In recent years, many organizations have installed dashcams in their vehicles to improve safety and compliance, reduce costs, and better understand what’s happening in the field.  Dashcams can be extremely useful for these purposes, giving organizations visibility into risky driver behaviors and misuse of company property.  They can also lower insurance costs and provide valuable evidence in litigation.  To provide these benefits, though, dashcams collect a lot of data—including data organizations didn’t intend to collect and/or that triggers legal obligations they didn’t intend to assume.

Why Organizations Are Using Dashcams

Dashcams serve a number of functions.  For example:

1. Their use can lower insurance costs.  The video and audio recordings dashcams collect can help favorably resolve disputes and their AI-powered driver behavior monitoring capabilities can help flag risky activity before it results in costly incidents. 

2. Dashcams can also help organizations monitor compliance with internal policies (e.g., no phone use while driving) and external requirements (e.g., hours-of-service rules in regulated industries).  They also create a record that can be useful in audits or investigations.

3. When accidents occur, dashcam footage can help clarify fault, rebut inaccurate claims, and, in some cases, prevent litigation altogether or significantly reduce exposure.

4. Many dashcams now incorporate AI tools that evaluate driver behavior and generate performance scores.  For some organizations, this information influences coaching, discipline, promotion, and compensation decisions. 

The Risks Dashcams Pose

To deliver these benefits, dashcams collect and process significant volumes of data, the management of which can be challenging.  For instance:

1. In certain jurisdictions, prior consent is required to audio record communications.  Organizations that deploy dashcams without a clear process for obtaining and documenting consent may find themselves out of compliance.

2. Some dashcams use facial recognition or similar technologies to identify drivers or monitor attentiveness.  Collection of this data can trigger notice and consent obligations—e.g. in California, Colorado, Illinois, and Texas—as well as obligations to maintain reasonable safeguards to protect the data from unauthorized access or acquisition.

3. Dashcams capture extraneous information, such as employees’ discussions about medical conditions, religious beliefs, sexual orientation, or legal off-duty activities (like drinking or gambling), or the fact that, while using the vehicle, they visited their doctor or attended their AA meeting.  Collection of this information can complicate employment decisions—e.g., by imputing to an employer knowledge of an employee’s protected characteristics—and heighten the risk of invasion of privacy claims.

4. Dashcams increasingly use AI to evaluate driver behavior or generate performance metrics.  In certain jurisdictions (e.g., California, Colorado, Illinois, New York City), the use of AI-generated performance data may trigger notification, risk assessment, and other compliance requirements. 

4. Dashcams are typically deployed and managed by third-party vendors, which means the data they collect is often processed outside the employer’s information systems.  Nevertheless, the employer remains responsible for the protection and proper handling of that data.  If the vendor experiences a breach, or misuses the data, impacted employees and/or regulators will likely seek to hold the employer—not just the vendor—accountable.   

How To Manage Dashcam Risk

For many organizations, dashcams are a major value add.  And the good news is that the risks their use presents—though significant—are manageable, provided you have a solid program in place to do so.

Below are some practical steps to consider:

✔ Inventory Your Technology

• Identify what dashcams are in use across the organization
• Understand what features are enabled (e.g., video, audio, AI, facial recognition, geolocation tracking, etc.)
• Confirm the approved use cases

✔ Map the Data

• What data is being collected?
• Where is it stored (including vendor environments)?
• Who has access to it, both internally and externally?
• How long is it retained?

✔ Address Notice and Consent Requirements

• Implement clear notice to drivers and passengers
• Obtain consent where required (e.g., before recording audio or colleting biometric data)

✔ Review AI Use

• Determine whether AI is being used to evaluate employees
• Assess whether applicable AI laws impose additional obligations
• Confirm that outputs are being used appropriately in employment decisions

✔ Update Policies and Training

• Develop or revise policies addressing dashcam use
• Train employees on what is being collected and why
• Provide guidance on appropriate use of company vehicles and equipment

✔ Minimize Data Collection and Retention

• Disable unnecessary features (e.g., audio, facial recognition) where possible
• Limit retention periods to what is actually needed
• Avoid collecting data “just in case it’s useful at some point”

✔ Manage Vendor Risk

• Conduct diligence on dashcam vendors’ privacy and security practices
• Confirm where and how data is stored, processed, and transmitted
• Understand whether the vendor uses data for product improvement, AI training, or other secondary purposes
• Put clear contractual restrictions in place governing data use, retention, disclosure, breach notification, and risk allocation
• Require appropriate security controls (e.g., encryption, access controls, incident response obligations)
• Periodically reassess vendors to confirm ongoing compliance