You clip a guardrail on an icy road at 30 mph. No airbag fires, the bumper cracks, and you drive home. If the impact was sharp enough to cross the recorder’s trigger threshold, your car has already saved five seconds of speed, throttle and braking data, and special equipment can read it back.
That recorder is the smaller part of what your car keeps. A second system, running on a cellular modem, can report where you drive and how hard you brake, and in one documented case that data reached insurers. Here is who can read each one, under US and EU law, and how to limit it.
This guide rests on rule text and agency records checked in November 2026. Practices differ by brand and model year, and no specific car was tested for it.
What does an event data recorder record, and when?
An event data recorder (EDR) is a function inside the airbag control module, not a flight-style black box. 49 CFR Part 563 defines it as a device or function that records vehicle data just before or during a crash, and excludes audio and video.
It saves data when an “event” occurs: a speed change of 8 km/h (about 5 mph) within 150 milliseconds, or the deployment of an airbag or belt pretensioner. For the five seconds before the event it logs speed, throttle position and whether the brake was pressed, twice per second.
During the crash it logs the change in velocity (delta-V) at 100 samples per second for up to 250 milliseconds. It also stores the driver’s belt status, the airbag warning lamp state, airbag deployment timing and the ignition cycle count.
Steering input, ABS activity and engine rpm are stored only “if recorded”, meaning the manufacturer chose to. GPS location is not on the required list, and the owner’s manual statement the rule mandates says no crash location or other personal data is recorded.
Is the EDR mandatory, and can you turn it off?
Part 563 applies to vehicles built from 1 September 2012 only if they have an EDR. NHTSA never required installation, but the Department of Transportation estimated that about 96 percent of model year 2013 cars already had one.
Nothing in Part 563 gives you an off switch. An airbag deployment event is locked against overwriting, while up to two lesser events are kept and a manufacturer may overwrite an older one.
The five-second window is changing. A December 2024 rule raised pre-crash recording to 20 seconds at 10 samples per second.
A May 2026 final rule delayed it into a phase-in: 25 percent of EDR-equipped production from 1 September 2028, rising to 100 percent from 1 September 2031. Small-volume manufacturers have until 2032. A car built before September 2028 records the old five seconds.
Who can read your EDR data?
The Driver Privacy Act of 2015, part of the FAST Act, says EDR data belongs to the vehicle’s owner or, for a leased car, the lessee.
Anyone else needs a court or other judicial or administrative authorization, your written, electronic or recorded audio consent, an NHTSA investigation, emergency medical response after a crash, or traffic safety research.
Insurers and police are not named, so in practice they get the data through your consent or a court order. Watch the consent route: the Act accepts consent given “by agreeing to a subscription that describes how data will be retrieved and used”, so a service contract you clicked through can count.
The Act covers EDR data. What your connected services send to the manufacturer falls under the contract you accepted and consumer-protection law.
What does connected-car telematics collect beyond the EDR?
Telematics means a modem in the car reporting to the manufacturer’s servers, the same phone-home model as ACR in a smart TV. The Federal Trade Commission’s case against General Motors shows the scale: GM collected precise geolocation from millions of vehicles, as often as every three seconds for some users.
Its Smart Driver feature scored every instance of hard braking, late-night driving and speeding. The FTC alleged that some owners did not know they had been enrolled.
Infotainment adds a third layer. Pairing your phone creates a profile with settings, linked apps and the paired device, and Consumer Reports advises giving yourself several days or more to clear it before a sale.
Mozilla’s Privacy Not Included review of 25 car brands, published 6 September 2023, failed every one on privacy, a first in the guide’s seven-year history.
How does driving data reach insurers and data brokers?
The route ran through consumer reporting agencies. GM said it ended data sharing with LexisNexis and Verisk on 20 March 2024, and in April 2024 it announced it would discontinue Smart Driver and unenroll all customers.
The FTC announced its complaint on 16 January 2025. It alleged that consumer reporting agencies used GM’s data to compile reports that insurers used to deny coverage and set rates.
The Commission finalized the order on 14 January 2026. GM is banned for five years from giving geolocation and driver behavior data to consumer reporting agencies.
