Logistics and distribution
Driver data privacy laws by state: a fleet owner's guide
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Driver privacy laws by state fall into four groups a fleet owner should map: biometric privacy laws, audio recording consent rules, employer monitoring notice laws and comprehensive consumer privacy laws. The working rule is to list where drivers are based and where trucks run, then test every data source against each group before monitoring data is reused or licensed.
Key takeaways
- No single federal law settles driver monitoring, so fleets that cross state lines face a patchwork of state rules.
- Driver-facing cameras with face analysis and in-cab audio carry the most state-law exposure; engine and lane-level trip data usually carry the least.
- A monitoring notice written for safety and coaching does not automatically cover reusing the same data for analytics or AI licensing.
- California's privacy law reaches employee data, while most other state comprehensive privacy laws exclude employee and business-contact data.
- Vehicle ownership matters: company tractors, lease-purchase units and owner-operator equipment raise different consent questions.
Which state laws apply to driver monitoring data?#
Driver monitoring data is governed by a patchwork of state laws rather than one federal privacy statute, so the answer depends on where drivers are employed, where vehicles operate and which sensors are installed. Four law types do most of the work: biometric privacy laws, recording consent laws, employer monitoring notice laws and comprehensive consumer privacy laws.
Federal law sets only a floor. The federal wiretap statute generally allows a recording when one party to the conversation consents, and the federal ELD rule records location at reduced precision and bars carriers from using ELD data to harass drivers. Neither answers whether monitoring data can be reused for analytics or licensed.
For a general counsel, the useful first step is an inventory of data sources rather than a list of statutes. Each source triggers different law types, and one truck can generate several of them on a single trip.
- GPS and telematics: location pings, speed, harsh braking, idle time and geofence events from platforms such as Samsara.
- ELD records: duty status, driving time, edits and annotations, and the location stamp attached to each change.
- Road-facing dashcam video: event clips triggered by braking or impact, often showing other motorists, plates and pedestrians.
- Driver-facing cameras: video of the cab, sometimes paired with fatigue or distraction alerts based on face or eye analysis.
- In-cab audio: microphones on cameras or tablets, plus recorded calls between drivers and dispatch.
- Driver apps and fuel cards: phone location, photos of paperwork, messages to dispatch and transaction records.
State-by-state table: biometrics, cab audio, notice and employee rights#
The state table below compares the four questions that most often decide driver data exposure: biometric privacy, consent for cab audio, employer monitoring notice and employee privacy rights. It shows where each state's main exposure sits, not the detailed requirements, which change and need a current reading by counsel.
Treat the last column as a list of open questions. A state missing from the table is not a state without rules; privacy torts, tracking-device statutes and newer comprehensive privacy laws can apply in narrower situations, and legislatures keep adding to the list.
| State | Biometric law | Cab audio consent | Monitoring notice and employee rights | Verify with counsel |
|---|---|---|---|---|
| Illinois | Biometric Information Privacy Act (BIPA): written policy, notice and written release; individuals can sue | All-party consent for private conversations | No general monitoring notice statute; BIPA governs biometrics | Whether fatigue or ID features capture face geometry, and whether the vendor or the fleet collects it |
| Texas | Biometric identifier law: notice and consent before capture; enforced by the attorney general | One-party consent | No general monitoring notice statute; the state privacy act excludes employment-context data | Consent records for face analysis and destruction of biometric data once its purpose ends |
| Washington | Biometric identifier law; enforced by the attorney general | All-party consent for private conversations | No general monitoring notice statute; the My Health My Data Act covers consumer health data | Whether fatigue scoring of non-employee drivers counts as health data; how audio consent is shown |
| California | No BIPA-style statute; biometric data is sensitive personal information under the CCPA | All-party consent for confidential communications | The CCPA covers employees: notice at collection and rights to know, delete, correct and limit sensitive data use | Notices for telematics and cameras, purpose limits, rights requests and tracking of driver-owned vehicles |
| New York | No BIPA-style statewide statute | One-party consent | Notice at hire with an acknowledgment and a posted notice, for monitoring of phone, email and internet use | Whether telematics apps and in-cab tablets fall within the notice law; acknowledgments from long-tenured drivers |
