Your Car Has a Black Box. Here Is What It Records.

What an EDR actually is

An Event Data Recorder is a function inside a vehicle's restraint system control module, the same computer that decides when to fire the airbags. When the control module senses a crash-level change in velocity, or when the airbags deploy, the module freezes a short window of pre-crash and post-crash data into non-volatile memory (an EEPROM that does not need battery power to retain its contents) [5]. The Toyota unintended-acceleration trials from 2009 to 2014 are what made the device famous in the United States: a series of crashes where drivers said the gas pedal was stuck, and Toyota pointed to the EDR to show the brake was never pressed [6][7].

Most modern light vehicles have had an EDR of some kind since the mid-2000s. The Insurance Institute for Highway Safety and the Highway Loss Data Institute have been publishing EDR data extraction guidance for the same window [8]. The 2006 final rule, 49 CFR Part 563, did not require carmakers to install EDRs, it required that any EDR a carmaker did install meet the federal format and survive a 30 mph barrier crash [1]. Voluntary adoption was already at 85% or higher by 2010 [1]. The compliance date for the format rule was pushed from September 1, 2010, to September 1, 2012 [1].

The practical result: if your car was made in the last 15 years and has airbags, it has an EDR. The function lives inside the airbag control module, and the data stays in the car until someone with the right tool pulls it out.

The 15 (plus 30) data elements

49 CFR 563.7 lists the data elements the EDR must record if the device is present [3]. The required elements fall into two tables: the elements that must be on every EDR-equipped vehicle, and the elements that must be recorded only if the carmaker chose to record them. The full list, drawn directly from the rule:

Table 563.7(a), required on every EDR-equipped vehicle:

• Delta-V, longitudinal (change in forward velocity), 0 to 250 ms, 100 samples per second
• Maximum Delta-V, longitudinal, 0 to 300 ms
• Time, maximum Delta-V, longitudinal, 0 to 300 ms
• Speed, vehicle indicated, minus 5.0 to 0 seconds, 2 samples per second
• Engine throttle, percent full (or accelerator pedal percent full), minus 5.0 to 0 seconds, 2 samples per second
• Service brake, on or off, minus 5.0 to 0 seconds, 2 samples per second
• Ignition cycle, crash, at minus 1.0 second
• Ignition cycle, download, at the time of download
• Safety belt status, driver, at minus 1.0 second
• Frontal airbag warning lamp, on or off, at minus 1.0 second
• Frontal airbag deployment, time, for first stage, recorded relative to time zero
• Frontal airbag deployment, time, for second stage (multi-stage systems)
• Side airbag deployment, time, if recorded
• Curtain airbag deployment, time, if recorded
• Time, maximum Delta-V, resultant, 0 to 300 ms

Table 563.7(b), required only "if recorded":

• Lateral acceleration, longitudinal acceleration, normal acceleration
• Delta-V, lateral, 0 to 250 ms, 100 samples per second
• Maximum Delta-V, lateral, 0 to 300 ms
• Engine RPM, minus 5.0 to 0 seconds, 2 samples per second
• Vehicle roll angle, minus 1.0 to 5.0 seconds
• ABS activity, engaged or non-engaged, minus 5.0 to 0 seconds
• Stability control, on, off, or engaged, minus 5.0 to 0 seconds
• Steering input, minus 5.0 to 0 seconds

Read the list again. The rule does not require GPS, audio, video, driver identification, phone contacts, or cabin conversations. EDRs record what the car knew about itself: speed, brake, throttle, steering, belt, airbag, and crash physics. The instrument the rule built is a vehicle-state recorder, not a surveillance device [1][3].

That framing matters, because the next thing the rule did was also notable. It required that the data survive a 30 mph barrier crash and that carmakers make a public tool to read the data [1]. The first three automakers to publish a tool were General Motors, Ford, and DaimlerChrysler, all by October 2009 [1].

5 seconds before, 300 ms after

The 5-second pre-crash window is the part the public hears about most often. In the November 2011 Massachusetts crash that ended Lt. Governor Tim Murray's political career, the Ford Crown Victoria EDR recorded 108 mph in the 5 seconds before impact, a throttle reading consistent with the accelerator being applied, and a service-brake switch reading consistent with no foot on the brake [9]. Murray had told state police he lost control on ice and was not speeding. The EDR said otherwise. He was not injured; he later pleaded guilty to negligent operation and paid a fine [9].

The 300-millisecond post-crash window is the part the engineers and the crash-reconstruction experts care about. Delta-V at 100 samples per second for the first quarter-second after the trigger is what lets a reconstruction expert say how fast the car was going when it hit, whether the occupant was wearing a belt, and whether the airbags should have fired when they did [1][3]. The same window is what the National Transportation Safety Board and the Federal Railroad Administration use in the post-crash reports on airplane, train, and pipeline incidents.

The "trigger" itself is a sudden change in longitudinal velocity, a deployment of the airbags, or both. If the airbags do not fire and the crash is below the velocity-change trigger threshold, the EDR may not record a file at all, which is one of the most commonly misunderstood facts about the device. A fender-bender at 5 mph does not generate a record. A parking-lot tap on a curb does not generate a record. The EDR is recording, in the sense that it is always running, but it is only writing to permanent memory when the trigger fires [1][5].

