Connected Vehicles & Vehicle Telematics in Law Enforcement
How modern vehicles create, store, transmit, and preserve digital evidence through infotainment systems, embedded telematics, event data recorders, navigation systems, paired devices, manufacturer cloud services, connected-vehicle applications, and other onboard computers—and what investigators should understand about warrants, privacy, location history, authentication, preservation, discovery, and governance.
What this explainer does
A modern vehicle can be simultaneously a transportation platform, networked computer, location sensor, communications hub, crash recorder, mobile-device accessory, and cloud-connected service.
That means an investigation involving a vehicle may produce several fundamentally different categories of digital evidence. Some information may be stored physically inside the vehicle. Some may be transmitted to the manufacturer or a connected-service provider. Some may be copied from a driver's phone. Some may record only seconds around a crash; other records may reveal routes, destinations, devices, accounts, or patterns extending well beyond the incident.
The central investigative question is not simply “what data does the car have?” It is: what system created the information, where is it stored, who controls it, what does it actually prove, and what legal authority permits access?
Connected-vehicle evidence is no longer confined to a traditional crash “black box.” Current vehicles may create detailed records across infotainment modules, navigation systems, telematics units, cloud services, companion applications, and manufacturer platforms.
In May 2026, California announced a $12.75 million privacy settlement with General Motors arising from allegations involving the sale of consumer geolocation and driving-behavior data. The enforcement action illustrates an important investigative fact: vehicle-generated data may exist far beyond the physical vehicle.
1. Overview
Modern vehicles can retain digital evidence that is qualitatively different from the mechanical evidence investigators traditionally obtained from automobiles.
A vehicle may generate data about speed, braking, steering, crash dynamics, navigation, GPS position, route history, destinations, paired phones, device identifiers, contacts, calls, messages, media, Wi-Fi connections, Bluetooth relationships, system events, diagnostic conditions, door activity, charging, remote commands, and connected-service use. The exact information varies dramatically by manufacturer, model, year, configuration, subscription, module, software version, and forensic method.
Investigators should therefore resist describing all electronic vehicle evidence as “black-box data.” An event data recorder, infotainment system, telematics control unit, manufacturer cloud account, and companion application can be legally and technically distinct evidence sources.
2. The Connected-Vehicle Data Ecosystem
Infotainment, telematics, navigation, body-control, powertrain, airbag, and other electronic modules may contain locally stored information.
Connected-service platforms may receive information from the vehicle and retain account, location, diagnostic, command, safety, or usage records.
Smartphone applications may permit remote start, locking, charging, vehicle location, trip review, account management, and other connected functions.
Bluetooth, USB, CarPlay, Android Auto, or other integrations may cause vehicle systems to receive or retain device identifiers and user information.
Mapping, insurance, fleet, charging, roadside-assistance, rental, finance, advertising, or analytics providers may create separate records.
Traditional crash reconstruction and mechanical evidence remain important and should be integrated with—not displaced by—digital records.
3. Major Categories of Vehicle-Generated Evidence
| Source | Potential Information | Important Limitation |
|---|---|---|
| Event Data Recorder / Airbag Control Module | Crash-related speed, braking, throttle, restraint, delta-V, deployment, and other model-specific data | Typically event-focused and limited in duration; not equivalent to long-term trip history |
| Infotainment System | Navigation, destinations, GPS records, paired devices, call/contact artifacts, media, system events | Capabilities vary greatly by make, model, year, module, firmware, and forensic support |
| Telematics Control Unit | Vehicle connectivity, emergency events, GPS-related records, network activity, remote-service interactions | Some information may be stored locally; other information may exist only with a provider |
| OEM Connected-Service Platform | Account records, vehicle status, location-related data, diagnostics, remote-command history, subscription records | Retention and legal-process procedures are provider-specific |
| Companion Application | Vehicle locations, account data, charging, trip, remote-control, notification, and authentication artifacts | Evidence may exist on the phone, in the cloud, or both |
| Paired Mobile Device Artifacts | Bluetooth identifiers, contacts, call information, messages, device names, connection history | A record showing pairing does not automatically establish who physically possessed the phone or vehicle |
| Fleet / Rental / Insurance / Charging Services | Trip, location, transaction, charging, driver, diagnostic, or account information | Records are controlled by separate businesses and may implicate separate statutes or contracts |
4. Infotainment Systems Can Be Digital-Evidence Repositories
The center display is only the visible interface. Behind it may be a computer that stores information created by the vehicle and information copied from connected devices.
