GRS Fleet Telematics

Fleet Tracking Regulations Explained: A Guide for Delivery Firms in France

Explains France-specific rules for employer GPS tracking, GDPR and CNIL obligations, tachograph changes and retention limits.

5 min read

Jurisdiction Scope

French national law and CNIL guidance; EU tachograph requirements apply where the vehicle and operation fall within the applicable road-transport rules.

Overview of Fleet Tracking Laws

Applicable Business Type

Delivery firms and other businesses operating commercial vehicles with employee drivers in France.

Country or Region

France

A France-specific compliance guide for delivery firms using vehicle geolocation and, where applicable, tachographs. It explains lawful purposes, employee transparency, data minimisation, off-duty privacy, retention, access rights, tachograph-data safeguards, enforcement and practical implementation.

Legal Requirements Summary

French delivery firms must treat driver and vehicle location as personal-data processing subject to GDPR and French data-protection rules. Tracking must have a defined lawful purpose, be proportionate and transparent, and respect drivers' private time. Employee representatives must be consulted before deployment and drivers must receive individual information; off-duty collection must be stoppable. Location records are normally limited to 2 months, with narrowly defined longer periods. Where tachographs apply, their data must be used and protected for road-transport compliance purposes rather than repurposed for unrelated surveillance. CNIL can investigate and sanction excessive or unlawful tracking; a cited vehicle-tracking case resulted in total fines of €150,000.

Main Regulatory Topics

  • Data Privacy
  • GDPR and French Data-Protection Law
  • Employee Information and Consultation
  • Driver Consent and Off-Duty Controls
  • Data Minimisation
  • Record-Keeping and Retention
  • Installation and Configuration Standards
  • Real-Time Tracking
  • Tachograph Compliance
  • CNIL Enforcement and Penalties

Key Compliance Obligations

  • Define and document a lawful, specific purpose for geolocation, such as vehicle security, invoicing, route optimisation or proof of intervention.
  • Consult employee representative bodies before deciding to install tracking in employee vehicles.
  • Give each affected driver clear information about the controller, legal basis, purpose, recipients, retention period and data-protection rights.
  • Do not use tracking for continuous employee surveillance, monitoring speed-limit compliance, tracking outside working time, or calculating working time where another system is available.
  • Provide a mechanism for drivers to disable location collection or transmission during breaks and other non-working periods.
  • Apply data minimisation: configure tracking frequency, accuracy and activation only to what the stated purpose requires.
  • Retain location data only for the applicable period: normally 2 months, with limited 1-year or 5-year exceptions.
  • Enable access and rectification rights and provide a route for complaints to the CNIL.
  • Keep tachograph-related personal data protected against uses unrelated to verifying tachograph and driving/rest-time compliance.
  • Use secure processors and documented contracts where a tracking provider processes the data on the firm's behalf.

Driver Consent Requirement

Consent Rule: Prior employee consent is not presented as a general prerequisite for a lawful employer fleet-tracking system. Before installation, the employer must inform and consult employee representatives and individually inform each driver about the controller, legal basis, purposes, recipients, retention and rights. Drivers must be able to disable collection or transmission outside working time, and may object where legal conditions are not met. Separate user consent can be required for connected-vehicle/location processing based on consent under French data-protection rules.

Data Retention Period

Minimum Retention: Generally no more than 2 months; up to 1 year for route optimisation or proof of completed interventions where no alternative proof exists; up to 5 years when used to monitor working time.