EDR is not your car's telematics

The most common confusion we hear from readers is between the EDR and the connected-car services, the ones our car-data opt-out guide covers in detail. They are not the same system.

• EDR (Event Data Recorder): a passive function inside the airbag control module, with no radio transmitter, no remote connection, and no live data feed. The data stays in the car until someone with the Bosch Crash Data Retrieval tool (or a manufacturer-specific tool for Subaru, Kia, or Hyundai) plugs in and downloads it [1][10].
• Telematics (OnStar, FordPass, Toyota Connected, Blue Link, Tesla telematics): a cellular modem and a software stack, owned by the carmaker, that streams location, speed, accelerator position, and sometimes cabin video to the automaker's cloud on an ongoing basis. This is the data path that flows into LexisNexis, Verisk, insurance risk scores, and the data-broker pipeline [11].

The EDR is a sealed witness. The telematics is a live microphone. The two systems share a wiring harness in many cars, and the airbag control module can be queried by the telematics unit to send a "crash detected" alert over the cellular network, the same alert that triggers an OnStar or FordPass automatic crash response. But the data the EDR holds locally is the data the police and the lawyers want, not the data the automaker's cloud already has.

This is also why EDRs are usually not the privacy problem the headlines make them out to be. The privacy problem in cars is the data path the carmaker streams out, the telematics pipeline. The EDR's privacy problem is narrower: who can plug in and read it, and under what authority.

The Toyota courtroom era

Until 2009, the EDR was a tool used almost exclusively by crash investigators and a small group of product-liability lawyers. Then Toyota began recalling 9 million vehicles for unintended acceleration, an episode that started with floor mats trapping the accelerator pedal in November 2009 and grew to include sticky accelerator pedals in January 2010 [6]. The 2010 recalls were followed by a March 2014 deferred prosecution agreement with the Department of Justice in which Toyota paid $1.2 billion in financial penalties to resolve a criminal charge that it had concealed the defects [6].

Through the entire multi-year investigation, the EDR data was the only neutral witness. The Department of Justice statement of facts described EDR downloads from the Bookout v. Toyota case, an Oklahoma state-court trial in 2013, where the EDR data showed the driver's foot on the brake at the moment of impact and no corresponding reduction in engine throttle, evidence the jury used to find the vehicle's electronic throttle control system had failed [6]. The same EDR data was used in the criminal trial of Toyota Motor Corporation in U.S. District Court for the Central District of California in March 2014, where a federal judge acquitted Toyota of the remaining wire-fraud count, but the deferred prosecution agreement stood [6].

The Toyota era is when the EDR graduated from a crash-reconstruction tool to a courtroom weapon, on both sides. Drivers in unintended-acceleration cases pointed to the EDR to show the throttle was stuck. Automakers pointed to the EDR to show the brake was never applied. The device, by 2014, had become the standard of proof in any contested crash where the data was recoverable. The Insurance Institute for Highway Safety's EDR working group and NHTSA's Crash Investigation Sampling System both lean on EDR downloads in the same window [8].

Who can read it: the federal rule

On December 4, 2015, President Obama signed the Driver Privacy Act of 2015 into law [4]. The statute is short and unusually direct. It says the owner or lessee of a motor vehicle is the owner of the data recorded by an EDR, and it lists five narrow exceptions for when someone else can access the data:

1. A court or judicial or administrative authority, subject to the standards for admission into evidence.
2. The written, electronic, or recorded audio consent of the vehicle owner or lessee.
3. An investigation or inspection authorized by federal law.
4. A medical emergency, where the data is necessary to facilitate care of the driver or passengers.
5. Traffic safety research, including by the federal government, a state, or a contractor, provided the personal information of the owner or lessee is not disclosed.

The federal rule is privacy-protective on its face. A police officer who pulls a connector and downloads the module without a warrant or without your written consent is, under the statute, in the wrong. The statute does not create a private right of action, and it does not preempt state law, so the practical protection depends on which state you are in [4].

The 17-state patchwork

At least 17 states have statutes specific to EDRs, on top of the federal floor [5]. The most-cited is California Vehicle Code section 9951, which provides that an EDR may not be equipped in a new vehicle sold or leased in California unless the carmaker provides a written statement in the owner's manual that the vehicle is equipped with an EDR and that the data is the property of the vehicle owner. New Hampshire has a similar statute, as do New York, Texas, Washington, Virginia, Oregon, and a growing list of others [5][12].

The patchwork matters in two ways. First, in a state with a strong EDR-consent statute, the police need a warrant or the owner's written consent to download the device, even after a fatal crash. Second, in a state without a strong statute, the only legal floor is the federal Driver Privacy Act, and a defendant in a civil or criminal case can argue that the federal statute's "court order" exception is satisfied by a subpoena, by a civil discovery request, or by an administrative subpoena. The federal rule does not specify which kind of court order qualifies [4].

