If you rent vehicles to California residents, the California Consumer Privacy Act (CCPA, as amended by the CPRA) may apply to you. Whether it does depends on your size and on how you use renter data. Either way, a rental counter collects exactly the data privacy law cares about: driver's licenses, payment cards, addresses and vehicle locations. This guide explains who must comply, what to disclose, how to answer consumer requests, and how to set retention rules you can defend.
TL;DR
- The CCPA covers for-profit businesses that do business in California and meet a revenue or data-volume threshold. Check the thresholds before you assume you are in or out.
- Give renters a notice at collection and a current privacy policy. Both must say what you collect, why, and how long you keep it.
- Consumer requests have fixed clocks: confirm receipt within 10 business days, respond within 45 days, and stop selling or sharing within 15 business days of an opt-out.
- Treat licenses, payment data and vehicle location as your highest-risk data. Write retention periods for each category and enforce them.
- A single system of record for reservations, contracts, payments and customer data makes every one of these tasks faster.
Table of Contents
Does the CCPA apply to your rental company?
The CCPA applies to a for-profit business that does business in California, collects consumers' personal information (or has it collected for it), decides why and how that information is processed, and meets at least one threshold. Under Civil Code § 1798.140, the thresholds are:
- Annual gross revenue above $25,000,000, as adjusted.
- Buying, selling or sharing the personal information of 100,000 or more consumers or households per year.
- Earning 50% or more of annual revenue from selling or sharing consumers' personal information.
The revenue test looks at the preceding calendar year and is measured as of January 1, as Jackson Lewis explains.
Most small independent operators will not meet the revenue test. Do not stop there, though. A regional operator with several locations, an airport presence and a booking website can reach 100,000 consumers or households faster than you would expect once you count website visitors and marketing audiences whose data is shared with ad platforms. The California Privacy Protection Agency (CPPA) publishes a short self-assessment built around questions such as whether you collect or receive consumers' personal information and whether you do business in California.
Two practical points:
- Out-of-state companies are not automatically outside the law. If you rent to California residents, deliver vehicles to California, or operate a location there, you do business in California.
- Corporate groups count together. The statute's definition of a business also reaches an entity that controls or is controlled by a covered business and shares common branding with it. If you run several rental brands under one owner and share customer data between them, plan compliance at group level. For background on handling data that moves between related companies, see this overview of secure business data sharing.
Even if you are under every threshold today, build the habits now. Growth, an acquisition or a new franchise partner can push you over, and corporate customers and insurers increasingly ask rental suppliers how they handle personal data.
What renter data you hold, and why it matters
A rental transaction collects more personal information than most retail sales. Published privacy notices from large US rental and car-sharing brands list the same families of data again and again: names, addresses, phone numbers and email, driver's license numbers and jurisdiction, passport details for international renters, payment card information, insurance details, rental history, call recordings, photos taken at the counter, and vehicle location. One major brand's California notice, for example, lists geolocation data such as booking, rental and return locations and vehicle geolocation alongside government ID and financial information.
Map your own data before you write any notice. A useful inventory has four columns:
| Data category | Where it enters | Where it lives | Who else receives it |
|---|
| Identity and contact details | Online booking, counter, phone | Reservation system, CRM | Payment processor, insurer |
| Driver's license and ID | Counter scan, upload | Customer record, contract | Background check provider |
| Payment data | Checkout, counter terminal | Payment gateway | Processor, bank |
| Vehicle location and driving data | GPS or telematics unit | Tracking platform | GPS vendor |
| Marketing and web data | Website, email, ads | Analytics, email tool | Ad platforms |
The last row is where "sharing" problems usually start. The CCPA's concept of sharing covers disclosing personal information for cross-context behavioral advertising, so pixels and ad tags on your booking page belong in the inventory.
The statute defines a category of sensitive personal information that includes government identifiers such as driver's license numbers, account credentials and precise geolocation. Rental operators hold all three. Under § 1798.121, consumers can direct a business to limit use of sensitive personal information to what is necessary to provide the goods or services an average consumer would reasonably expect. If you use this data only to complete rentals, verify identity, process payments and recover vehicles, that is the expected use. If you use it for anything else, such as profiling or marketing, you owe a notice and a right to limit.
Notice at collection and your privacy policy
These are two different documents, and rental companies often have only one of them.
The notice at collection must reach the renter at or before the point where you collect data. According to the CCPA text and regulations, it covers, at a minimum:
- the categories of personal information collected, including sensitive categories
- the purposes for collecting and using each category
- whether each category is sold or shared
- how long you intend to keep each category, or the criteria you use to decide
- a link to opt-out rights if you sell or share, and a link to your privacy policy
For a rental business, "at or before collection" means the booking form, the mobile app sign-up, the counter tablet or paper contract, and any page where a license photo is uploaded. Put the notice link on each of them.
