Fleet Tracking Regulations Explained: A Guide for Logistics Companies in France

Lawful fleet tracking in France must balance operational needs with employee privacy under GDPR/CNIL and EU tachograph rules.

1 October 20265 min read

Jurisdiction Scope

French employers and logistics operators, supplemented by EU rules applicable to vehicles and drivers within the EU road-transport regime.

Overview of Fleet Tracking Laws

Applicable Business Type

Logistics companies and road-freight operators using employee vehicles and legally required tachographs.

Country or Region

France (with applicable EU road-transport rules).

A compliance guide for French logistics businesses deploying vehicle geolocation and tachograph systems. It covers GDPR/CNIL limits on employee tracking, transparency and access rights, off-duty disabling, retention periods, and the separate EU tachograph framework governing drivers’ driving and rest times.

Legal Requirements Summary

French logistics companies may use fleet geolocation only for a defined, lawful and proportionate business purpose, with employee transparency, rights, off-duty privacy and strict retention controls. Continuous or private-time tracking is generally prohibited or excessive. Tachographs are governed separately by EU law for driving/rest-time compliance; access by an external connected device to personal data, including location data, requires verifiable driver consent. CNIL can sanction disproportionate geolocation practices.

Main Regulatory Topics

Data privacy and GDPR/CNIL compliance
Employee transparency and data-subject rights
Purpose limitation and data minimisation
Driver consent for tachograph-interface access
Off-duty and break-time privacy
Record-keeping and retention
Tachograph and driving/rest-time compliance
Regulatory enforcement and penalties

Key Compliance Obligations

Define a lawful, specific and proportionate purpose for geolocation and minimise the frequency, volume and granularity of collected data.
Inform drivers and employees about the controller, purposes, legal basis, recipients, retention period and applicable rights, including access and objection rights.
Do not use geolocation to monitor employees continuously, control speed-limit compliance, track representatives carrying out their mandate, or monitor private/off-duty travel.
Provide a means for employees to disable geolocation collection or transmission outside working hours and during breaks, where applicable.
Apply CNIL retention limits: normally 2 months, with documented exceptions of up to 1 year for route optimisation or proof of service and up to 5 years for working-time monitoring.
Allow employees to access and, where applicable, rectify data concerning them; provide information about the right to complain to CNIL.
Use tachograph data for the legally prescribed control of driving, rest and related road-transport obligations, and respect purpose limitation when reusing it.
Obtain verifiable driver consent before an external device connected to a tachograph interface accesses personal data, including geopositioning data.

Driver Consent Requirement

Consent Rule: Employee consent is not presented as a general prerequisite for an employer’s lawful fleet-geolocation system; the employer must have a lawful, proportionate purpose and inform employees. Employees must be able to disable collection outside working time. For an external device accessing personal data, including geopositioning data, through a tachograph interface, verifiable driver consent is required under Regulation (EU) 165/2014.

Data Retention Period

Minimum Retention: No single universal period: generally 2 months; up to 1 year for route optimisation or proof of service; up to 5 years for working-time monitoring, limited to relevant working-hours data. Specific legal requirements may provide otherwise.

Enforcement Authorities

Commission nationale de l’informatique et des libertés (CNIL), for personal-data and employee-monitoring compliance
French labour inspectorate and employment courts, for employee information, consultation and working-time/privacy issues
DREAL, DRIEAT or DEAL, for road-transport operator registration and transport-sector obligations
Other competent transport authorities and enforcement services where mandatory tachograph, driving-time or vehicle-monitoring rules apply

Penalties for Non-Compliance

Non-compliance can lead to CNIL corrective action and GDPR-related administrative fines, employee complaints and access/objection disputes, labour-inspection or employment litigation, and transport-sector enforcement consequences where operator, tachograph, driving-time or record-keeping obligations are breached. The exact sanction depends on the infringement, its seriousness, scale, duration, data volume and whether the organisation cooperated. French transport registration materials also identify criminal exposure for knowingly supplying false information in transport-registration investigations (up to two years’ imprisonment and a €30,000 fine).

Implementation Best Practices

Start with a written purpose-and-necessity assessment for every tracking feature. Configure geofencing, live views, driver scoring and historical reporting so that access and precision match the purpose; disable or mask tracking outside working hours; provide a driver-facing privacy notice and an easy privacy control; consult staff representatives before installation; define role-based access, retention and deletion rules; test supplier contracts, hosting and international transfers; and review the configuration periodically to ensure the system is not repurposed for excessive surveillance. Keep evidence of consultation, notices, lawful-basis assessment, access logs, deletion and driver requests.

Compliance Checklist

Define and document a specific lawful purpose for tracking, such as route optimisation, driver safety, theft prevention, proof of service, or a legal/regulatory transport obligation.
Apply necessity and proportionality: collect only the location and associated data needed for the stated purpose and avoid continuous employee surveillance where a less intrusive method is available.
Inform and, where applicable, consult employee representative bodies before deployment; give drivers clear prior information about the controller, purposes, data recipients, rights, and how to exercise them.
Provide a means for drivers to disable location collection or transmission outside working time and during breaks, particularly where a vehicle may be used privately.
Do not use tracking covertly for unrelated purposes such as real-time speed monitoring or generalised productivity surveillance.
Restrict access to authorised personnel, secure the tracking platform and transfers, and set a documented retention period proportionate to each purpose.
Enable access and rectification requests and maintain an audit trail of disclosures, configuration changes and privacy requests.
Check whether the vehicle or goods being transported trigger separate mandatory transport-monitoring requirements; retain the required transport and tachograph records separately from optional telematics data.
Document the processing in the GDPR records of processing activities and carry out a data-protection impact assessment where the scale, systematic monitoring or risk profile warrants one.

Industry-Specific Guidance

A French logistics company may have strong operational reasons to track trucks and vans—dispatch, delivery proof, route optimisation, theft recovery and compliance with transport obligations—but those reasons do not create a blanket right to monitor drivers continuously. Tracking data linked to a named driver is personal data. Drivers must be told about the system before it is installed, and employee representative bodies must be consulted where required. A driver must be able to stop location collection outside working time or during breaks, especially for an assigned vehicle used privately. Use separate controls and retention schedules for mandatory transport records (for example, records required by road-transport or tachograph rules) and optional fleet analytics. Subcontracted or agency drivers should receive the relevant notice directly or through a clearly documented allocation of responsibilities.

Recent Legal Updates

On 30 June 2026 the CNIL published a recommendation on location data from connected vehicles. It emphasises a valid legal basis, data minimisation, limited retention and security, but expressly says that employer-provided company vehicles used by employees are outside that recommendation because existing employee-geolocation guidance applies. CNIL’s current employee-monitoring guidance also stresses that permanent surveillance is generally excessive and that a less intrusive method must be considered. Review the tracking policy against these 2026 materials and monitor CNIL, Légifrance and French transport-authority updates for changes affecting road freight and tachographs.

Authoritative Resources

CNIL — professional-vehicle geolocation guidance
CNIL — employee activity monitoring guidance
CNIL Recommendation on connected-vehicle location data (30 June 2026)
Légifrance — CNIL Deliberation 2015-165 (former simplified standard No. 51)
French Transport Code and DREAL/DRIEAT/DEAL transport registers