There is no nationwide EDR opt-out. The data is recorded any time the trigger fires, regardless of whether the owner wants it recorded. The only opt-out is not driving, which is not an opt-out in any practical sense.

What you can actually do

The honest answer is: not much about the EDR itself, and a lot about the rest of the car's data pipeline.

The bottom line

The EDR is the most-misunderstood piece of surveillance hardware in the average American's life. It is a passive device. It does not transmit. It does not record location. It does not record audio. It records what the car knew about itself, in a 5-second window before a crash trigger, and a 300-millisecond window after. The federal rule (49 CFR Part 563) and the federal privacy law (the Driver Privacy Act of 2015) put the data in the hands of the vehicle owner and limit when everyone else can read it. The actual privacy problem in modern cars is not the EDR. It is the connected-car telematics pipeline, the OnStar, FordPass, Toyota Connected, Tesla, and Blue Link stacks that stream location, speed, and behavior to the automaker's cloud and, from there, to LexisNexis, Verisk, and the insurance industry.

The EDR is the witness. The telematics is the witness's stenographer. They are not the same thing, and treating them as the same thing is how the car industry has gotten away with building a $100-per-car surveillance economy on the back of a 49 CFR rule that, on its own, is mostly privacy-protective.

If you are in a crash, the EDR is a sealed record. If you are driving to work, the EDR is silent. The privacy fight in your car is downstream of the EDR, in the cloud, where the connected services you did not realize you signed up for are doing what the black box never did.

Sources

1. U.S. Government Publishing Office, Electronic Code of Federal Regulations, Title 49, Subtitle B, Chapter V, Part 563, Event Data Recorders. Effective date: August 28, 2006. https://www.ecfr.gov/current/title-49/subtitle-B/chapter-V/part-563
2. Insurance Institute for Highway Safety, "Event data recorders" topic page. (IIHS EDR resources and EDR data extraction guidance.) https://www.iihs.org/
3. U.S. Government Publishing Office, 49 CFR 563.7, Data elements (Table I to § 563.7(a), required for all vehicles equipped with an EDR; Table I to § 563.7(b), required for vehicles under specified minimum conditions). https://www.ecfr.gov/current/title-49/subtitle-B/chapter-V/part-563/subpart-B/section-563.7
4. U.S. Congress, "Driver Privacy Act of 2015," enacted December 4, 2015. Codified at 49 U.S.C. § 30101 note. (Vehicle owner is owner of EDR data; five enumerated access exceptions.) https://www.congress.gov/bill/114th-congress/senate-bill/766
5. Wikipedia, "Event data recorder" (consolidated regulatory, technical, and courtroom-case references; cross-linked to 49 CFR 563, Driver Privacy Act of 2015, Bosch CDR tool, and the 17-state EDR consent compendium). https://en.wikipedia.org/wiki/Event_data_recorder
6. Wikipedia, "2009-2011 Toyota vehicle recalls" (floor-mat recall November 2009, sticky-pedal recall January 2010, DOJ deferred prosecution agreement March 2014, $1.2 billion penalty, unintended-acceleration investigation history). https://en.wikipedia.org/wiki/2009%E2%80%932011_Toyota_vehicle_recalls
7. Wikipedia, "Sudden unintended acceleration" (Bookout v. Toyota 2013 Oklahoma state-court trial; EDR data showed brake applied and no corresponding throttle reduction; Colin O'Flynn 2021 electromagnetic fault injection (EMFI) reproduction on a 2005 Toyota Corolla ECU). https://en.wikipedia.org/wiki/Sudden_unintended_acceleration
8. Andrews, Dennis F. and Limpert, Rudy, "Electronic Control Module Data in Large Truck Collision Analysis" (PC Brake, 2013). Cited reference for ECM / EDR data interpretation across heavy-truck collision analysis. https://www.pcbrake.com/
9. Wikipedia, "Tim Murray" (Massachusetts Lt. Governor, November 2, 2011 I-190 crash; 108 mph; EDR data; subsequent negligent-operation plea). https://en.wikipedia.org/wiki/Tim_Murray
10. Bosch Crash Data Retrieval (CDR) tool documentation. The standard read-only tool used by law enforcement, crash investigators, and OEM dealerships to download EDR data from most U.S. light vehicles. https://www.boschdiagnostics.com/cdr
11. State of Surveillance, "How to Actually Opt Out of Car Data Collection (2026 Guide)." The basic privacy guide for filing right-to-know, right-to-delete, and do-not-sell requests with 18 car brands, plus the broker-layer (LexisNexis, Verisk) cleanup. /guides/basic/car-data-opt-out-guide
12. California Vehicle Code, section 9951 (Event Data Recorder owner's-manual disclosure; data is property of vehicle owner). Codified at Cal. Veh. Code § 9951. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=VEH§ionNum=9951
13. National Highway Traffic Safety Administration (NHTSA), "Event Data Recorders" regulatory overview. The August 2006 final rule, the 85% voluntary adoption estimate for 2010, and the September 1, 2012 compliance date. https://www.nhtsa.gov/equipment/event-data-recorder