Vehicle Event Data Recorder Laws: The Driver Privacy Act of 2015, NHTSA's Part 563 and Eight State Statutes

What an Event Data Recorder Captures

NHTSA's regulation, 49 CFR part 563, defines an event data recorder as "a device or function in a vehicle that records the vehicle's dynamic time-series data during the time period just prior to a crash event (e.g., vehicle speed vs. time) or during a crash event (e.g., delta-V vs. time), intended for retrieval after the crash event." The definition adds that event data "do not include audio and video data."

An EDR works in two stages. It continuously captures data into volatile memory that is overwritten at regular intervals, and it records into non-volatile memory only when an event occurs. An event is a crash or other occurrence that meets the trigger threshold, a change in longitudinal velocity of at least 8 km/h within 150 milliseconds (or lateral, for recorders that track lateral delta-V), or that deploys a non-reversible restraint. Under section 563.9, data from an air bag deployment is locked against overwriting, and up to two non-deployment events can be stored.

Every covered EDR must record the elements in table I to section 563.7(a), among them longitudinal delta-V, indicated vehicle speed, accelerator position, service brake status, ignition cycle counts, driver safety belt status, the frontal air bag warning lamp and frontal air bag deployment times. Other elements, such as steering input, engine RPM, ABS and stability control activity and lateral acceleration, are required in a specified form only "if recorded." The owner's manual statement required by section 563.11 tells buyers that "no personal data (e.g., name, gender, age, and crash location) are recorded," and that other parties "could combine the EDR data with the type of personally identifying data routinely acquired during a crash investigation."

Ownership Under the Driver Privacy Act of 2015

The Driver Privacy Act of 2015 is part I of subtitle C of title XXIV of division B of the Fixing America's Surface Transportation Act, Pub. L. 114-94, enacted December 4, 2015. It is not codified in a numbered section; the text is carried as a statutory note to 49 U.S.C. § 30101. Section 24302(a) provides that "Any data retained by an event data recorder (as defined in section 563.5 of title 49, Code of Federal Regulations), regardless of when the motor vehicle in which it is installed was manufactured, is the property of the owner, or, in the case of a leased vehicle, the lessee of the motor vehicle in which the event data recorder is installed."

Three features of that sentence define its reach. It borrows NHTSA's definition, so it covers what Part 563 calls an EDR and not every module that stores vehicle data. It is retroactive by its terms, applying regardless of the vehicle's manufacture date. And it vests the data in the owner or lessee, not the driver, so a person driving someone else's vehicle is not the person whose consent the statute contemplates.

The Five Retrieval Exceptions

Section 24302(b) states that EDR data "may not be accessed by a person other than an owner or a lessee of the motor vehicle" unless one of five conditions is met:

1. A court or other judicial or administrative authority having jurisdiction authorizes the retrieval, and any retrieved data is subject to that body's standards for admission into evidence
2. An owner or lessee gives written, electronic, or recorded audio consent "for any purpose, including the purpose of diagnosing, servicing, or repairing the motor vehicle, or by agreeing to a subscription that describes how data will be retrieved and used"
3. The data is retrieved in an investigation or inspection authorized under 49 U.S.C. 1131(a) or 30166, and the owner's or lessee's personally identifiable information and the VIN are not disclosed with it, except that the VIN may go to the certifying manufacturer
4. The data is retrieved to determine the need for, or facilitate, emergency medical response to a motor vehicle crash
5. The data is retrieved for traffic safety research, and the personally identifiable information of the owner or lessee and the VIN are not disclosed with it

The consent exception is broad. It accepts any of three forms, any purpose, and agreement to a subscription that describes retrieval and use. Section 24303 directed NHTSA to study how long EDRs should record and then to set that period by rule. Section 24302 itself contains no penalty, enforcement provision or private right of action.

NHTSA's Part 563 Standard

Part 563 is an "if equipped" standard. NHTSA's December 18, 2024 final rule describes it as applying "only to light vehicles required to have frontal air bags that a manufacturer chooses to voluntarily equip with EDRs." Under section 563.3 it covers passenger cars, multipurpose passenger vehicles, trucks and buses manufactured on or after September 1, 2012 with a GVWR of 8,500 pounds or less, if they have an EDR. Section 563.12 requires each manufacturer to ensure that a retrieval tool is commercially available no later than 90 days after the vehicle's first sale for purposes other than resale.

The 2024 rule answered section 24303. It extends the recording period for timed pre-crash data "from 5 seconds of pre-crash data at a frequency of 2 Hz to 20 seconds of pre-crash data at a frequency of 10 Hz." On petitions for reconsideration, NHTSA's May 18, 2026 final rule, effective June 17, 2026, replaced the original 2027 compliance date with a phase-in: 25 percent of a manufacturer's EDR-equipped production from September 1, 2028, 50 percent from September 1, 2029, 75 percent from September 1, 2030, and all vehicles from September 1, 2031. Small-volume and limited-line manufacturers have until September 1, 2032, and altered and multi-stage vehicles until September 1, 2033.

Privacy came up in both rulemakings. Commenters cited in the 2024 rule argued that 20 seconds would capture a significant amount of driver behavior. NHTSA's response was that EDRs "do not record personally identifiable data," that captured data are regularly overwritten except for trigger events, and that the Driver Privacy Act's ownership and access limits "should alleviate expressed privacy concerns." The 2026 rule repeats that position.

State EDR Statutes

For this post, EDR statutes were read on the legislatures' own websites for eight states: California, Maine, Montana, Nevada, New Hampshire, North Dakota, Oregon and Virginia. Pages for other states either did not render the statute text or were not located, so those states are not charted, and the table is not a census. All eight vest control in the owner and list exceptions, but they differ on who may retrieve data without consent and on insurers.

The statutes also differ in what they count. California, Maine, Nevada, New Hampshire and North Dakota define the device by function, listing speed, direction, location history, steering, braking, seat belt status and crash transmission. Montana and Oregon adopt the federal Part 563 definition as of a fixed date (October 1, 2011 for Montana, January 1, 2008 for Oregon). Virginia's "recording device" is the broadest: it names EDRs, sensing and diagnostic modules, electronic control modules, automatic crash notification systems, geographic information systems "and any other device that records and preserves data that can be accessed related to that vehicle." California, Nevada, New Hampshire and North Dakota also require the manufacturer to disclose the device in the owner's manual, and North Dakota requires dealers to note it in the purchase contract.

What These Laws Do Not Reach

Read together, the federal and state texts leave several categories outside their terms.

• Subscription telematics. California, Maine, Nevada, New Hampshire and North Dakota exempt subscription services from their retrieval limits once the recording or transmission is disclosed in the service agreement, and Oregon and Montana exclude data stored or transmitted under a subscription to record travel history or send data to a central communications system
• Audio, video and non-EDR modules. The federal definition excludes audio and video, and the Driver Privacy Act reaches only what Part 563 defines as an EDR. Virginia's broader device definition is the exception among the eight states read
• The driver who is not the owner. The federal statute and most state statutes vest control in the owner or lessee, so consent from that person can authorize access to data generated by someone else's driving
• Remedies. Section 24302 contains no enforcement mechanism of its own; of the state texts read, Nevada uses a misdemeanor, New Hampshire routes violations to its consumer protection act, and the others read set out no penalty in the sections charted

One adjacent federal rule applies to a different party. For telecommunications carriers, 47 U.S.C. § 222(f)(2) provides that a customer is not considered to have approved use or disclosure of "automatic crash notification information to any person other than for use in the operation of an automatic crash notification system" without express prior authorization.

Frequently Asked Questions