The average car built in the last few years collects more data per mile than most drivers generate on their phone. Speed, position, hard braking, seatbelt status, steering angle, phone contacts beamed in over Bluetooth, voice commands spoken to the dashboard. Most of it sits on hardware you own but can’t easily read. Some of it’s uploaded within seconds to servers you’ll never see. For anyone in a dispute, a crash claim or a privacy fight, the question is no longer whether the data exists. it’s whether you can get a copy before it’s overwritten, expired or quietly reclassified.
The black box you already own
Event data recorders, the EDR, have been standard in new vehicles in the United States since the 2012 model year under federal rules, and effectively universal across European and Gulf-market cars since. The EDR isn’t a tracker. it’s a crash-triggered memory: a rolling window of a few seconds to half a minute covering vehicle speed, engine throttle, brake application, restraint deployment and, on many units, steering input in the moments before and during an impact.
Two properties matter. First, the data is physical: it lives on a module in your car, not in some vendor’s cloud, and it survives crashes that destroy the rest of the electronics. Second, the window is short. An EDR doesn’t keep months of history. It holds the last events and, once a set number of ignition cycles pass without a download, older records are overwritten. If you’re in a collision dispute, the physical EDR is both the most authoritative and the most perishable piece of evidence in the case. Preservation letters to whoever holds the vehicle, insurers, body shops, the other party, need to go out early, because every day in a storage yard is a day closer to the memory rolling over.
The telematics layer
Above the EDR sits a far bigger and far less regulated system: telematics. Connected cars phone home. Remote start, emergency calls, stolen-vehicle tracking, usage-based insurance, the app that tells you where you parked. Every one of those features is a data pipeline.
What it collects: position traces, trips, speeds, harsh events, ignition states, sometimes cabin camera footage on newer driver-monitoring systems, and diagnostic streams. Where it goes: the manufacturer’s cloud, plus whatever third parties the subscription flow includes, plus, in insured vehicles, the insurer if you’re on a usage-based policy.
How long it survives: here the picture gets worse for anyone hoping for a simple answer. Retention varies wildly. Insurance black-box policies commonly hold process-level data for the policy term and aggregate scores for years after. Manufacturer connected-car platforms have moved toward short raw retention with long aggregate retention: the trip log often thins out after a few months in the app, while the account profile, service history and the consented marketing dataset live indefinitely. Dashcam and sentry footage, covered in an earlier piece on this site about CCTV retention, is on yet another clock entirely: loop storage measured in days before the overwrite gets it.
Who can actually demand a copy
If you’re in the UK or Europe, the GDPR route is direct and it works. Telematics records that identify you’re personal data, full stop, and the manufacturer’s regional entity is the controller. A subject access request costs nothing and carries a statutory one-month clock. Ask for: the account profile, process and location history, any event or safety data linked to your vehicle, and the categories of third parties it has been shared with. Insurers are subject to the same regime for telematics policy data.
There are two catches. The first is identification: expect the platform to demand proof you own the vehicle before releasing trip history, which is fair, so have the logbook and keys to hand, or in a disputed case, use your lawyer’s letterhead. The second is scope: a SAR gets you your own data. If what you need is the other party’s driving history, from an insurer or a fleet operator, that’s a disclosure application in litigation, not a data request, and the rules for getting it are the court’s.
In the United States, the patchwork applies. Several states give you a right to the telematics data tied to your vehicle, and the federal EDR rule gives an “authorized person”, generally the vehicle owner or lessee, the right to a copy of the EDR data after a crash. Rental and fleet vehicles complicate ownership of the data, and subscription telematics adds a contract layer: the terms of service you clicked through at the dealership decide a great deal. Read them before the dispute, not after.
Delete isn't the same as gone
Manufacturers increasingly advertise a delete option in the connected-car app, and it’s honest as far as it goes: your account profile goes, the linkage goes. What doesn’t go is the aggregate record. Safety analytics, warranty claims linked to the VIN, any snapshot already shared under a legal or safety process, and crash event data already extracted are held under separate retention rules that the delete button doesn’t touch. The VIN itself persists across every database the vehicle has ever been registered in.
For litigation, the lesson is the same one that keeps repeating on this site: the useful copy is the one preserved early, with timestamps and provenance. A screenshot of the trip log is an exhibit. A certified extract from the manufacturer, obtained by a SAR or by disclosure order, is evidence.
Practical checklist
- After any collision you may ever litigate: send a preservation notice to your insurer and the storage yard the same week. EDR windows are short.
- Request your own connected-car history once a year. It costs nothing and it tells you what the platform actually holds about you, which is more than most people know.
- Before a telematics insurance policy renews, check the retention terms in the policy document, not the app. The document controls.
- Treat the in-car voice assistant as a microphone with a cloud contract. If the subject matter is sensitive, don’t say it in the cabin.
- Used car? The previous owner’s paired phone books and profiles are frequently still on the infotainment. Wipe the pairings on both ends, and remember the vendor side doesn’t wipe because the car did.
Your car is a competent witness and a loyal correspondent. It writes down where you went, how you drove and what you said to the dashboard, files copies with strangers, and forgets on schedules you never agreed to. Finding out what it said about you, while it still remembers, is the whole of the game.
The Shadow Chronicle covers surveillance, data retention and the machinery that watches. Related reading: UK call records and how long phone data survives, and body camera footage before the retention clock wipes it.