Specialized forensic systems can extract supported data from some vehicle infotainment modules. Publicly reported and litigated examples show that vehicle data can include GPS positions, calculated or recorded movement information, navigation history, paired-device information, and other artifacts.
In People v. Pierce, a 2025 California Court of Appeal decision, law enforcement used BERLA hardware and software to retrieve infotainment data from a Ford Mustang. The opinion describes records including vehicle bearing, GPS location, distance traveled, and calculated speed in one-second intervals. The data was used with other evidence in a vehicular-homicide prosecution.
5. Telematics and Manufacturer Cloud Data
A telematics system connects the vehicle with outside networks and services. Depending on the vehicle and service, the system may support emergency assistance, crash notification, remote diagnostics, stolen-vehicle assistance, remote locking or starting, navigation, software updates, charging, account services, and other functions.
Connected-service architecture means that evidence can be created or transmitted without remaining solely inside the vehicle. The manufacturer or service provider may possess records that are unavailable through a physical forensic extraction.
Some platforms may receive current or historical vehicle-location information, subject to provider design and retention.
Account or system records may document remote start, lock, unlock, charging, or other commands.
Automatic collision notification or emergency-service systems may generate event, time, location, and communications records.
Vehicle health, fault, mileage, battery, charging, maintenance, or operational information may be transmitted.
Subscriber identity, contact information, service enrollment, billing, devices, and authentication records may exist.
Provider-side timestamps, access logs, request history, and metadata may assist authentication and reconstruction.
6. Event Data Recorders Are Different
An event data recorder is principally a crash-event evidence source—not a general synonym for all electronic information generated by a vehicle.
NHTSA describes an EDR as a device that records technical vehicle and occupant information for a brief period before, during, and after a crash. Depending on the system and applicable federal requirements, information can include pre-crash dynamics, driver inputs, crash characteristics, restraint use or deployment, and related data.
Federal regulation at 49 C.F.R. Part 563 standardizes specified elements, formats, capture requirements, survivability, and retrieval for covered EDRs. NHTSA's regulations have evolved; a 2024 final rule increased required pre-crash recording duration for covered future systems from 5 seconds at 2 Hz to 20 seconds at 10 Hz, with later agency action addressing compliance timing and phase-in.
7. Paired Phones Can Leave Evidence Behind
Drivers and passengers routinely connect smartphones to vehicles through Bluetooth, USB, CarPlay, Android Auto, or manufacturer systems. Depending on the implementation, the vehicle may receive or store contacts, call information, device names, identifiers, messages, media information, or connection history.
The Ninth Circuit's 2023 decision in Jones v. Ford Motor Co. arose from civil privacy claims, not a police search. The allegations nevertheless illustrate the forensic issue: the plaintiffs alleged that Ford infotainment systems copied and retained call logs and text messages from connected phones and that specialized Berla technology could access information stored on vehicle memory.
8. A Defensible Connected-Vehicle Investigation
9. Fourth Amendment Framework
Connected-vehicle evidence sits at the intersection of traditional automobile doctrine and the Supreme Court's modern digital-privacy cases.
The automobile exception
Under longstanding doctrine, officers with probable cause may in appropriate circumstances conduct a warrantless search of a vehicle and containers within it capable of containing the object of the search. That doctrine developed around physical automobiles and physical evidence.
The digital-evidence problem
Riley v. California rejected automatic application of ordinary physical-search rules to the extraordinary quantity and quality of information stored on a smartphone. Carpenter v. United States recognized Fourth Amendment protection for the extensive historical CSLI at issue there. United States v. Jones addressed GPS tracking of a vehicle through physical installation and use of a tracking device.
These cases do not establish a single nationwide rule for every connected-car search. They do establish why investigators should be cautious about assuming that digital information stored in or generated by a vehicle receives no protection simply because the hardware happens to be inside an automobile.
10. State v. Worsham: Warrant Required for EDR Download
In State v. Worsham, 227 So. 3d 602 (Fla. Dist. Ct. App. 2017), officers downloaded information from the event data recorder of an impounded vehicle without first obtaining a warrant. The vehicle had been involved in a fatal crash and had been impounded for approximately twelve days before the download.
Florida's Fourth District Court of Appeal held that the driver had a reasonable expectation of privacy in the information retained by the recorder and that, absent exigent circumstances, the warrantless extraction violated the Fourth Amendment.
The court distinguished electronic data from mechanical features such as brakes or tires, emphasizing that the information was not exposed to public observation and required specialized extraction and interpretation.
