Who owns the data? Privacy, monetization, and compliance

Third parties (insurers, fleet operators, mapping companies) want to buy access.

In most jurisdictions, raw data is not "property" you can own like a chair. Instead, control comes from two places: contracts (the terms you clicked to accept) and data protection law. So the real question is not "who owns it" but "who has the legal right to use it, and under what conditions."

Personal data vs. non-personal data

This distinction drives everything that follows.

Personal data is any information relating to an identified or identifiable person. Location history, driving behavior tied to your account, and voice commands are personal data. This triggers privacy law.

Non-personal data is aggregated or anonymized information with no link to an individual. "Average battery degradation across 40,000 vehicles in cold climates" is non-personal. This is far freer to monetize.

The catch: true anonymization is hard. Location traces are notoriously re-identifiable. Four location points can often uniquely identify a person. So a lot of "anonymized" automotive data is legally still personal data, which means the privacy rules still apply.

GDPR: the framework you must design around

The GDPR (General Data Protection Regulation) is the EU privacy law that sets the global benchmark. Even a US or Asian OEM must comply when handling EU drivers' data. Fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → up to 4% of global annual revenue, so this is a board-level risk.

GDPR requires a lawful basis for processing personal data. For automotive monetization, two matter most:

• Consent: the driver freely agrees to a specific use. Must be opt-in, granular, and as easy to withdraw as to give.
• Legitimate interest: the company can process data for a genuine business need that does not override the individual's rights. This requires a documented balancing test.

A safety recall notification can rely on legitimate interest or legal obligation. Selling driving-behavior data to an insurer almost always requires explicit consent.

The European Data Protection Board has published specific guidance on connected vehicles that is worth bookmarking: EDPB Guidelines on connected vehicles.

Consent that actually holds up

Bad consent is the most common failure. A single checkbox saying "I agree to data processing" buried in a 40-page terms document will not survive a regulator's review.

Valid consent under GDPR must be:

• Freely given: the car must still function if the driver says no to marketing data.
• Specific: separate the uses. Navigation improvement is not the same as selling data to advertisers.
• Informed: plain language, not legalese.
• Withdrawable: one tap in the vehicle menu or app.

Practical design pattern: a layered consent dashboard in the infotainment system and companion app, with toggles per data category (diagnostics, location, driving behavior, in-car commerce). Each toggle maps to a documented purpose.

This kind of structured consent record is what you show a regulator to prove compliance. If you cannot produce it, you effectively have no lawful basis.

The Data Act changes the balance

New for the mid-2020s: the EU Data Act started applying in September 2025. It is a major shift for automotive.

The core idea: users of connected products have a right to access the data they generate and to share it with third parties of their choice. A driver can now ask their OEM to send maintenance data to an independent repair shop instead of the brand's own dealer network.

Why this matters for strategy: OEMs can no longer assume they hold exclusive access to vehicle data. The independent aftermarket (repairers, parts sellers, insurers) gains leverage. Your monetization model cannot depend on locking others out.

Regional patchwork

Do not assume GDPR covers everything.

• United States: no single federal privacy law. State laws lead, notably the CCPA/CPRA in California, which gives consumers rights to know, delete, and opt out of the sale of personal data. Several other states have followed with their own acts.
• China: the PIPL (Personal Information Protection Law) is strict, and automotive data has extra rules. Precise mapping data is treated as sensitive, and there are tight controls on transferring vehicle data out of the country.
• Rest of world: many markets are adopting GDPR-style laws, but timelines and details differ.

A global OEM needs a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → model that meets the strictest applicable standard per region, then relaxes only where local law clearly permits.

Building a compliant monetization strategy

Now the applied part. How do you actually make money from vehicle data without creating legal and reputational risk?

1. Segment your data by monetization freedom

Sort every data stream into three buckets:

• Freely monetizable: genuinely aggregated, non-personal insights. Example: selling anonymized road-condition data to a mapping provider.
• Monetizable with consent: personal data where the driver opts in and shares the value. Example: usage-based insurance, where safe drivers get lower premiums.
• Do not touch: sensitive data or uses that would fail a legitimate-interest balancing test. Example: inferring health conditions from driving patterns to sell to advertisers.

2. Make consent a value exchange, not a trap

Drivers say yes when they get something back. Usage-based insurance works because the driver sees a discount. A concierge service that pre-books charging works because it saves time. Frame consent as an offer, not fine print.

3. Follow the Data Act, do not fight it

Instead of hoarding data, build paid APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.Voir la définition complète → access for third parties who the driver authorizes. If a repair shop needs diagnostics, sell them a clean, permissioned data feed. You can monetize access and interoperability rather than exclusivity.

4. Design privacy in from the start

Privacy by design is a GDPR requirement, not a nice-to-have. Minimize what you collect, process on the edge (in the car) where possible, and pseudonymize early. Data you never collect cannot be breached or fined.

5. Keep the paper trail

Maintain records of processing, consent logs, and balancing tests. When a regulator or a driver asks, you answer with documentation, not promises.

A quick worked example

An OEM wants to launch a predictive maintenance service that also generates parts revenue.

• Data used: engine and battery diagnostics. Personal, because it links to the vehicle and owner.
• Lawful basis: consent, offered as "Get early warnings before a breakdown."
• Value exchange: the driver avoids being stranded; the OEM sells the part and service.
• Data Act compliance: the driver can route that same diagnostic data to an independent garage if they prefer.
• Result: revenue that survives a compliance audit, because consent, purpose, and portability are all handled.

Key Takeaways

• Nobody cleanly "owns" car data. Control comes from contracts plus data protection law, so design around lawful use, not ownership claims.
• Split every data stream into personal vs. non-personal, then into freely monetizable, consent-based, and off-limits. This mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → is your strategy.
• Valid GDPR consent is granular, informed, and easy to withdraw, and you must keep structured records to prove it.
• The EU Data Act (applying since September 2025) gives drivers portability rights, so build permissioned, paid APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.Voir la définition complète → access instead of locking competitors out.
• Treat privacy by design and per-region compliance (GDPR, CCPA/CPRA, PIPL) as the foundation, then monetize through genuine value exchange with the driver.