Definitions and comparisons
Is fleet GPS and telematics data personal data?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Fleet GPS and telematics data is often personal data, because a vehicle's location trail combined with a driver assignment points to a specific person at a specific time. Engine codes and other vehicle-only readings may not identify anyone on their own. Before licensing, separate driver identity, camera footage and precise trails from the operational events buyers actually need.
Key takeaways
- Location trails become personal data once they can be tied to the driver assigned to a vehicle.
- Research on mobility data found that a handful of location points can single out most people, so removing names is not enough.
- Inward-facing dash cam footage carries the highest risk, including possible biometric privacy questions.
- In California, driver data is employee data covered by the CCPA, while some other state privacy laws exclude employment data.
- Exception records with lane-level locations usually carry the value without precise breadcrumbs.
When does fleet GPS data identify a driver?#
Fleet GPS data identifies a driver whenever a location trail can be connected to the person assigned to the vehicle or logged in to the device. In most fleets that connection is easy: dispatch records, electronic logging device (ELD) logins and fuel card transactions all tie a truck to a named driver on a given day.
Even without names, location trails are revealing. In Unique in the Crowd, published in Scientific Reports in March 2013, researchers found that four spatio-temporal points were enough to uniquely identify 95% of individuals in a large mobility dataset. Overnight stops, home terminals and regular breaks make a driver's trail more distinctive, not less.
So the useful question for a COO is not whether telematics data is personal in the abstract. It is which fields tie the data to a person, and whether the operational value survives once those fields are gone.
Which telematics data types are personal?#
Telematics data types differ sharply in how directly they point to a person. The table gives a general starting view; the right handling depends on the states involved, driver agreements and customer contracts.
| Data type | Identifies a person? | Main concern | Handling before licensing |
|---|---|---|---|
| GPS breadcrumbs with timestamps | Often, once tied to a driver or with enough points | Reveals homes, routines and off-duty stops | Drop precise trails or coarsen to lane or region |
| Driver ID and ELD hours-of-service logs | Yes | Employment records and duty status | Remove driver identity; keep only duty patterns that are needed |
| Inward-facing dash cam video | Yes | Faces, voices and possible biometric privacy claims | Usually exclude |
| Forward-facing dash cam video | Sometimes | Bystanders, license plates and addresses | Exclude, or blur faces and plates with documented review |
| Harsh-event data such as hard braking and speeding | Yes, when tied to a driver | Performance and disciplinary use | Link to vehicle and trip, not to a person |
| Engine diagnostics and fault codes | Rarely on their own | Can become personal when joined to driver logs | Keep, with vehicle IDs tokenized |
| Stop, dwell and detention times at customer sites | Sometimes | Customer confidentiality and shipment details | Generalize consignee locations; check shipper contracts |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Which privacy rules may apply to driver data?#
The privacy rules that may apply to driver data depend on where drivers live and work and on whether they are employees or contractors. For most fleets, driver location and performance data is employment data, and state laws treat employment data very differently.
In California, the CCPA's temporary exemptions for employee and business-to-business information expired on January 1, 2023, so driver records held by a covered business are personal information with consumer rights attached. By contrast, the Colorado Attorney General states that the Colorado Privacy Act does not cover people acting in a commercial or employment context, and Virginia's law generally does not apply to information about people acting in an employment context.
Federal motor carrier rules add their own layer. FMCSA guidance says carriers must keep ELD records of duty status and back-up data for six months and store them in a manner that protects driver privacy. Employee monitoring notice laws in some states, union agreements and owner-operator lease terms can also limit how telematics data is reused.
Who controls the telematics record?#
The telematics record is usually controlled by the fleet under its contract with the telematics provider, but the provider's terms and retention settings decide what still exists. Before planning any licensing, check what the platform actually keeps.
Retention varies by platform and setting. Samsara, for example, lets customers customize retention for camera, hours-of-service and safety data, and its documentation says dash cam video is generally uploaded to the cloud only for a safety event or a manual request. A fleet's video archive is therefore a set of events, not continuous footage. Samsara also says data outside the chosen retention period is purged nightly and cannot be recovered, so export anything you may need before shortening a retention setting.
Owner-operators complicate control. Data from a leased-on owner-operator's truck may be governed by the lease agreement, and shipper contracts often treat delivery locations and shipment details as confidential.