11. Mobley v. State: A Second Warning from a State High Court
In Mobley v. State, 307 Ga. 59, 834 S.E.2d 785 (2019), officers responding to a fatal collision downloaded airbag-control-module data from the vehicles at the scene without a warrant. The data showed that Mobley's Dodge Charger had been traveling nearly 100 miles per hour shortly before the collision.
The Georgia Supreme Court reversed the judgment upholding admission of the evidence because the State had not established inevitable discovery or another applicable exception. The opinion's procedural posture requires care: it should not be overstated as a categorical U.S. Supreme Court rule governing every EDR download.
12. Vehicle Location Data Raises a Separate Privacy Question
Connected vehicles can generate location information in several ways: onboard navigation, embedded GPS, telematics, manufacturer services, companion applications, paired devices, fleet platforms, and third-party services.
The constitutional significance of vehicle-location information can depend on how it was obtained and how much it reveals. United States v. Jones involved physical installation and use of a GPS tracker by the government. Carpenter addressed extensive historical CSLI held by a wireless carrier. In June 2026, Chatrie v. United States held that law-enforcement acquisition of a user's Google Location History constitutes a Fourth Amendment search even when the period obtained was only two hours.
None of those decisions mechanically resolves every OEM telematics request. Together, however, they reinforce a broader principle: highly revealing digital location information should not be treated as constitutionally trivial merely because it was created by a commercial technology platform.
13. Federal Driver Privacy Act and Event Data Recorders
The federal Driver Privacy Act of 2015 establishes specific protections for event data recorder information. As incorporated into federal motor-vehicle law, data retained by an EDR is treated as the property of the vehicle owner or, for a leased vehicle, the lessee.
The Act restricts access by others unless one of specified circumstances applies, including authorization by a court or other authority with jurisdiction, owner or lessee consent, specified federal safety investigations, emergency medical response, or qualifying traffic safety research.
14. California Adds Its Own Vehicle-Data Rules
California Vehicle Code § 9951
California Vehicle Code § 9951 addresses manufacturer-installed recording devices used to retrieve specified information after an accident. The statute requires disclosure in the owner's manual and generally restricts retrieval by a person other than the registered owner except under enumerated circumstances, including owner consent or a court order.
The statutory definition includes devices that can record speed and direction, travel history, steering, braking, seatbelt status, or transmit accident information to a central communications system.
Connected-vehicle service protections
California has also enacted connected-vehicle-service provisions addressing account access and privacy in specified circumstances. Vehicle Code § 28226, operative in 2025, requires covered providers to protect specified driver information and expressly preserves a provider's ability to respond to a court order or warrant.
2026 General Motors privacy enforcement
On May 8, 2026, California officials announced a proposed $12.75 million settlement with General Motors over allegations that GM sold names, contact information, geolocation data, and driving-behavior data collected through connected services to data brokers. The settlement included restrictions on use and sale of driving data.
15. Drafting a Connected-Vehicle Warrant
Particularity improves when the affidavit describes the technology instead of merely asking to search “all computers in the vehicle.”
Include VIN, make, model, year, plate, ownership or possession facts, and connection to the investigation.
Specify infotainment, navigation, telematics, EDR, airbag control module, or other modules when known.
State what categories may exist and why they are relevant to the offense.
Limit location, route, communication, or event records to a defensible period where feasible.
Explain whether investigators seek identifiers only or substantive communications copied from mobile devices.
Describe why extraction may require specialized hardware, software, disassembly, imaging, or off-site examination.
16. Accuracy, Meaning, and Interpretation
Digital vehicle data can appear precise while still requiring careful interpretation. A GPS coordinate can be precise numerically but inaccurate physically. A calculated speed may be derived from positional data rather than measured by a wheel sensor. A timestamp may reflect UTC, local time, a system clock, a network clock, or an unsynchronized module.
Determine timezone, clock source, drift, resets, software behavior, and synchronization before correlating records.
A label in forensic software may summarize a manufacturer-specific field. Preserve technical documentation and examiner interpretation.
Distinguish sensor measurements from values computed by forensic software or derived from GPS observations.
Vehicle data identifies systems and events; it may not identify the human who performed an action.
Absence of a record may mean no event occurred—or that the system did not record, retain, transmit, or support extraction of it.
Forensic extraction tools can change over time, and later software may interpret or recover information differently.
17. Preservation Can Be Time Sensitive
Vehicle information can be overwritten, altered by ordinary use, lost during repair, changed by software updates, deleted when devices are unpaired, or unavailable after a provider retention period expires.
