Federal Law Says the Crash Data in Your Car Is Yours. It Does Not Say Anyone Has to Hand It to You.
The short version. Two federal instruments govern the black box in your car and they do two different jobs that get merged constantly. One regulates the recorder and requires a reading tool to exist on the market. The other says the data belongs to you and nobody else may take it without a reason from a list of five. Put together they produce an odd result: you own the data, a tool to read it must be commercially available, and nothing federal obliges anyone to give you the readout.
First, it may not be there at all
49 CFR § 563.3 sets out what the rule covers: passenger cars, multipurpose passenger vehicles, trucks and buses built on or after 1 September 2012, under 3,855 kg gross and 2,495 kg unloaded, if they are equipped with an event data recorder.
That conditional is the whole of it. Part 563 says what an EDR must record and how, once a manufacturer has fitted one. It does not require anyone to fit one. "Federal law requires your car to have a black box" is not what the rule says.
Second, the tool has to exist
§ 563.12 is one sentence and worth reading closely:
Each manufacturer of a motor vehicle equipped with an EDR shall ensure by licensing agreement or other means that a tool(s) is commercially available that is capable of accessing and retrieving the data stored in the EDR that are required by this part.
The tool must be commercially available not later than 90 days after the first sale of the vehicle for purposes other than resale.
Read what the duty attaches to. It attaches to a tool being commercially available. It says nothing about what the tool costs, who may buy it, what training or credential the seller may require, or whether the vehicle owner is among the people who can obtain one. A manufacturer that licenses a tool to a scan-tool company which sells it at a professional price, to professionals, has satisfied § 563.12.
Third, the owner's manual tells you who reads it, and it is not you
§ 563.11(a) prescribes a statement that has to appear, in English, in the owner's manual of every covered vehicle. It discloses the recorder, lists what it captures, and says no personal data such as name, gender, age or crash location is recorded. Then it says this:
In addition to the vehicle manufacturer, other parties, such as law enforcement, that have the special equipment, can read the information if they have access to the vehicle or the EDR.
The manufacturer and law enforcement are named. The person who owns the car is not in the sentence. That is not an oversight in the drafting; it is an accurate description of who, in practice, has the equipment.
Fourth, the data is legally yours
The Driver Privacy Act of 2015 is not in the Code of Federal Regulations. It sits as a note to 49 U.S.C. § 30101, from Public Law 114-94.
Section 24302(a) is unambiguous. Data retained by an event data recorder, regardless of when the vehicle was manufactured, is the property of the owner, or of the lessee if the vehicle is leased. Not the manufacturer's, not the insurer's, not the finance company's.
Section 24302(b) then says that data may not be accessed by anyone other than the owner or lessee unless one of five things is true.
| # | The exception | What it actually requires |
|---|---|---|
| 1 | Court or administrative authority | A court or other judicial or administrative authority with jurisdiction authorises retrieval, and any data retrieved is subject to that body's rules of evidence |
| 2 | Your consent | Written, electronic, or recorded audio consent from the owner or lessee, for any purpose including diagnosing, servicing or repairing the vehicle, or by agreeing to a subscription that describes how data will be retrieved and used |
| 3 | A federal safety investigation | Under 49 U.S.C. § 1131(a) or § 30166, with your personally identifying information and the VIN withheld, except that the VIN may go to the certifying manufacturer |
| 4 | Emergency medical response | Retrieval to determine the need for, or to facilitate, emergency medical response to a crash |
| 5 | Traffic safety research | With personally identifying information and the VIN withheld |
Two of those are worth stopping on.
Exception 2 is the one your repair shop operates under. If a shop pulls EDR data while diagnosing or repairing your car, it is doing so on your consent, and the statute names the acceptable forms: written, electronic, or recorded audio. A shrug in the reception area is not one of them.
Exception 2 also contains a subscription clause. Agreeing to a subscription that describes how data will be retrieved and used is consent under this statute. Connected-car services are how a great deal of vehicle data now moves, and the consent for it was given at sign-up.
The gap, stated plainly
Ownership and access are separate rights, and federal law gives you one of them.
You own the data. You can consent to its retrieval or withhold consent. What you do not have, from any federal provision, is a right to be handed a tool, a readout, or a price at which either is available to you. § 563.12's duty is discharged when a tool exists on the market.
In practice that means getting your own crash data usually runs through somebody who already has the equipment: a collision repairer with a retrieval tool, an independent accident reconstruction firm, or a lawyer who retains one. All of them are acting under exception 2, on your consent, which is the part of this you do control.
What we are not saying
We are not saying federal law gives you a right to your EDR data. It gives you ownership of it and a veto over most retrieval by others. Those are real and they are not the same as a right to a readout.
We are not saying your car has an EDR. Part 563 governs vehicles that are equipped with one. Whether yours is, and what it records beyond the required elements, is a vehicle-specific question and the owner's manual statement is where to start.
We are not describing state law or your policy. Several states legislate on EDR access and an insurance policy may have terms of its own. Neither is covered here.
We are not telling you a shop pulling your data has done anything wrong. Exception 2 makes that lawful on your consent. The point is that it is consent, and consent has a required form.
If you need the data after a crash
Start with the owner's manual. The § 563.11(a) statement tells you whether the vehicle has an EDR and what it is designed to record.
Say who you are consenting to, and in what form. Written, electronic, or recorded audio are the forms the statute names. Consent given to one party for one purpose is not consent given to everyone.
Ask before the car moves. Access to the data generally means access to the vehicle or to the recorder itself, which is a problem once a total loss has gone to a salvage buyer.
If someone else wants your data, they need a route from the list. A request from an insurer or another driver's representative is not one of the five exceptions on its own. Your consent is the route they are asking for.
Sources
- 49 CFR Part 563, Event Data Recorders, sections 563.3, 563.11(a) and 563.12, read in full on 18 August 2026 from the Electronic Code of Federal Regulations.
- Driver Privacy Act of 2015, Public Law 114-94, division B, title XXIV, subtitle C, part I, sections 24301 to 24303, 4 December 2015, 129 Stat. 1712, published as a note to 49 U.S.C. § 30101 and read in full on 18 August 2026 from the Office of the Law Revision Counsel's United States Code site.
- Scan reports: what they prove
- How to read a repair estimate
- ADAS calibration explained
- When insurance will not pay for a proper repair
General consumer information: not legal, insurance, or financial advice. Requirements, coverage, and practices vary by state, policy, and manufacturer.
Cite this dataset
This dataset is published under Creative Commons Attribution 4.0. You may republish it, including commercially, in whole or in part. The licence asks one thing in return: credit the source and link to it. Copy the line below.
"Who may read the crash data in your car, under federal law", The Autobody Directory (Quorum Industries LLC), 2026. Licensed CC BY 4.0. https://theautobodydirectory.com/guides/who-can-read-your-cars-crash-data
- Page to cite and link: https://theautobodydirectory.com/guides/who-can-read-your-cars-crash-data
- Machine-readable copy: https://theautobodydirectory.com/api/register/edr-access.json
- Questions, corrections, or a figure you want checked before you publish it: see Press. We would rather be corrected than cited wrongly.