Transporter variants, rather than re-engineer them to comply. Regulation had become a gatekeeper to the showroom.

A modern connected car generates and transmits enormous volumes of data: location, driving behavior, cabin microphone audio, biometric identifiers, even inferred health signals. That turns every automaker into a data business and a software business, whether it wants to be or not. This lesson maps the four regulatory forces every automotive professional must now understand.

UNECE R155: cybersecurity as a condition of market access

UNECE stands for the United Nations Economic Commission for Europe. It runs the World Forum for Harmonization of Vehicle Regulations, which sets vehicle rules adopted across the EU, UK, Japan, South Korea, and roughly 60 signatory countries. The United States is not a signatory, so R155 does not directly bind US sales.

R155 requires automakers to operate a Cyber Security Management System (CSMS): a documented, audited process for identifying and managing cyber risks across a vehicle's entire lifecycle, from design to decommissioning.

In practice this means:

• Maintaining a risk assessment for every vehicle type and updating it as new threats emerge.
• Monitoring for attacks in the field and being able to respond (a Vehicle Security Operations Center, or VSOC).
• Managing risks from suppliers. A single insecure infotainment chip can void the whole approval.

Since July 2024, R155 **applies to *all* new vehicles produced for these markets, not just newly approved models**. The engineering standard most manufacturers use to meet it is ISO/SAE 21434, the industry cybersecurity engineering baseline.

Why this reshapes supplier relationships

An automaker cannot certify a CSMS if it cannot vouch for its supply chain. So Tier 1 suppliers (direct component suppliers like Bosch or Continental) and Tier 2 suppliers now face contractual cybersecurity obligations flowing down from the OEM (Original Equipment Manufacturer, the brand that builds the car). Compliance has become a procurement requirement, not just an IT concern.

UNECE R156: governing over-the-air updates

Cars now receive software the way phones do. Tesla popularized it; nearly every OEM now ships over-the-air (OTA) updates, remote software patches sent to vehicles in the field.

That creates a new risk: a bad or malicious update could disable brakes across a fleet. UNECE R156 governs this by requiring a Software Update Management System (SUMS).

R156 requires automakers to:

• Keep a verifiable record of the software on every vehicle (which version runs on which car).
• Ensure updates are authentic and integrity-protected so attackers cannot inject fake ones.
• Confirm an update will not compromise safety, and that the driver is informed when needed.
• Preserve type approval, since a software change can legally alter the vehicle. R156 introduced the concept of a software identification number so regulators can track approved configurations.

A concrete example: if an OTA update changes how a car's automatic emergency braking behaves, that touches a safety-relevant system. Under R156 the automaker must document the change, validate it, and ensure the vehicle still matches its approved type.

🎬 [VIDEO: "UN Regulation No. 155 and No. 156 explained" - youtube.com - a clear industry primer on how the two regulations interact for connected vehicles]

GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition →: the car as a data subject's device

The General Data Protection Regulation (GDPR) is the EU's comprehensive privacy law, enforced by national Data Protection Authorities (DPAs). It applies to any personal data of people in the EU, and connected cars produce a flood of it.

The European Data Protection Board (the body coordinating GDPR enforcement) has issued specific guidelines on connected vehicles making key points automakers cannot ignore:

• Location data is sensitive. Continuous geolocation can reveal home, workplace, religious sites, and health visits.
• Consent must be genuine. Pre-ticked boxes and "accept everything to start the engine" do not qualify.
• Data minimization. Process data inside the vehicle where possible, rather than shipping everything to the cloud.

GDPR fines can reach the higher of 20 million euros or 4 percent of global annual revenue. For a large OEM that is a multi-billion-euro exposure, which is why privacy engineering now sits in the vehicle design process.

Worked example: sizing a GDPR fine

This is illustrative, not a prediction. Suppose an OEM with global annual revenue of 100 billion euros faces a maximum-tier violation.

Fine ceiling = max(20,000,000 euros, 4% of global revenue)
4% of 100,000,000,000 euros = 4,000,000,000 euros
Fine ceiling = 4,000,000,000 euros (the 4% figure dominates)

The point: for large automakers the percentage-of-revenue cap, not the flat 20 million, sets the real ceiling. Regulators rarely impose the maximum, but the exposure disciplines behavior.

US state privacy laws: a patchwork, not a federal rule

The United States has no single federal privacy law equivalent to GDPR as of 2026. Instead, automakers face a growing patchwork of state laws. The most influential is the California Consumer Privacy Act (CCPA), expanded by the California Privacy Rights Act (CPRA) and enforced by the California Privacy Protection Agency (CPPA).

Key requirements that reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → connected cars:

• Consumers can access, delete, and opt out of the sale or sharing of their personal data.
• Precise geolocation and biometric data are treated as "sensitive personal information" with extra restrictions.
• The CPPA has publicly signaled scrutiny of connected vehicle data practices, opening a review of automakers and their data brokers.

More than a dozen states, including Virginia, Colorado, Texas, and others, have passed their own comprehensive privacy laws, each with slightly different definitions and consumer rights. An automaker selling nationwide must comply with the strictest applicable rule, which in practice often means engineering to a California-plus standard.

The data-sharing problem regulators are watching

A 2023 Mozilla report famously concluded that every major car brand it reviewed collected excessive data, and many reserved the right to share or sell it. In 2024, reporting revealed that some automakers had shared driving-behavior data with data brokers, which then fed insurers, in some cases raising drivers' premiums without clear consent. That triggered regulatory inquiries and lawsuits.

The lesson for professionals: data monetization strategies that ignore consent are now a legal and reputational liability, not a revenue opportunity.

How these regimes stack in practice

A single connected model sold in both Europe and the US faces overlapping obligations:

These do not replace each other. An OEM must satisfy all that apply to a given vehicle and market simultaneously. A US-market car escapes R155 and R156 but still faces state privacy law. A European car faces all four if it processes personal data.

The organizational consequence

Compliance now cuts across functions that used to be separate: engineering (secure design), legal (privacy notices and consent), procurement (supplier obligations), and operations (the VSOC monitoring the fleet). Many OEMs have created dedicated roles such as a Vehicle Cybersecurity Officer to own R155 and R156 evidence, since a lapsed certificate can halt production.

Key Takeaways

• Regulation is now a gate to the market, not an afterthought. Without a certified CSMS (R155) and SUMS (R156), automakers cannot get type approval to sell in Europe and 60-plus UNECE countries.
• OTA updates are legally controlled software. Under R156 a remote update that touches a safety system can affect type approval and must be tracked, validated, and authenticated.
• Privacy exposure is quantifiable and large. GDPR fines are capped at the higher of 20 million euros or 4 percent of global revenue, which for big OEMs means billions.
• The US is a patchwork. No federal law exists as of 2026, so automakers effectively engineer to the strictest state standard, often California's, and consent-free data sharing with brokers is now under active scrutiny.
• Compliance is cross-functional. Meeting these rules requires engineering, legal, procurement, and a live security operations center working together, with clear ownership of the audit evidence.