The privacy policy is the fuller document. Among other items, the regulations require a general description of how you verify consumer requests, an explanation of how you process opt-out preference signals, instructions for authorized agents, contact information for privacy questions, and a last-updated date.
A short checklist for a rental privacy policy:
- Name the categories of data in the language of the statute, then add rental-specific examples such as license scans, telematics location and damage photos.
- List the sources: the renter, payment processors, background check or license verification services, and connected vehicle or GPS devices.
- State the business purposes: completing the rental, billing, fraud prevention, damage and toll recovery, legal compliance.
- Say whether you sell or share, and describe how renters opt out.
- Describe the rights and how to exercise them, with at least two request methods.
- Date it, and review it whenever you add a vendor or a data use.
Handling consumer requests (DSARs)
California residents have the right to know what you collect, the right to delete, the right to correct, the right to opt out of sale or sharing, and the right to limit use of sensitive personal information, as the California Attorney General's office describes. A request can arrive by web form, email, phone or at the counter, so every location and every employee who answers the phone needs to recognize one.
| Step | Deadline |
|---|
| Confirm you received the request | Within 10 business days |
| Respond to a request to know, delete or correct | Generally within 45 days, with an extension available |
| Stop selling or sharing after an opt-out | As soon as feasible, no later than 15 business days |
The 10-day and 45-day clocks come from Jackson Lewis's summary of the regulations, which also notes that you need not answer more than two right-to-know requests from the same consumer in 12 months. The 15-business-day opt-out limit is in the regulation on opt-out requests.
A workable request process
- Log every request on day one. A shared inbox is not a log. Record the date received, the channel, the request type and the person handling it.
- Verify identity in proportion to the risk. Match the requester against details already in the rental record, such as email, phone and booking reference. Do not ask for more sensitive documents than you need to verify.
- Search every system. For a rental company that means reservations, contracts, payment records, damage photos, call recordings, GPS history and marketing tools. This is the step that fails when customer data lives in spreadsheets and several unconnected tools.
- Apply legal holds. A renter who asks for deletion may also have an open damage claim, a toll dispute or a tax record you must keep. Delete what you can, tell the requester what you retained and why in general terms, and keep the record of your decision.
- Respond and close. Send the response in a format the person can use, then record the date and outcome.
The two-per-year limit on right-to-know requests protects you from repetitive demands, but it does not remove the need for a fast, consistent process on the first two.
Opt-outs, Global Privacy Control and vendors
If you sell or share personal information and collect it online, the regulations require you to honor an opt-out preference signal such as Global Privacy Control. You must also offer at least one additional method, for example an interactive form reached through a "Do Not Sell or Share My Personal Information" link, as the opt-out regulation sets out. Your privacy policy must explain how you process those signals.
In practice, rental operators should check three things:
- Your booking site. Test whether ad and analytics tags stop firing when a browser sends the signal.
- Your contracts with vendors. Payment gateways, GPS providers, insurers and marketing platforms should be bound by written contracts that restrict how they use renter data. Under the regulations, a service provider or contractor collecting under that required contract does not constitute a sale or sharing, as the CCPA text explains. Without the contract, the same flow may count as a sale or sharing.
- Minors. A business must not sell or share the personal information of a consumer it knows is under 16 without affirmative authorization (the consumer for ages 13 to 15, a parent or guardian under 13), per § 1798.120. Most renters are over 21 or 25, but loyalty and marketing lists can still catch younger people.
If you also rent in Europe or serve international renters, GDPR obligations for car rentals overlap with many of these controls, and one well-built process can serve both.
Retention: decide, write down, enforce
The retention rule is simple and often ignored. The notice at collection must state how long you intend to keep each category of personal information, or the criteria for deciding, and you must not keep data longer than reasonably necessary for the disclosed purpose. Both points come from Civil Code § 1798.100.
Build a retention schedule with one row per data category:
| Category | Purpose | Retention trigger | Disposal method |
|---|
| Rental contract and invoice | Billing, tax, disputes | End of rental plus your tax and legal period | Scheduled deletion |
| License scan | Identity and eligibility check | Shortest period that supports claims and disputes | Scheduled deletion of image, keep verification result |
| Payment card data | Charges and refunds | Do not store beyond what your processor requires | Handled by gateway |
| Vehicle location history | Recovery, mileage and damage disputes | Short rolling window, longer only for open cases | Automated purge |
| Marketing profile | Offers and newsletters | Until opt-out or inactivity period | Suppression, then deletion |
Your tax and financial record periods are a separate matter from privacy retention. Our guide to record retention for US car rentals covers the three-year IRS angle and how to automate it. Have your attorney confirm the exact periods for your state and your insurance and claims exposure. For card data, the PCI compliance steps show how to keep stored payment data to a minimum.
