Navigating the regulatory maze: GDPR, UNECE R155 and CCPA on wheels

The core GDPR requirement: you need a lawful basis to process personal data. There are six. The two that matter most in cars:

• Consent: freely given, specific, informed, and revocable.
• Legitimate interest: processing genuinely necessary for a business purpose, balanced against the driver's rights.

Where it bites

When the infotainment screen asks the driver to accept data sharing before navigation works, that is a consent flow. GDPR says consent for navigation cannot be bundled with consent for marketing analytics. Bundling is a classic violation.

Safety-critical functions (airbag deployment logging, eCall emergency data) usually rely on legal obligation or vital interests, not consent. You cannot ask a driver to "opt in" to crash telemetry mid-collision.

The European Data Protection Board publishes vehicle-specific guidance worth bookmarking: EDPB Guidelines on connected vehicles.

Kilometre one: R155 and R156, the security gate

Here is what surprises non-technical professionals. R155 is not a privacy law at all. It is a cybersecurity type-approval requirement. In the EU, since July 2024, a car cannot be sold as a new model unless the manufacturer holds a valid CSMS (Cyber Security Management System) certificate.

R155 forces automakers to prove they can identify, assess, and manage cyber risks across the vehicle lifecycle. R156 does the same for software updates (the SUMS, Software Update Management System), meaning over-the-air updates must be controlled, logged, and reversible.

Where it bites

R155 bites at the factory and at the regulator, not at the driver. But it shapes the data story: a manufacturer must maintain audit trails proving each ECU (Electronic Control Unit, the small computers running steering, braking, and so on) is protected against known attack vectors.

The practical link to your data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → job: R155 evidence and GDPR records of processing often describe the same data flows from different angles. Security teams and privacy teams frequently maintain separate documents that should reconcile. They often do not.

🎬 [VIDEO: "UNECE WP.29 R155 Cybersecurity Explained" - youtube.com/results?search_query=unece+r155+cybersecurity - a plain-language overview of the WP.29 vehicle cybersecurity regulation and CSMS requirements]

The border crossing: US state laws

The same automaker selling in the US faces no federal privacy law equivalent to GDPR. Instead, a patchwork of state laws applies. As of 2026, roughly 20 US states have comprehensive consumer privacy laws in force (estimate, count keeps rising). The anchor is still CCPA, amended by the CPRA (California Privacy Rights Act).

Key CCPA differences from GDPR:

• CCPA is primarily opt-out, not opt-in. A California driver has the right to say "do not sell or share my personal information," but data can flow until they object.
• CCPA has an explicit "Do Not Sell or Share" right. Connected-car location data sold to data brokers is exactly the target.
• Enforcement sits with the California Privacy Protection Agency and the state Attorney General.

Where it bites

If our automaker shares precise geolocation with an insurance analytics partner, CCPA requires a clear opt-out mechanism accessible to the California driver. GDPR would have required opt-in consent for the same flow in Munich. Same data, opposite default.

A worked reconciliation

Say your car collects three data streams and you need to mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → obligations. A simple governance matrix:

| Data element | GDPR basis | R155 relevance | CCPA category |

|---|---|---|---|

| Precise GPS | Consent | Attack surface (spoofing) | Sensitive PI, opt-out |

| Crash telemetry | Legal obligation | Integrity critical | Not "sold," retained |

| Voice commands | Consent | Cloud transit security | PI, opt-out if shared |

Build this once per data element and half your audit work is done.

The data check: a practical inventory snippet

Governance starts with knowing what flows where. Here is a minimal data inventory record you can adapt. This is a structured description, not a legal document:

If you cannot fill in lawful_basis_eu, shared_with, and opt_out_mechanism_us for every element, you have a gap.

Running the audit: what to actually check

Auditing connected-car data is not one review. It is three overlapping checks that should share evidence.

1. Consent audit (GDPR)

• Pull the infotainment consent screens. Are marketing and navigation consents unbundled?
• Test revocation. If a driver withdraws consent, does data collection actually stop within a reasonable window?
• Check the records of processing activities (ROPA), the GDPR-mandated log of what you process and why.

2. Cybersecurity evidence audit (R155/R156)

• Confirm the CSMS certificate is current and covers the models in scope.
• Verify OTA update logs are tamper-evident and reversible.
• Cross-check: does the R155 threat analysis list the same data flows your ROPA describes? Reconcile the two.

3. Consumer rights audit (US state laws)

• Confirm a functioning "Do Not Sell or Share" mechanism for US drivers.
• MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → which of the roughly 20 active state laws apply to your customer base.
• Check whether precise geolocation is treated as sensitive data (it is, under CPRA and several others).

The reconciliation trap

The single most common finding: the privacy team's data mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → and the security team's R155 threat model describe different realities. Privacy says voice data is deleted after 30 days. Security's cloud logs show 90-day retention for debugging. Both cannot be right. Force them into one shared inventory.

Why the defaults matter commercially

The opt-in versus opt-out gap is not academic. A European driver who must actively consent may leave features off, so EU connected-car datasets can be thinner. A California driver's data flows until they object, so US datasets are richer but carry higher exposure if the opt-out mechanism fails.

Real enforcement exists. European data protection authorities have issued substantial GDPR fines across sectors, and automotive location-data practices are under active scrutiny by regulators and the press. Treat the maze as live, not theoretical.

Key Takeaways

• Three regimes, three trigger points. GDPR bites at data collection (opt-in), R155/R156 bite at sale and software updates (security certification), US state laws bite at data sharing (opt-out).
• Same data, opposite defaults. EU consent is opt-in; CCPA and most US laws are opt-out. Precise geolocation is the highest-risk element under all of them.
• Reconcile privacy and security records. Your GDPR ROPA and your R155 threat model must describe the same data flows. Divergence is the most common audit finding.
• Build one inventory per data element. Capture lawful basis, sharing partners, retention, and opt-out status. Do this once and most audit work follows.
• Enforcement is real in 2026. Roughly 20 US states now have comprehensive privacy laws (estimate), and EU authorities actively scrutinise connected-car location data.