| New Jersey | No BIPA-style statute; the New Jersey Data Privacy Act treats biometric data as sensitive data | One-party consent | Written notice before an employer uses a tracking device in a vehicle an employee uses; the privacy act excludes employment-context data | Notice records for each tracked vehicle and the scope of the tracking law's exceptions |
| Connecticut | The Connecticut Data Privacy Act lists biometric data among sensitive data | Mixed: recorded phone calls need all-party consent under civil law | Prior written notice of electronic monitoring plus a posted notice; broad definition of monitoring | Whether the notice names telematics and cameras; how the privacy act treats owner-operators |
| Delaware | Delaware's comprehensive privacy act includes biometric data in its sensitive data definition | Statutes conflict, so many counsel treat audio cautiously | Notice for monitoring of phone, email and internet use, with an acknowledgment or a daily notice | Whether telematics or app monitoring falls within the notice law |
| Florida, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania | Varies; check any comprehensive privacy law for biometric terms | All-party consent | Not the main exposure; confirm current law | Whether cab audio is a private conversation and how every speaker's consent is shown |
Does GPS tracking of drivers need consent or notice?#
GPS tracking of drivers usually turns on two facts: who owns the vehicle, and whether the state requires employers to give notice of electronic monitoring. Tracking a company-owned tractor during working hours is generally the simplest case; tracking a driver's personal phone or an owner-operator's own truck needs more care.
Some states restrict placing a tracking device on a vehicle without the owner's consent, which is why equipment ownership belongs in the inventory. Lease-purchase programs and leased-on owner-operators blur that line, and the lease may say who controls the telematics unit and its data.
Monitoring notice laws differ in scope. New York and Delaware focus on monitoring of phone, email and internet use, Connecticut defines electronic monitoring broadly, and New Jersey requires written notice before an employer uses a tracking device in a vehicle an employee drives. Check that your notice names telematics, cameras and apps specifically, and that drivers hired before the policy changed received the current version.
Off-duty location is a common gap. Personal conveyance, team drivers resting in the sleeper and trucks taken home all generate data outside working time, and that data is the hardest to justify keeping or reusing.
Where dashcams and in-cab audio create the most exposure#
Dashcams create the most exposure when they point at the driver or record sound. Road-facing video mainly raises questions about bystanders and other motorists, while driver-facing video and audio raise biometric, recording consent and workplace privacy questions at once.
Audio is the sharpest edge. In all-party consent states, recording a conversation in the cab may require consent from everyone speaking, including a co-driver or rider, and the analysis can shift when a truck crosses a state line mid-trip. Some fleets disable audio by default and enable it only for event clips, a choice that still needs review in each operating state.
Fatigue and distraction features deserve a separate review. If a camera measures eye closure or head position, counsel should decide whether the feature captures face geometry or similar identifiers under BIPA, the Texas biometric law or Washington's law, and whether the camera vendor or the fleet is the party collecting it. BIPA matters most because individuals can sue under it, while the Texas and Washington laws are enforced by the attorney general.
What changes when fleet data is licensed for AI?#
Licensing fleet data for AI is a new purpose, and state privacy analysis is largely purpose-driven. A notice telling drivers that cameras exist for safety and coaching does not automatically cover sharing clips or trip histories with an AI developer, even under a license that leaves the fleet owner in control of the records.
California is the outlier on employee data. Its employee and B2B exemptions, first adopted in 2019, expired on January 1, 2023 under the California Privacy Rights Act, and the comprehensive laws passed in Colorado, Connecticut, Utah and Virginia by then did not apply to employment-context data. Newer statutes need their own reading of the consumer definition.
Comprehensive state privacy laws add four questions. Does the law apply at all, given thresholds tied to how many consumers' data the company processes or how much revenue comes from selling data? Does it exclude employee and business-contact data, as most laws outside California do? Does a license meet its definition of a sale? And does de-identified data fall outside it, usually on conditions such as a public commitment not to re-identify and contract limits on the recipient?