How to prepare telematics data for licensing#
Preparing telematics data for licensing means keeping the operational story and removing the person. Buyers building logistics models usually want to know what went wrong on a load and how dispatch resolved it, not who was driving.
Test the package before release. Pick sample trips and ask whether someone with access to the company's own dispatch board could name the driver from what remains. If the answer is yes, coarsen the locations further or drop the field.
- Remove driver names, employee IDs, ELD login IDs and phone numbers.
- Replace vehicle and trip IDs with tokens that are not reused across packages, and do not ship the mapping key.
- Coarsen locations to lane, region or facility type, and drop the start and end of each trip near homes and terminals.
- Shift or generalize timestamps where exact times are not needed.
- Exclude inward-facing camera video and cab audio entirely.
- Keep exception events linked to outcomes: late delivery, detention, reroute, damage claim or missed appointment.
- Check shipper and customer contracts before including consignee names or addresses.
Illustrative: a regional carrier licenses exception records, not trails#
Illustrative: a fictional regional carrier and 3PL runs Samsara telematics alongside a McLeod TMS. An AI developer building exception-handling tools is interested in its records of late deliveries, detention and reroutes, and in how dispatchers resolved each one.
The carrier's first idea is to export everything, including GPS trails and dash cam events. Its COO and counsel instead scope a package of TMS exception records with lane-level locations, event codes, dispatcher notes with names removed and resolution outcomes. Driver identities, camera video and precise breadcrumbs are excluded, and shipper names are replaced with industry labels.
The buyer confirms the exception records carry the signal it needs. The carrier keeps raw telematics in its own systems under its existing retention settings, and the license bars any attempt to identify drivers or reconstruct routes.
How SourceX approaches fleet and telematics records#
SourceX handles fleet records through the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The Rights step reviews driver notices, owner-operator leases, shipper contracts and telematics vendor terms, and Preparation removes personal and confidential details before anything is shared.
Large telematics archives stay in the company's own storage or ship on encrypted drives, and the SourceX Evidence Packet records provenance, permitted use and the privacy record for each package. Whether a prepared package counts as deidentified under a given state's law is assessed deal by deal with the company's counsel.
Frequently asked questions
Does removing driver names make GPS data anonymous?
Usually not. Location trails can identify people through their patterns alone, such as where a vehicle parks overnight or which route it takes every morning. Removing names is a first step; coarsening locations, removing trip endpoints and generalizing timestamps do more of the work.
Can we license dash cam footage?
Inward-facing footage is usually excluded because it shows drivers' faces and may raise biometric privacy questions. Forward-facing footage can sometimes be prepared by blurring faces and license plates, but it also captures bystanders and addresses, so it needs careful review and counsel's sign-off.
Do drivers need to be told before their data is licensed?
It depends on the states involved, the original notices and any union or owner-operator agreements. Where notices described telematics only for safety and compliance, a new use may need fresh notice or consent. Counsel should review the notices drivers actually received.
Does FMCSA retention mean we must keep all telematics data?
No. The FMCSA rule sets a minimum period for ELD records of duty status and supporting documents, but it does not cover every telematics field and does not require long-term storage. Your own retention policy and any legal holds decide what else is kept.
Is vehicle diagnostic data ever personal data?
Engine fault codes and sensor readings rarely identify anyone on their own. They can become personal when joined to driver assignments or precise location trails, so keep vehicle data separate from driver data and tokenize vehicle IDs before licensing.
Sources
- In Unique in the Crowd (Scientific Reports, March 2013), de Montjoye and colleagues found that four spatio-temporal points are enough to uniquely identify 95% of individuals in mobility data for about 1.5 million people. Source
- The California legislature did not extend the CCPA employee and business-to-business personal information exemptions, so they expired on January 1, 2023. Source
- The Colorado Attorney General states that the Colorado Privacy Act does not cover personal data of individuals acting in a commercial or employment context and does not apply to data maintained for employment records purposes. Source
- The Virginia Consumer Data Protection Act generally does not apply to information about a natural person acting in a commercial or employment context. Source
- FMCSA's ELD FAQ states that motor carriers must retain ELD records of duty status and back-up data for six months and store them in a manner that protects driver privacy. Source
- Samsara's help center says customers can customize data retention for DVIR, camera, Hours of Service and Safety and Speeding data, and that data outside the chosen retention period is purged nightly and cannot be recovered. Source
- Samsara's camera privacy article says video is generally uploaded to the cloud only when there is a safety event or a manual request for footage. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.