Fleet Tracking Regulations Explained: A Guide for Van Rental Companies in France

Practical guide to French GDPR and CNIL rules for van-rental GPS tracking: consent, minimisation, retention and employee limits.

Michael Bar

— 6 min read
Share
Fleet Tracking Regulations Explained: A Guide for Van Rental Companies in France

Jurisdiction Scope

Metropolitan France; French CNIL guidance under the GDPR and France's amended Data Protection Act (Loi Informatique et Libertés), including Article 82 rules for access to terminal/connected-vehicle data.

Overview of Fleet Tracking Laws

Applicable Business Type

Van rental companies and connected-vehicle rental-service providers

Country or Region

France

A France-focused compliance guide for van rental companies using GPS or connected-vehicle location data. It covers the French GDPR/ePrivacy framework, lawful purpose and necessity, customer and employee transparency, consent or another valid legal basis, minimisation, retention, data-subject rights, and limits on continuous or off-duty tracking. CNIL enforcement against a car-rental provider illustrates that retaining location data throughout the commercial relationship and for three further years after the last activity may be excessive.

Legal Requirements Summary

French van-rental operators must treat GPS/connected-vehicle location data as regulated personal data. They should use a defined and necessary purpose, obtain prior renter consent for location access unless a narrow service-necessity exception applies, establish a separate GDPR legal basis for subsequent processing, minimise collection, set a purpose-based retention schedule, provide privacy information and rights, and secure processor arrangements. Employee tracking must be proportionate, transparent and restricted to working-time/business needs, with off-duty suspension. There is no blanket French rule requiring a fixed retention period for rental tracking; excessive retention and continuous collection have been sanctioned.

Main Regulatory Topics

  • Data privacy and GDPR compliance
  • French ePrivacy/Article 82 consent for connected-vehicle data
  • Purpose limitation and lawful basis
  • Data minimisation and proportionality
  • Retention and deletion
  • Renter transparency and data-subject rights
  • Employee monitoring and off-duty tracking
  • Processor contracts and security
  • CNIL enforcement and penalties

Key Compliance Obligations

  • Define a specific, explicit and legitimate purpose for each tracking use and document the GDPR Article 6 legal basis.
  • Inform renters and employees clearly about the location processing, purposes, recipients, retention and their rights; obtain prior renter consent where Article 82 requires it.
  • Collect and retain only location data necessary for the stated purpose; limit collection frequency, recorded detail and retention duration.
  • Do not retain a complete journey history where the current position or a shorter history is sufficient; delete or anonymise data when the purpose ends, subject to a documented legal or litigation need.
  • For employee vehicles, do not use geolocation for permanent monitoring, speed-limit compliance, or off-duty tracking; provide a means to disable collection/transmission outside working time.
  • Allow data-subject rights, including access, rectification, erasure, portability, withdrawal of consent and objection where applicable.
  • Use appropriate processor contracts and security controls, and assess vendor processing and data transfers.
  • Maintain evidence of the compliance design and be prepared for CNIL scrutiny; excessive tracking or retention can lead to enforcement and fines.

Driver Consent Requirement

Consent Rule: For rental customers, users must generally be informed and give prior consent before accessing connected-vehicle location data under French law, unless access is strictly necessary for a service expressly requested by the user; any subsequent personal-data processing must also have a GDPR Article 6 legal basis. CNIL specifically gives a rental vehicle's use for improving or optimising the rental service as an example where the renter's consent is required. For employees, provide clear information, permit access and off-duty suspension, and do not use tracking continuously or outside working time; employee consent is not a blanket substitute for necessity and proportionality.

Data Retention Period

Minimum Retention: No universal minimum period for rental-customer geolocation data; retain only for as long as necessary for the specified purpose. For employee vehicle tracking, CNIL guidance states in principle no more than 2 months, with exceptions of 1 year for route optimisation/proof of service and 5 years for working-time monitoring.