Enforcement Authorities

  • Commission nationale de l’informatique et des libertés (CNIL), France’s data protection authority
  • French labour and employment authorities and courts for employment/privacy obligations
  • National road-transport enforcement authorities and roadside inspection bodies for driving-time, rest-time and tachograph compliance

Penalties for Non-Compliance

Non-compliance can lead to CNIL corrective measures, including orders to comply, daily penalty payments, formal warnings and administrative fines. CNIL’s simplified procedure can impose a fine of up to €20,000 and an injunction with a penalty of up to €100 per day; GDPR fines can be substantially higher depending on the infringement and circumstances. In a vehicle-tracking case, the CNIL imposed €100,000 for GDPR breaches and €25,000 under France’s Data Protection Act. Separate transport-law breaches may result in roadside enforcement, infringement proceedings and sanctions relating to driving/rest times or tachograph records; the exact amount depends on the breach and applicable French/EU rules.

Implementation Best Practices

Carry out a documented purpose-and-necessity assessment before deployment, separating operational GPS functions from legally required tachograph functions. Use configurable geofencing and working-hours controls so location is paused outside work, provide a driver-facing privacy notice and accessible rights process, maintain role-based access and audit logs, and schedule retention/deletion automatically by purpose. Consult representatives and the DPO early, record the processing, test the disable function, and train dispatchers and drivers. For cross-border LCV delivery, classify each vehicle and route by permitted mass and countries visited, install/calibrate tachographs through an appropriate workshop, issue cards, train drivers, and automate regular downloads, archiving and exception reviews.

Compliance Checklist

  1. Define and document lawful, specific purposes for tracking; do not use geolocation as general or continuous employee surveillance.
  2. Inform and, where applicable, consult employee representative bodies before implementation.
  3. Give every driver clear pre-installation privacy information covering purposes, data categories, retention, recipients and individual rights.
  4. Allow drivers to disable or suspend location collection outside working time, including breaks and private use; monitor only misuse of the disabling function where justified.
  5. Restrict access to authorised personnel and secure live-tracking accounts with strong authentication and appropriate access controls.
  6. Limit disclosure to clients or principals to what is necessary; do not normally disclose the driver’s name.
  7. Record the processing in the employer’s GDPR record of processing activities and involve the DPO where one exists.
  8. Set retention by purpose: generally no more than two months; up to one year for route optimisation or proof of service where necessary; up to five years where used for working-time monitoring.
  9. For international freight with an LCV over 2.5 tonnes and up to 3.5 tonnes from 1 July 2026, assess tachograph scope, fit a compliant device where required, obtain company and driver cards, train drivers, and download/archive vehicle and driver data on schedule.
  10. For covered international operations, apply EU driving/rest-time rules and retain tachograph data for at least the applicable statutory period; do not assume a standard fleet GPS tracker replaces a tachograph.

Industry-Specific Guidance

French delivery firms may use vehicle tracking for purposes such as route optimisation, dispatch, proof of service and, where justified, working-time monitoring, but continuous tracking must be proportionate. Drivers must be able to stop collection outside working time, and customers should receive only necessary information. A delivery company operating solely within France must distinguish ordinary GPS fleet management from tachograph obligations. From 1 July 2026, international or cabotage freight using vehicles over 2.5 tonnes and up to 3.5 tonnes falls within the EU driving/rest-time and tachograph regime; this is especially relevant to express, last-mile and mixed fleets crossing borders. The 2026 tachograph change does not automatically impose the same requirement on purely domestic French delivery operations, so route, vehicle mass, trailer and operation type must be assessed individually.

Recent Legal Updates

The principal 2026 update is the extension, from 1 July 2026, of EU driving/rest-time and tachograph requirements to light commercial vehicles over 2.5 tonnes and up to 3.5 tonnes engaged in international transport or cabotage. Covered delivery operators must use a compliant tachograph, use company and driver cards, train drivers, and manage downloads and archives. The change is operation-specific: it does not generally make tachographs mandatory for vans conducting only domestic French transport. CNIL’s core employee-geolocation principles remain applicable: prior transparency, proportionality, off-duty disablement and purpose-limited retention.

Authoritative Resources

Related Blog Posts

Talk to GRS

Tell us about your fleet.

Get a package recommendation, transparent pricing and a practical deployment route.

Book a demoView resources