GRS Fleet Telematics

Fleet Tracking Regulations Explained: A Guide for Courier Businesses in France

Guide for French courier fleets on CNIL/GDPR geolocation rules: purposes, retention, employee rights and off-duty limits.

5 min read

Jurisdiction Scope

France; rules concern employee vehicles and workplace geolocation under CNIL guidance

Overview of Fleet Tracking Laws

Applicable Business Type

Courier businesses and employers operating vehicles used by employees in France

Country or Region

France

A France-focused compliance guide for courier businesses using vehicle geolocation to manage deliveries, routes and service evidence. It covers GDPR/CNIL transparency, proportionality, employee privacy, permitted purposes, retention limits, access and objection rights, and safeguards against continuous or off-duty tracking.

Legal Requirements Summary

Courier employers in France must use vehicle geolocation only for legitimate, necessary and proportionate purposes, provide prior employee and workforce-representative information/consultation, respect access and objection rights, and prevent off-duty or continuous tracking. Location data should generally be deleted after 2 months, with limited documented extensions to 1 year or 5 years for specified purposes. CNIL has treated continuous recording without a way to suspend tracking during breaks as potentially excessive.

Main Regulatory Topics

  • Data privacy and GDPR/CNIL compliance
  • Employee transparency and information rights
  • Employee representative consultation
  • Driver/employee objection and off-duty privacy
  • Data retention and record-keeping
  • Purpose limitation and proportionality
  • Real-time and continuous tracking restrictions
  • Route optimisation and delivery proof
  • Working-time monitoring
  • CNIL enforcement

Key Compliance Obligations

  • Define and document a lawful, specific and proportionate purpose for geolocation, such as route optimisation or proving delivery/service performance where necessary.
  • Inform employees before installation about the controller, purposes, legal basis, recipients, retention period and their rights.
  • Inform or consult employee representative bodies before deciding to install the system.
  • Limit retention to 2 months as the general rule; apply the documented exceptions for route optimisation/service proof or working-time monitoring.
  • Allow employees to disable location collection or transmission outside working time, including breaks and private use where applicable.
  • Provide access to recorded personal location data and respect legitimate objections.
  • Do not use geolocation to continuously monitor employees, enforce speed limits, track off-duty travel, or monitor employee representatives during their mandate.
  • Do not use geolocation to calculate working time where another system already exists.

Driver Consent Requirement

Consent Rule: Prior individual information is required, but general prior employee consent is not stated as a prerequisite. Employees must be told the controller, purposes, legal basis, recipients, retention period and applicable rights; they may object on legitimate grounds and must be able to disable location collection or transmission outside working time. Employee representative bodies must be informed or consulted before implementation.

Data Retention Period

Minimum Retention: 2 months in principle; up to 1 year for route optimisation or proof of service where no alternative exists, and 5 years for working-time monitoring

Enforcement Authorities

  • CNIL (Commission nationale de l’informatique et des libertés) — primary data-protection supervisory and enforcement authority.
  • French labour authorities and employee representative bodies — relevant to workplace information, consultation and employment-monitoring compliance.
  • Courts and other competent French authorities — potentially relevant where tracking data is used in disputes or where sectoral transport obligations apply.

Penalties for Non-Compliance

Non-compliance can lead to CNIL corrective measures, orders to stop or modify processing, deletion or restriction of data, reputational and employment disputes, and GDPR administrative fines. A reported French vehicle-geolocation enforcement case resulted in a €125,000 GDPR fine and a €25,000 fine under Article 82 of the French Data Protection Act; the amount in any case depends on the infringement, scale, duration, cooperation and circumstances. Illegally obtained tracking data may also be challenged in employee or commercial disputes.

Implementation Best Practices

Carry out a documented GDPR proportionality assessment before installation, map each courier use case to a separate purpose and legal basis, and configure the platform to collect the least precise/frequent data needed. Use role-based access, strong authentication, encryption, audit logs and supplier/data-processing agreements. Provide drivers with a concise written notice and an easy off-duty disablement method; publish the full policy permanently on the intranet or in the internal rules. Automate retention and deletion, review configurations periodically, and keep evidence of consultation, training, rights requests, incidents and vendor due diligence. For customer-facing or connected-vehicle features, obtain any required user consent separately and do not enable continuous location by default unless strictly necessary for the requested service.

Compliance Checklist

  1. Define and document a lawful, specific purpose for tracking, such as coordinating deliveries, proving a delivery/service, protecting drivers, goods or vehicles, or meeting a legal/regulatory obligation.
  2. Select and document an appropriate GDPR legal basis; do not treat employee consent as a blanket substitute for a lawful and proportionate employment monitoring arrangement.
  3. Inform drivers before deployment about the controller, purposes, legal basis, data recipients, retention, rights and how to complain to the CNIL.
  4. Inform and consult employee representative bodies before deciding to install the system, where applicable.
  5. Configure tracking proportionately: do not use it for permanent employee surveillance, speed-limit compliance monitoring, or calculating working time where another system is available.
  6. Disable collection/transmission outside working time, including commuting and breaks; provide a practical driver control or deactivation function.
  7. Set retention by purpose: normally no more than two months; up to one year for route optimisation or proof of service where no alternative exists; up to five years for working-time monitoring where legally justified.
  8. Restrict access, authenticate users and secure live dashboards and stored location data.
  9. Enable access, rectification, objection/limitation and other applicable GDPR rights, and maintain records of processing, contracts and security controls.

Industry-Specific Guidance

For a French courier business, live location can generally be justified for dispatching and allocating deliveries, protecting couriers/parcels/vehicles, and proving or billing a delivery service when the data is necessary and proportionate. It should not become a general productivity-surveillance tool: CNIL guidance prohibits permanent monitoring, speed-limit enforcement, off-duty tracking and duplicate working-time measurement. Courier drivers should receive the notice directly, including agency or subcontracted personnel where the business determines the processing; contracts and operational procedures should clearly allocate controller/processor responsibilities. If vehicles are used privately, tracking must stop during personal use. Customer-facing tracking links and connected-vehicle services require a separate analysis of customer consent, transparency and purpose limitation under the GDPR and French Data Protection Act.

Recent Legal Updates

As of 10 October 2026, CNIL’s June 2026 recommendation on location data from connected vehicles is a key recent resource. It reiterates prior information/consent and GDPR purpose-limitation principles for connected-vehicle location data, including that processing based on consent for one purpose cannot simply be reused for a new purpose. Separately, France’s 30 April 2025 DDADUE law introduced Transport Code Articles L.1513-2 and L.1513-3 concerning holders/users of road-traffic and road-safety data, with implementing rules still relevant to businesses that fall within those categories; these provisions are not a general mandate requiring courier fleets to track employees.

Authoritative Resources

Related Blog Posts

Talk to GRS

Tell us about your fleet.

Get a package recommendation, transparent pricing and a practical deployment route.

Book a demoView resources