There are many options there, at the cost of making audits/complaints harder, such as e.g. only keeping GPS traces for a very short time (or not at all), and gradually overwrite more and more details, such as coordinates, reducing time precision, and finally consolidate to amounts owed. Those settings could be left under the control of the car owner as well, or let you dump a signed record of the precise data if you as the owner suspect inaccuracies and want to collect evidence, and then allow you to wipe the details from the device and only leave aggregate numbers.
The point is if the device is tamper-proof enough, you don't need it to record your movements, you just need it to monitor your movements and location with sufficient precision to decide what amounts should be added to running totals of tax.
Of course there is a risk some governments will decide they'd really like more detailed records.
I would assume that there is some law which requires the detailed data to be deleted, but I'm not sure about that.
Trucks have been doing it for years with transponders in the cabs. That's how when a semi fills up with fuel in one state and ends its trip in another state the state in between still gets some fuel tax to pay for road maintenance.