Two habits keep the schedule honest. First, assign an owner for each category. Second, run deletion on a schedule rather than when someone remembers.
GPS, telematics and connected vehicles
Vehicle location is the data type renters notice most. A tracker in a car tied to a named renter is personal information, and precise geolocation is among the sensitive categories. Some practical rules:
- Collect location only for stated purposes such as recovery, theft prevention, fleet operations and agreed mileage or geofence terms.
- Say so in the rental agreement and in the notice at collection, in plain language.
- Limit who can see location history and log access.
- Keep history only as long as the purpose requires, and purge it on a schedule.
For integration design, see how to set up privacy-first GPS integration and how real-time tracking fits daily operations. For wider context on how rental technology touches sensitive data, this personal data and GDPR primer is a useful starting point for the vocabulary. If you run background checks on renters, the FCRA has its own rules; our guide to renter background checks covers them.
What noncompliance can cost
The state Attorney General can seek an injunction and civil penalties of up to $2,500 per violation, or $7,500 per intentional violation and per violation involving minors' data, as Civil Code § 1798.199.90 provides, adjusted over time. The CPPA also has its own power to bring administrative actions and fines under § 1798.155. The agency announced adjusted amounts of $2,663 and $7,988 effective January 1, 2025, and later adjustments may apply.
Because penalties are counted per violation, a flawed process repeated across every renter can multiply fast. That is the argument for fixing the process, not the individual request.
Our perspective: the system of record is your privacy program
We see the same pattern in rental businesses of every size. Privacy trouble rarely starts with bad intent. It starts when a renter's data sits in a booking tool, a spreadsheet of contracts, a photo folder on a phone and a separate GPS dashboard, and nobody can say where all of it is.
That is why we think of rental software as the central nervous system of the operation. When reservations, contracts, payments, customer records and fleet tracking live in one platform, you can answer a request to know by searching one place. You can apply a retention rule once rather than five times. You can limit who sees what by role.
Nomora is designed around that idea: replace spreadsheets and manual processes with one cloud-based system, with security and GDPR compliance built into how we describe the platform. Every plan includes the full feature set, so a small operator gets the same centralized records as a large network. No software makes you compliant by itself, and your attorney should sign off on your notices. But a clean system of record turns privacy from a scramble into a routine.
Dizzy
Put it into practice with Nomora
If your customer data is scattered, consolidating it is the first compliance step that pays for itself. Nomora brings reservations, fleet management with GPS tracking, automated contracts, integrated payments and customer data into one cloud platform, and we aim to have you fully operational in 24 to 48 hours. Plans start with Starter at €45 per month. Business is €2.80 per vehicle per month and Fleet is €2.20 per vehicle per month, while Enterprise has no published price. See the full plan details.
If you manage a larger fleet, look at fleet management software for 50+ vehicles or our corporate fleet use case. To see how payment handling fits, read about automated car rental payments, and check the integrations guide before you add any new vendor, since every integration is a data flow you must disclose.
A 90-day starting plan
Days 1 to 30: see what you have. Complete the CPPA applicability questions, build the data inventory, and list every vendor that receives renter data. Pull the contracts and note which lack privacy terms.
Days 31 to 60: write and publish. Draft the notice at collection and privacy policy, add links at every collection point, add a request form and a second request method, and test your site's response to opt-out signals.
Days 61 to 90: operate. Adopt the retention schedule, train counter and phone staff to recognize and route requests, run a test request through the full process, and set a calendar review of the policy every year or whenever you add a data use.
FAQ
Does the CCPA apply to a small, single-location rental company?
Only if you do business in California, collect personal information and meet a threshold: more than $25,000,000 in annual gross revenue as adjusted, 100,000 or more consumers or households, or 50% of revenue from selling or sharing data. Many small operators fall below all three. Confirm with an attorney, and still adopt good practices, because thresholds are measured each year.
What should a car rental privacy policy include?
It should list the categories of personal information you collect and their sources, the purposes of use, whether you sell or share, how long you retain each category, how renters can exercise their rights, how you verify requests and process opt-out signals, and contact details. It also needs a last-updated date.
How long do we have to respond to a data request?
Confirm receipt within 10 business days and respond generally within 45 days, with an extension available in some cases. Opt-outs of sale or sharing must take effect as soon as feasible and within 15 business days. Log the date every request arrives so the clock is never in doubt.
Can we keep a renter's data after they ask for deletion?
Sometimes. You may need to keep records for an open claim, a dispute or legal recordkeeping. Delete everything you do not need, document why you kept the rest, and tell the requester in general terms. Have your attorney confirm which records qualify.
Is vehicle GPS data covered?
Yes, when it can be tied to an identifiable renter. Precise location is a sensitive category, so state your purposes in the notice at collection, limit access, and set a short retention period for location history.
Sources
Recommended