For 20 years it must also get affirmative consent, let all US consumers request a copy of their data and ask for deletion, and offer an opt-out.
The order binds only GM. The FTC called it its first action on connected vehicle data, so no equivalent rule yet covers other automakers.
EDR vs telematics: what is recorded, when, and who reads it
| Event data recorder | Connected telematics | |
|---|---|---|
| What it holds | Speed, throttle, brake, belt status, delta-V, airbag timing | Location, braking and speeding events, trip data, infotainment and phone-sync data |
| When it records | On a trigger: 8 km/h speed change in 150 ms, or airbag deployment | Repeatedly while the service is active, every three seconds for some GM users |
| Where it lives | In the airbag control module, inside the car | On the manufacturer’s servers, sometimes shared with partners |
| Who reads it | Owner, courts, NHTSA, researchers, and others with your consent | Manufacturer, its partners, and insurers or data brokers if you were enrolled |
| Governing rule | 49 CFR Part 563, Driver Privacy Act | Your service contract, FTC enforcement, state law; GDPR in the EU |
| Can you switch it off? | No owner control in Part 563 | Usually, through a portal or app, at the cost of features |
What is different in Europe: GDPR, eCall and the EU EDR rule?
The EU made the recorder compulsory. Under Regulation 2019/2144, cars and light vans needed an EDR for new type approvals from 6 July 2022, and every newly registered one has needed it since 7 July 2024.
The EU recorder is built to be anonymous. It cannot be deactivated, it may not store the last four digits of the VIN or anything that identifies the vehicle or its owner, and national authorities may read it only for accident research and analysis.
Regulation 2015/758 made the 112-based eCall system compulsory in new vehicle types from 31 March 2018. It must not be traceable or subject to constant tracking, and its memory is continuously wiped, with only the last three locations kept.
Telematics falls under GDPR. An Article 15 access request to the manufacturer must be answered within one month, extendable by two for complex requests (Article 12).
Since 12 September 2025 the EU Data Act also gives users a right to data generated by connected products. The law firm Alston & Bird counts speed, braking patterns and seat belt usage among the connected-car examples.
How do you check and limit what your car shares?
Start with the manufacturer’s app or privacy portal and look for location sharing, a driving score and any toggle that mentions partners or insurers. Then check your insurance paperwork for a telematics or safe-driver enrollment, a separate data flow with its own agreement.
Request your records. In the US, LexisNexis Risk Solutions lets you request a Consumer Disclosure Report under the Fair Credit Reporting Act, online or by US mail.
GM owners can use the access and deletion route the FTC order requires, and EU drivers can send the Article 15 request.
Before you sell or return a rental, delete your device from the infotainment settings. The FTC warns that future renters or rental car employees may otherwise see the data.
What opting out cannot fix
Switching off sharing can switch off features. GM sold OnStar on emergency help, voice assistance, traffic and navigation, which rely on knowing where the car is, so read what a toggle disables before you flip it.
Opting out is also not deletion. The FTC order requires GM to let owners disable precise geolocation only “if their vehicle has the necessary technology”, with exceptions such as location for emergency first responders.
Opting out addresses collection going forward. Deleting what was already collected is a separate request, and the EDR keeps running either way.
Common questions about car data recorders
Can police download my EDR without a warrant?
Under the Driver Privacy Act they need court or administrative authorization or your consent. An NHTSA investigation, emergency medical response and traffic safety research are separate routes. A service subscription you agreed to can also count as consent, so read it.
Does an EDR record audio, video or location?
Audio and video are excluded by definition in Part 563, and GPS location is not a required data element. Manufacturers may record some optional items, such as steering input, only “if recorded”. Location sent by a connected-car modem is a different system, covered above.
Can I turn off my car’s event data recorder?
Part 563 gives owners no off switch, and the EU rule says the recorder cannot be deactivated. What you can control is connected telematics: use the manufacturer’s app or portal to turn off location sharing and driving scores, accepting that some features may stop.
How do I find out if my driving data went to an insurer?
Order your LexisNexis Consumer Disclosure Report, check any insurer telematics enrollment, and ask the manufacturer for a copy of your data. GM owners can use the access route its FTC order requires, and EU drivers can file a GDPR Article 15 request.