# Data, privacy, and cybersecurity for connected cars
In July 2022, a rule quietly changed what it takes to sell a car in Europe. Under UNECE Regulation No. 155, any automaker seeking type approval (the license to sell a vehicle model in a market) must prove it runs a certified cybersecurity management system. No certificate, no approval, no sale. Volkswagen reportedly pulled several models, including versions of the up! and certain Transporter variants, rather than re-engineer them to comply. Regulation had become a gatekeeper to the showroom.
A modern connected car generates and transmits enormous volumes of data: location, driving behavior, cabin microphone audio, biometric identifiers, even inferred health signals. That turns every automaker into a data business and a software business, whether it wants to be or not. This lesson maps the four regulatory forces every automotive professional must now understand.
UNECE stands for the United Nations Economic Commission for Europe. It runs the World Forum for Harmonization of Vehicle Regulations, which sets vehicle rules adopted across the EU, UK, Japan, South Korea, and roughly 60 signatory countries. The United States is not a signatory, so R155 does not directly bind US sales.
R155 requires automakers to operate a Cyber Security Management System (CSMS): a documented, audited process for identifying and managing cyber risks across a vehicle's entire lifecycle, from design to decommissioning.
In practice this means:
Since July 2024, R155 applies to *all* new vehicles produced for these markets, not just newly approved models. The engineering standard most manufacturers use to meet it is ISO/SAE 21434, the industry cybersecurity engineering baseline.
An automaker cannot certify a CSMS if it cannot vouch for its supply chain. So Tier 1 suppliers (direct component suppliers like Bosch or Continental) and Tier 2 suppliers now face contractual cybersecurity obligations flowing down from the OEM (Original Equipment Manufacturer, the brand that builds the car). Compliance has become a procurement requirement, not just an IT concern.
Cars now receive software the way phones do. Tesla popularized it; nearly every OEM now ships over-the-air (OTA) updates, remote software patches sent to vehicles in the field.
That creates a new risk: a bad or malicious update could disable brakes across a fleet. UNECE R156 governs this by requiring a Software Update Management System (SUMS).
R156 requires automakers to:
A concrete example: if an OTA update changes how a car's automatic emergency braking behaves, that touches a safety-relevant system. Under R156 the automaker must document the change, validate it, and ensure the vehicle still matches its approved type.
🎬 [VIDEO: "UN Regulation No. 155 and No. 156 explained" - youtube.com - a clear industry primer on how the two regulations interact for connected vehicles]
The General Data Protection Regulation (GDPR) is the EU's comprehensive privacy law, enforced by national Data Protection Authorities (DPAs). It applies to any personal data of people in the EU, and connected cars produce a flood of it.
The European Data Protection Board (the body coordinating GDPR enforcement) has issued specific guidelines on connected vehicles making key points automakers cannot ignore:
GDPR fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → the higher of 20 million euros or 4 percent of global annual revenue. For a large OEM that is a multi-billion-euro exposure, which is why privacy engineering now sits in the vehicle design process.
This is illustrative, not a prediction. Suppose an OEM with global annual revenue of 100 billion euros faces a maximum-tier violation.
Fine ceiling = max(20,000,000 euros, 4% of global revenue)
4% of 100,000,000,000 euros = 4,000,000,000 euros
Fine ceiling = 4,000,000,000 euros (the 4% figure dominates)The point: for large automakers the percentage-of-revenue cap, not the flat 20 million, sets the real ceiling. Regulators rarely impose the maximum, but the exposure disciplines behavior.
Vérification des acquis
1. Why does UNECE R155 function as a 'gatekeeper to the showroom' rather than as a typical after-market safety recall mechanism?
2. A US-only automaker argues R155 is irrelevant to its business. What is the most accurate assessment of this reasoning?
3. Why does R155 require automakers to manage cybersecurity risks arising from their suppliers?
4. Select ALL correct answers about what a Cyber Security Management System (CSMS) under R155 requires.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers explaining why modern connected cars turn automakers into data and software businesses.
Sélectionnez toutes les réponses correctes.
The United States has no single federal privacy law equivalent to GDPR as of 2026. Instead, automakers face a growing patchwork of state laws. The most influential is the California Consumer Privacy Act (CCPA), expanded by the California Privacy Rights Act (CPRA) and enforced by the California Privacy Protection Agency (CPPA).
Key requirements that reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → connected cars:
More than a dozen states, including Virginia, Colorado, Texas, and others, have passed their own comprehensive privacy laws, each with slightly different definitions and consumer rights. An automaker selling nationwide must comply with the strictest applicable rule, which in practice often means engineering to a California-plus standard.
A 2023 Mozilla report famously concluded that every major car brand it reviewed collected excessive data, and many reserved the right to share or sell it. In 2024, reporting revealed that some automakers had shared driving-behavior data with data brokers, which then fed insurers, in some cases raising drivers' premiums without clear consent. That triggered regulatory inquiries and lawsuits.
The lesson for professionals: data monetization strategies that ignore consent are now a legal and reputational liability, not a revenue opportunity.
A single connected model sold in both Europe and the US faces overlapping obligations:
| Regime | Governs | Trigger |
|--------|---------|---------|
| UNECE R155 | Cybersecurity management | EU/UNECE type approval |
| UNECE R156 | Software/OTA updates | EU/UNECE type approval |
| GDPR | Personal data of EU individuals | Any EU data processing |
| CCPA/CPRA and state laws | Consumer data rights | Sales into those US states |
These do not replace each other. An OEM must satisfy all that apply to a given vehicle and market simultaneously. A US-market car escapes R155 and R156 but still faces state privacy law. A European car faces all four if it processes personal data.
Compliance now cuts across functions that used to be separate: engineering (secure design), legal (privacy notices and consent), procurement (supplier obligations), and operations (the VSOC monitoring the fleet). Many OEMs have created dedicated roles such as a Vehicle Cybersecurity Officer to own R155 and R156 evidence, since a lapsed certificate can halt production.