Vehicle GPS tracking privacy laws work in three layers: the Fourth Amendment limits what police can do, state criminal statutes limit what private individuals can do, and a growing body of federal consumer protection law limits what manufacturers, lenders, and rental companies can do with the location data your car already generates. Where you fit in depends on who is doing the tracking and what kind of device or data is involved.
When Police Can Track Your Car
Law enforcement generally needs a warrant supported by probable cause before attaching a GPS device to your vehicle. The Supreme Court settled that in United States v. Jones (2012), holding that physically installing a tracker on a private vehicle to monitor its movements is a “search” under the Fourth Amendment.1Legal Information Institute. United States v Jones The FBI in that case had left a tracker on a suspect’s car for nearly a month without a valid warrant, and the Court treated the physical intrusion on a privately owned “effect” as enough to trigger constitutional protection.
Six years later, Carpenter v. United States (2018) extended the same logic to digital location records, ruling that the government needs a warrant to access historical cell-site location information from a wireless carrier.2Legal Information Institute. Carpenter v United States The Court described comprehensive digital location records as “detailed, encyclopedic, and effortlessly compiled,” and rejected the idea that people surrender privacy just by carrying a phone. That reasoning strongly suggests that historical vehicle telematics data held by an automaker gets the same protection: an officer who wants your car’s location history from a manufacturer’s servers almost certainly needs a warrant rather than a subpoena.
Federal warrants for GPS trackers run on tight timelines. The statute authorizes courts to issue warrants for “mobile tracking devices,” defined as any electronic or mechanical device that permits tracking a person or object’s movement.3Office of the Law Revision Counsel. 18 USC 3117 – Mobile Tracking Devices Under Federal Rule of Criminal Procedure 41, officers must complete the physical installation within 10 calendar days of the warrant’s issuance, and total tracking cannot exceed 45 days. A court can grant extensions for good cause, but each extension is also capped at 45 days. Evidence gathered outside the authorized window is vulnerable to suppression at trial.
When a Private Person Tracks Your Car
At least 26 states and the District of Columbia have statutes that specifically address installing or using a tracking device on another person’s property without consent. The details vary, but they fall into two broad approaches. Some states criminalize GPS tracking only when it is part of a pattern of stalking or harassment, requiring prosecutors to prove a “course of conduct.” Others make the unauthorized installation itself the crime, regardless of intent.
Penalties range from fines of a few hundred dollars up to about $5,000, and misdemeanor or felony classification depends on the jurisdiction and the circumstances. Repeat offenses, or tracking tied to stalking or domestic violence, generally carry steeper penalties and potential jail time. Victims can also often bring civil suits for invasion of privacy, seeking damages for emotional distress and attorney fees.
Most statutes carve out exceptions:
- Vehicle owners can generally track a car they hold title to, even if someone else is driving it.
- Parents and guardians can often place trackers on a minor child’s vehicle, though shared-custody rules vary.
- Law enforcement officers acting under a valid warrant are exempt.
- Some states allow licensed private investigators to use trackers on a lawful case.
These exceptions are narrower in practice than they look. A co-owner tracking an estranged spouse’s car may have an argument; someone who hides a device on an ex-partner’s vehicle almost certainly does not. The dividing line between “monitoring my property” and “stalking another person” is where most of these cases turn.
When Your Employer Tracks a Vehicle You Drive
Employers stand on solid ground when they track company-owned vehicles. Courts recognize a legitimate business interest in knowing where company assets are and how they are being used, and an employee driving a company truck has a reduced expectation of privacy in its location, particularly during work hours.
Several states still require written notice before an employer activates electronic monitoring, including GPS tracking. Notice statutes typically require a clear written disclosure to employees and a posted notice in the workplace. Skipping this step can lead to administrative fines and gives employees a stronger position if they later challenge the tracking.
Two situations get complicated. Round-the-clock tracking that continues after work hours captures where an employee attends church, which doctor they visit, and where they spend the night. Courts and regulators increasingly view that as overreach without a clear business justification. Tracking on a personal vehicle or a personal phone raises the bar further: explicit consent becomes essential, and a policy buried in an employee handbook may not be enough.
When a Lender Tracks or Disables Your Car
Subprime auto lenders often install GPS trackers and “starter interrupt” devices on financed vehicles. A starter interrupt device lets the lender remotely prevent the car from starting if a payment is missed, effectively immobilizing the vehicle without physical repossession. The same hardware feeds continuous location data used to find cars for repossession.
