95% of new cars in circulation in 2026 are already connected and transfer personal data to manufacturers' servers without the driver having authorized it, according to a study by the Hermes Foundation. This situation affects both large cities like Barcelona, Girona, and Tarragona, as well as rural areas where privacy may be compromised.
Massive data collection in electric vehicles
Electric and connected vehicles collect detailed information about geolocation, biometrics, and driving habits. These data include GPS trajectories, facial recognition, and music listening patterns. In addition, calls made via Bluetooth can be monitored by the vehicle's system.
On rural roads in Soria, such as the A-15 or the N-111, recurrent routes with specific addresses can expose private residences to non-consented surveillance by insurers or advertisers. The collection of GPS trajectories and facial biometric data allows for the generation of medical profiles that can infer chronic diseases, treatments, or pregnancy, which constitutes a violation of the privacy of health data protected by the GDPR.
New European regulation and drivers' rights
Since September 2025, the EU Data Act obliges manufacturers to facilitate access to data collected by the car without limiting the basic functions of the vehicle. Owners can request a copy of their data on the brand's specific portals, a measure that seeks to reinforce users' control over their personal information.
In Soria, the GDPR is supervised by the Spanish Data Protection Agency. This entity recommends deleting data when changing ownership and limiting invasive geolocation to protect user privacy.
"Delete the data when changing owner, as well as limiting invasive geolocation" - Spokesperson, Spanish Data Protection Agency
DGT 3.0 and privacy protection on the roads
The entry into force of DGT 3.0 this year will represent an access point to information about what happens on roads and highways. This system will only track vehicles, avoiding the collection of personal biometric data. The protection of privacy remains a priority for authorities, especially in a context where technology advances faster than regulation.
The debate on the use and protection of personal data in the field of mobility remains open. Unconsented surveillance and the transfer of information without authorization pose legal and ethical challenges that affect both urban and rural drivers throughout Catalonia.