Investigators should evaluate whether operating the vehicle, powering modules, disconnecting batteries, pairing devices, entering navigation functions, towing, servicing, or updating software may affect evidence. Digital-forensics personnel should be consulted when the evidentiary value is significant and module behavior is uncertain.
18. Authentication, Discovery, and Evidentiary Use
Connected-vehicle evidence should be treated as digital evidence with a complete provenance record. The agency should be able to explain where the information came from, how it was acquired, whether acquisition altered source data, what software and hardware were used, how the data was interpreted, and how derivative reports or maps were created.
| Evidence Component | Questions to Preserve |
|---|---|
| Source vehicle / module | What exact hardware generated or stored the record? |
| Forensic acquisition | Who acquired it, when, with what tool, software version, cable, adapter, or method? |
| Raw export | Was the original output preserved separately from investigator-created reports? |
| Provider production | What custodian, certification, legend, metadata, or business-record information accompanied the production? |
| Interpretive report | Which conclusions are direct records and which are examiner calculations or inferences? |
| Maps / visualizations | What coordinates, basemaps, assumptions, transformations, and software produced the display? |
| Corroboration | How do ALPR, BWC, surveillance video, phone records, witnesses, crash evidence, or other sources compare? |
19. Governance Framework for Connected-Vehicle Evidence
Define when warrants, court orders, provider process, consent, or exigency may be used for onboard and cloud records.
Establish who may acquire vehicle data and what training, validation, and documentation are required.
Record supported vehicles, software versions, known limitations, validation results, and changes affecting interpretation.
Limit acquisition and retention of unrelated communications, locations, contacts, and non-target device information.
Maintain current legal-process contacts, preservation procedures, production legends, and provider-specific requirements.
Track physical modules, forensic images, exports, cloud productions, and derivative analytical products.
Define what raw, derivative, validation, and interpretive materials are preserved for prosecutorial and defense disclosure.
Address passengers, paired non-target phones, historical locations, unrelated contacts, and data obtained from commercial or manufacturer sources.
Reassess policy as vehicles, forensic tools, provider architecture, consumer privacy law, and Fourth Amendment doctrine change.
20. Questions Every Agency Should Be Able to Answer
21. What Comes Next
Vehicle functions increasingly rely on manufacturer accounts, subscriptions, applications, and remote services.
Advanced driver-assistance and automated-driving systems can create new sensor, state, intervention, and decision records.
Exterior and interior cameras, radar, lidar, ultrasonic systems, and driver monitoring may expand evidentiary sources.
Location, immobilization, access, charging, remote commands, and software-defined features will increase provider-side evidence.
Consumer privacy regulators are increasingly scrutinizing how manufacturers collect, use, share, minimize, and monetize connected-vehicle information.
Courts will continue deciding how automobile doctrine applies when the “container” being searched is a sophisticated computer storing detailed digital history.
22. Key Terms
25. Key Takeaways
- A connected vehicle is a network of computers, sensors, modules, mobile-device relationships, cloud services, and third-party systems—not a single “black box.”
- Event data recorders are principally crash-event systems and should be distinguished from infotainment, navigation, telematics, and cloud records.
- Infotainment systems may contain GPS, navigation, paired-device, communications, and other evidence depending on the vehicle and forensic support.
- Provider-held telematics information may exist even when the same information cannot be extracted from the physical vehicle.
- Paired-phone artifacts can identify relationships between devices and vehicles but do not automatically prove who was driving or using a device.
- Worsham and Mobley demonstrate the litigation risk associated with warrantless extraction of vehicle digital data.
- Riley, Carpenter, Jones, and Chatrie provide the broader constitutional context for evaluating digital and location evidence.
- The federal Driver Privacy Act and 49 C.F.R. Part 563 create specific rules relevant to event data recorders.
- California Vehicle Code § 9951 independently regulates retrieval of specified manufacturer-installed recording-device data.
- The 2026 GM privacy settlement illustrates that connected-vehicle location and driving-behavior data can flow into commercial data ecosystems far beyond the car.
- Warrant drafting should identify the vehicle, system, data categories, time period, forensic method, and nexus to the investigation.
- Precise-looking data still requires interpretation: timestamps, GPS accuracy, calculated values, software support, and human attribution must be validated.
- Agencies should preserve raw exports, provider productions, examiner notes, software/version information, technical documentation, and derivative analytical products.
- The governing question should be: which system created this vehicle information, where is it now, what does it actually establish, and what legal authority permits us to obtain and use it?