Enforcement Authorities

  • Commission nationale de l’informatique et des libertés (CNIL), France’s data-protection supervisory authority
  • French courts and judicial authorities, where location data is relevant to theft, disputes or proceedings
  • The French labour-law framework and employee representative bodies are relevant to employee monitoring consultation and information obligations

Penalties for Non-Compliance

Non-compliance can lead to CNIL corrective measures and administrative fines, complaints and orders to change or stop the processing, as well as employment, contractual and reputational consequences. Recent enforcement illustrates the exposure: CNIL fined Ubeeqo International €175,000 for excessive and continuous customer geolocation/retention, and Cityscoot received fines totalling €150,000 for excessive geolocation and related privacy breaches. Excessive tracking may also weaken the company’s position in customer disputes and create evidence-handling and data-breach risks.

Implementation Best Practices

Adopt a purpose-by-purpose telematics design: document why location is needed, what minimum granularity achieves that purpose, when tracking starts and stops, who can see it, and when it is deleted. For ordinary van rentals, prefer a visible, event-driven or last-position design over continuous high-frequency tracking. Put concise notices in the rental workflow and vehicle, link to the full privacy policy, and log the customer’s choices where consent is used. Separate fleet-management, theft recovery, accident assistance, fines and dispute-evidence workflows rather than retaining one universal journey history. Configure automatic deletion after the approved period, audit access logs and vendor controls, and test disablement/privacy modes before rollout.

Compliance Checklist

  1. Define and document a specific, necessary purpose for each tracking function; do not collect location data merely “just in case”.
  2. Choose and document an appropriate GDPR legal basis; provide a clear privacy notice covering the controller, purposes, legal basis, data recipients, retention, and data-subject rights.
  3. For employee-operated vehicles, inform and, where applicable, consult employee representative bodies before deployment; inform employees before installation.
  4. For rental customers, make location processing transparent in the rental/privacy documentation and ensure any consent relied upon is specific and separate from general terms where consent is required.
  5. Configure collection proportionately: minimise frequency, accuracy, history and data fields. Consider last-position or event-triggered tracking rather than continuous journey histories.
  6. Use geolocation only during the rental or other justified operational period. Stop or restrict collection after vehicle return unless a separately justified theft, dispute, assistance or legal-evidence purpose applies.
  7. Permit employees to disable location collection outside working time where the vehicle can be used privately; do not track employee journeys during breaks or commuting.
  8. Restrict access to authorised staff and relevant service providers; secure web dashboards with strong authentication and maintain processor/data-processing arrangements.
  9. Set a documented retention schedule. As a CNIL benchmark for employee-vehicle systems, the normal period is no more than two months; up to one year may apply for route optimisation or proof of service, and up to five years for working-time records where justified.
  10. Maintain the processing activity in the GDPR records of processing, involve the DPO where applicable, and provide access, rectification, objection and other applicable rights-handling procedures.
  11. Review the system regularly against purpose limitation, minimisation, security, retention and supplier-contract requirements.

Industry-Specific Guidance

Van rental companies process location data for both customers and, potentially, employees, so the analysis differs by user. For employees, CNIL accepts limited purposes such as vehicle or goods security, service allocation, transport/service billing and—only where no other method works—working-time monitoring; it rejects permanent employee surveillance, speed-limit monitoring and tracking outside working time. For individual renters, continuous or highly granular tracking throughout every rental is especially risky because it can reveal private movements. Fleet management, return-location checks, theft recovery and accident assistance should be designed with the least intrusive data capable of achieving each objective. A returned vehicle generally should not retain the renter’s full location history merely because the commercial relationship continues; theft or litigation records require a distinct, documented justification and limited retention. Customer-facing notices should explain collection, purposes, recipients, retention and rights, with visible vehicle/app indicators where appropriate.

Recent Legal Updates

As at 5 October 2026, CNIL has published June 2026 guidance/recommendations on connected-vehicle location data used by private individuals, including owners and renters. It emphasises necessity, data minimisation, limited collection frequency and retention, transparent privacy information, visible notices, and practical rights mechanisms. CNIL’s July 2026 employee-monitoring guidance reiterates that a tool implemented for one purpose must not silently be reused for another and recognises constant tracking only in narrowly proportionate cases such as locating emergency vehicles. The 2022 Ubeeqo and 2023 Cityscoot enforcement decisions remain important practical warnings against default, continuous rental tracking and excessive retention.

Authoritative Resources

Related Blog Posts

Read more