Several state laws treat precise geolocation as sensitive data. Where such a law applies, raw GPS traces linked to a person can require opt-in consent, which is a strong reason to aggregate locations to lanes, regions or facilities before any licensing discussion.
| Data source | Typical treatment before a license | Why |
|---|---|---|
| Trip and lane history | Aggregate to lanes or facilities; remove driver IDs and home locations | Precise geolocation can be sensitive data |
| ELD duty status | Strip names and driver numbers; keep event sequences | Shows operations without pointing to a person |
| Dispatch and exception notes | Redact names, phone numbers and personal remarks | Often the most useful text, and practical to clean |
| Road-facing video | Excluded unless faces and plates are blurred and counsel approves | Captures bystanders who never received notice |
| Driver-facing video | Excluded by default | Biometric and workplace privacy exposure |
| In-cab audio | Excluded by default | Recording consent rules vary by state |
Illustrative: a regional carrier maps its driver data#
Illustrative: a fictional regional truckload carrier runs company tractors from terminals in Illinois, Indiana and Ohio. It uses telematics, road-facing and driver-facing cameras, a driver app, and a TMS that holds dispatch and exception notes. A model developer has asked about licensing its operational records.
Counsel builds the source inventory first. The Illinois trucks run fatigue alerts based on eye tracking, and the cameras can capture audio during events. Longer-tenured drivers signed a monitoring acknowledgment that mentions GPS but not cameras. Several owner-operators are leased on with their own tractors and telematics units.
The carrier excludes all driver-facing video, all audio and all owner-operator equipment data. Trip histories are aggregated to lane level, ELD sequences lose names and driver numbers, and dispatch notes are redacted. It also reissues its monitoring notice to current drivers. The package is narrower than first imagined, but every remaining record has a basis counsel signed off on.
How SourceX handles driver data in a license#
SourceX treats driver data as a Rights and Preparation question inside the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The fit check collects only metadata, such as which systems hold driver records and which states the fleet runs in, so nothing about an individual driver is shared during the initial assessment.
If a package proceeds, the SourceX Evidence Packet records which sources were excluded, how locations and identifiers were treated, and which state-law questions the supplier's counsel reviewed. Driver-facing video and cab audio are usually the first sources a supplier excludes, and the supplier approves the final release.
Frequently asked questions
Do driver privacy rules differ for owner-operators?
Often, yes. An owner-operator leased to a carrier may own the tractor and the telematics unit and is usually not an employee, so employee monitoring notices may not fit, and some state privacy acts exclude people acting in a commercial context. Read the lease for clauses on equipment data, then have counsel decide which privacy and tracking rules apply to that relationship.
Is ELD data personal information?
Usually, yes, while the records carry a driver's name or number and location stamps. Once names, driver numbers and precise locations are removed and the remaining sequences cannot reasonably be linked back to a person, they may fall under de-identified data rules. Whether a given dataset meets that standard is a deal-by-deal question for counsel.
Can we rely on the monitoring consent drivers signed at hire?
Only if it covers the purpose. Hiring documents typically describe safety, compliance and coaching. Reusing data for analytics or AI licensing is a different purpose, so check the wording, each state's notice requirements and whether drivers hired under older forms ever received the current version.
How long should a fleet keep camera footage and GPS history?
Keep each record only as long as a documented purpose requires, such as claims defense, safety coaching or regulatory retention, and apply legal holds when litigation is likely. Shorter retention for video and audio reduces privacy exposure. Some driver records have federal minimums: 49 CFR 391.51 requires a driver qualification file to be kept while the driver is employed and for three years after. Set the schedule with counsel and your insurer, since claims timelines and state rules differ.
What if a truck crosses into a stricter state mid-trip?
Many counsel prefer to treat the strictest state on regular routes as the baseline for features like audio and face analysis, rather than switching settings at state lines. Lighter settings can then be considered for routes that never leave one state. Document the decision so the reasoning survives staff turnover.
Sources
- The CCPA employee and B2B exemptions were first adopted in October 2019 via AB 25, and the California Privacy Rights Act set the sunset date for both at January 1, 2023. Source
- The other comprehensive state privacy laws then enacted (Colorado, Connecticut, Utah and Virginia) do not apply to employment-context data. Source
- 49 CFR 391.51(c) requires each driver qualification file to be retained for as long as the carrier employs the driver and for three years thereafter. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.