If your car was built in the last decade or so, it almost certainly has an event data recorder, and federal law treats the information on that black box as your property. You own the data. No one else can pull it off the vehicle without your consent or a court order, with a short list of narrow exceptions written into federal statute. That is the core of the black box in car rules, and everything else — what gets recorded, how long it survives, how it shows up in court — flows from those two ideas.
Over 95 percent of new passenger vehicles now come with an EDR installed, though no federal law actually requires manufacturers to include one. What federal law does require is that any vehicle equipped with a recorder follows the standards in 49 CFR Part 563, which govern what the device captures and how outsiders can retrieve it.1Cornell Law Institute. 49 CFR Part 563 – Event Data Recorders Those rules apply to passenger cars and light trucks with a gross vehicle weight rating of 10,000 pounds or less, manufactured on or after September 1, 2012.
What the Black Box Records
An EDR is an incident recorder, not a surveillance device. It activates only when a crash event triggers it. During that event and in the seconds leading up to it, the federal standard requires it to capture a defined set of measurements:
- Vehicle speed in the moments before the crash
- Throttle position — how far the accelerator was pressed
- Brake status — whether the service brakes were applied
- Steering input
- Delta-V, the change in velocity during impact, which measures how severe the crash was
- Front airbag deployment timing
- Seatbelt status for the driver and front passenger
Pre-crash data covers up to five seconds before the triggering event, depending on the element.1Cornell Law Institute. 49 CFR Part 563 – Event Data Recorders That short window is what makes EDR data so valuable in crash reconstruction: it shows whether a driver was braking, accelerating, or doing nothing at all before impact.
Just as important is what an EDR does not record. No audio. No video. No GPS location. No data at all during normal driving. If someone tells you the black box has been tracking your movements, they’re describing a telematics system, not an EDR.
The data doesn’t always survive, either. When an airbag deploys, the recorded data locks and cannot be overwritten. In a minor collision where the airbags don’t fire, the data from that non-deployment event can be overwritten the next time the system triggers. There is no cloud backup. The information lives on a chip inside the vehicle’s airbag control module, and physical access to that module is the only way to retrieve it.
Who Owns the Data
Federal law is unambiguous. Section 24302 of the FAST Act, enacted in December 2015, declares that any data retained by an event data recorder is the property of the vehicle’s owner or, for a leased vehicle, the lessee.2Office of the Law Revision Counsel. 49 USC 30101 – Purpose and Policy – Section 24302: Limitations on Data Retrieval From Vehicle Event Data Recorders This applies regardless of when the vehicle was manufactured. A manufacturer, dealer, or software provider cannot claim ownership just because their systems generated or stored the information.
Ownership carries teeth. Unauthorized retrieval is a violation of federal law, and the same statute that establishes ownership also spells out every situation where someone else is allowed to pull the data.
Who Can Legally Access Your Black Box Data
Federal law lists exactly five situations where someone other than the owner or lessee can retrieve EDR data:2Office of the Law Revision Counsel. 49 USC 30101 – Purpose and Policy – Section 24302: Limitations on Data Retrieval From Vehicle Event Data Recorders
- A court order or other judicial authority authorizes the retrieval, and the resulting data is subject to that court’s rules of evidence.
- The owner or lessee gives consent in writing, electronically, or through recorded audio. Consent can be for any purpose, including diagnostics, repair, or a subscription service that describes how the data will be used.
- NHTSA or the National Transportation Safety Board retrieves the data as part of a federal safety investigation. They cannot disclose personally identifiable information or the vehicle identification number, except to the manufacturer.
- Data is pulled to determine whether emergency medical response is needed after a crash.
- Traffic safety researchers access the data, again with personal information and the VIN kept confidential.
Insurance companies are not on that list. An insurer has no independent federal right to your EDR data. They need your written consent or a court order, and this is where most people give away leverage without realizing it. When an adjuster asks to “pull the data from your car’s computer,” they are asking you to consent voluntarily. You are not obligated to agree, and once you hand the data over you lose control of how it gets interpreted.
State Laws Can Go Further
Roughly fifteen states have enacted their own EDR statutes on top of the federal framework. They tend to address three areas.
Some require disclosure — that buyers be told, in writing or through the owner’s manual, that a vehicle contains an EDR before a sale or lease is finalized. Some narrow the access exceptions further, limiting EDR use to specific purposes like vehicle safety improvement and prohibiting its use to adjust insurance premiums. And some make unauthorized access a criminal offense, classifying it as a misdemeanor with fines and jail time of up to eighteen months. If you are dealing with a dispute over EDR access, your state’s specific law matters as much as the federal rule.
Preserving the Data After a Crash
The moment a crash ends, the clock starts on your EDR data. If the airbags didn’t deploy, the recording can be overwritten the next time the system triggers. If the vehicle is totaled and sent to a salvage yard, the data goes with it when the car is crushed. Insurance companies sometimes move quickly to scrap a totaled vehicle, especially when their own policyholder may be at fault.
The practical steps are simple. Don’t let the vehicle be repaired, scrapped, or sold before the data is downloaded. Tell the tow company and any repair shop in writing that the vehicle must be preserved. If you’re considering legal action, an attorney can file a formal preservation request or court motion that creates a legal obligation to keep the vehicle intact. A professional EDR download typically runs a few hundred to roughly a thousand dollars, and the industry-standard tool for the job is the Bosch Crash Data Retrieval system, which law enforcement, researchers, and manufacturers have used since 2000. The federal regulation prohibits proprietary data formats, so any qualified technician with the right tool can read the file regardless of the vehicle’s make.
Black Box Data in Court
Courts have consistently allowed properly retrieved EDR data as evidence in both criminal and civil cases, provided the party introducing it establishes a foundation for reliability. That foundation typically involves testimony from a qualified technician explaining how the data was extracted and confirming the hardware was functioning correctly.
Courts have also declined to treat EDR data as irrefutable. Judges and juries weigh it against other evidence, and appellate courts have reversed decisions that relied on black box data as though it conclusively settled a factual dispute. The data shows what the vehicle’s sensors measured. Whether those measurements tell the whole story of what happened is a question for the finder of fact.
If you’re in litigation where EDR data matters, the retrieval process needs to be clean: a certified technician, a documented chain of custody, and a formal report accompanying the raw data. Extractions done without proper authorization or using uncertified tools can face challenges.
Telematics Is a Separate Question
The rules above cover event data recorders. They do not fully cover the broader data streams from modern connected vehicles. Telematics systems can store GPS location history, speed logs, driver assistance activity, Bluetooth connection records, call logs, and navigation routes, and unlike an EDR they can collect continuously during normal driving. Whether the federal EDR privacy framework in Section 24302 covers those streams is an evolving legal question. Many manufacturers collect telematics data under subscription terms of service, which counts as owner consent under federal law. If your vehicle has an active telematics subscription, read the terms — you may have already agreed to data sharing that goes well beyond what a traditional black box captures.
Commercial Trucks Are Governed Differently
If your question involves a commercial truck or bus, a separate rulebook applies. Since December 2017, most commercial motor vehicles have been required to use Electronic Logging Devices under 49 CFR Part 395, which track a driver’s hours of service, duty status, and driving time.3eCFR. 49 CFR Part 395 – Hours of Service of Drivers An ELD is a compliance tool, not a crash recorder. A commercial truck may have both an ELD and an EDR, serving different purposes: the EDR captures pre-crash and impact data like a passenger car’s black box, while the ELD shows whether the driver was complying with federal rest requirements. Motor carriers must retain ELD records for at least six months.