The Consumer Financial Protection Bureau has flagged undisclosed GPS tracking in the repossession context as a potential unfair or deceptive practice under federal consumer financial law, particularly when a borrower does not know the device exists or when the tracking causes harm the borrower cannot reasonably avoid.4Consumer Financial Protection Bureau. Bulletin 2022-04 – Mitigating Harm From Repossession of Automobiles Misrepresenting the nature or extent of the tracking can independently qualify as deception. The FTC notes that whether remotely disabling a vehicle counts as a “repossession” or a “breach of the peace” depends on the loan contract and state law.5Federal Trade Commission. Vehicle Repossession
State rules on starter interrupt devices vary widely. Some states treat remote disabling as the legal equivalent of repossession, which triggers notice and right-to-cure requirements. Others require lenders to obtain separate written consent for the device and to disclose exactly how it will be used. A handful of states treat kill switches as an unfair collection practice. If you financed a car and see unfamiliar hardware near the dashboard or steering column, the loan documents should say whether a tracking or interrupt device was installed and when the lender can activate it.
When a Rental Company Tracks You
Rental companies tested the limits of GPS tracking early, particularly by charging speeding surcharges based on location data. Courts and state legislatures pushed back. One state supreme court struck down a $150 GPS-based speeding fee as an illegal penalty rather than a legitimate damage charge, and ordered refunds. Several states have since passed laws prohibiting rental companies from using GPS data to impose any fees or penalties tied to how a renter drives.
The emerging consensus permits rental companies to use GPS only in narrow circumstances: recovering a car reported stolen to law enforcement, locating a vehicle significantly overdue for return, and providing navigation or roadside assistance when the renter opts in. Some states require written notice of GPS capabilities before the rental agreement is signed and explicit consent for any tracking beyond theft recovery. A rental company using location data to charge you for how you drove is on shaky legal ground in most of the country.
What Your Own Car Collects and Shares
Modern vehicles contain event data recorders that capture speed, braking, and steering input in the seconds around a crash. Under the Driver Privacy Act of 2015, that data belongs to the vehicle’s owner or lessee, and accessing it generally requires the owner’s consent or a court order.6Office of the Law Revision Counsel. 49 USC 30101 – Purpose and Policy Police, insurers, and crash investigators cannot simply download it.
Telematics services are governed by contract rather than a single statute. When you activate a connected-vehicle service, you agree to privacy terms describing what data is collected, how it is used, and who sees it. Manufacturers use the data for remote diagnostics, navigation, emergency response, and usage-based insurance. The legal obligation on the manufacturer’s side is disclosure. Most connected vehicles include a privacy or data menu in the infotainment system where you can adjust location settings, though turning off location may also disable features like automatic crash notification.
The larger issue is what happens to the data your car generates on its own. Vehicle telematics information flows to insurers, ad-tech firms, data brokers, and analytics companies that package driving behavior into consumer profiles. In January 2026, the FTC finalized a consent order against General Motors and OnStar for collecting and selling drivers’ precise geolocation and driving behavior data without informed consent.7Federal Trade Commission. FTC Finalizes Order Settling Allegations That GM and OnStar Collected and Sold Geolocation Data Without Consumers Informed Consent The FTC alleged that GM used a misleading enrollment process to sign drivers up for its “Smart Driver” feature, which harvested detailed data and sold it to third parties, including consumer reporting agencies. The order imposes a five-year ban on sharing geolocation and driver behavior data with consumer reporting agencies. For the full 20-year term, GM must obtain affirmative express consent before collecting or sharing connected vehicle data, let consumers request copies of their data and have it deleted, and provide a way to disable geolocation collection entirely.
The FTC treats vehicle geolocation data the way it treats cell phone location data: inherently sensitive and subject to heightened protection.8Federal Trade Commission. Cars and Consumer Data – On Unlawful Collection and Use Collecting or disclosing it without meaningful consent can violate the FTC Act’s prohibition on unfair practices, and feeding it into automated decision-making systems compounds the harm.
What You Can Do Right Now
Check whether your vehicle’s connected services are active and review the data-sharing permissions you have granted. Open the privacy or data menu in the infotainment system and adjust location settings to the level you want. Opt out of any usage-based insurance or “smart driver” program that shares location or driving behavior with third parties you did not knowingly approve. If you financed the car, look through your loan documents for any disclosure of a GPS tracker or starter interrupt device. And if you suspect someone has placed a tracker on your car without your consent, your state’s stalking, harassment, or dedicated tracking statute is where the criminal remedy lives, and a civil invasion-of-privacy claim may run alongside it.