Car infotainment and the data your vehicle sends home
Your car probably has two computers doing very different jobs. Most people only think about one of them. The infotainment screen is the obvious one: it plays music, runs navigation, and pairs with your phone. The other is a telematics control unit, a small module with its own cellular radio that talks to the manufacturer’s servers whether or not your phone is anywhere near the car. That difference matters. It explains why turning off Bluetooth on your phone doesn’t stop your car from reporting home.
What “connected” actually means under the hood
The telematics control unit, usually shortened to TCU, has an embedded SIM or eSIM baked into the vehicle at the factory. It’s how features like remote start, “find my car,” automatic crash notification, and over the air software updates work without needing your phone as a go between. It runs on its own schedule, sending diagnostic pings, location data, and vehicle health information back to the manufacturer’s cloud. That happens even while the car is parked and off.
The infotainment head unit is a separate system. It handles the touchscreen, CarPlay or Android Auto, and Bluetooth pairing with your phone. Phoning the manufacturer is the TCU’s job. This unit phones your contact list, call history, and cached media into the car’s own local storage. Both get lumped together as “connected car.” But they collect different data for different reasons, and they don’t necessarily get cleared by the same reset.
The infotainment screen remembers more than you think
When you pair a phone over Bluetooth for the first time, most head units offer to import contacts and call logs so you can use hands free calling and see caller names on screen. A lot of people accept this without noticing what got copied. Depending on the system, that can include your full contact list. Recent call history too. Sometimes SMS previews, for read aloud features. And any addresses you’ve typed into navigation, including ones labeled “home” or “work.” Some units also integrate with garage door systems, storing that access alongside everything else.
Here’s the part that catches people out: unpairing your phone from your phone’s Bluetooth settings does not automatically delete the corresponding profile on the car’s side. The car keeps its own list of paired devices. That data stays until someone goes into the car’s own settings menu and deletes it. That distinction is the root of most of the real world exposure people run into.
Where the data goes after it leaves the car
The TCU’s telemetry serves genuine operational purposes: diagnosing a failing battery before it strands you, pushing a security patch, flagging a recall issue. That’s the pitch, and it’s mostly true. But some manufacturers also bundle driving behavior scoring into a companion app, tracking things like hard braking, acceleration, and speed. It’s pitched as an opt in feature, a way to see your own habits or unlock a discount. Once that data exists on a server, it can be shared with or sold to third parties as part of the manufacturer’s broader data business. Plenty of mobile apps monetize sensor data the same way. This is disclosed in privacy policies that essentially nobody reads. That’s usually the initial vehicle setup screen, where the consent checkbox lives.
Rental and used cars carry the last person’s data
This is the most concrete, least hypothetical version of the problem. Rent a car, pair your phone to make hands free calls on the drive. Unless you go delete that pairing before you return the car, your contact list and call history sit in that infotainment system. The next renter could see all of it. The reverse happens constantly with used cars. Buy one, turn on the screen, and find the previous owner’s contacts, call logs, and saved “home” address still sitting there, because nobody wiped it before the sale.
If you’re returning a rental or handing over a car you’re selling, go into the infotainment settings and manually delete each paired device. Don’t just disconnect it. Many systems also let you clear saved navigation destinations and run a full factory reset on the infotainment unit specifically. That’s separate from anything at the TCU level.
Usage based insurance is a trade you make on purpose, or without noticing
Some insurers give you a discount in exchange for plugging a small device into your car’s OBD-II port, or activating a built in telematics program through the manufacturer’s app. Either one monitors driving events like hard braking, rapid acceleration, and time of day driven. This is a genuine trade. Data about how you drive, in exchange for a possible lower premium. It’s worth treating it as a deliberate decision rather than a default. That means actually reading what the device or program measures, and how long that data keeps flowing, before you decide whether the discount is worth it to you.
That’s different from the driving score features some manufacturers turn on by default as part of initial account setup. It’s buried in a screen you clicked through when you first activated the connected services on a new car. Those are worth checking for even if you never signed up for a discount program. The checkbox is often on by default, not something you consciously opted into.
What’s actually in your control
None of this is fixable with one setting, but there’s a real list of things worth doing:
- Open the infotainment system’s privacy or data settings, usually under a general or connected services menu, and review what’s enabled. Most systems let you turn off individual features like driving scores without needing to touch anything else.
- Delete paired devices you no longer use from the car itself, not just from your phone.
- When pairing a phone you don’t want fully imported, check if the unit gives you a choice about which data categories to sync. Some let you allow calls without importing the full contact list.
- Check whether the manufacturer has a privacy portal or data request dashboard. A growing number do, driven by regional privacy regulation. They let you see or request a copy of what’s been collected under your account.
- Treat a rental car’s infotainment system like a shared computer. Pair as a guest if that option exists, and remove your data before you hand the keys back.
What none of this does is stop the TCU from sending diagnostic and location telemetry. The manufacturer considers that necessary for maintenance, safety recalls, and software updates. There’s no setting that makes the car stop communicating altogether, especially if you want features like automatic crash notification or roadside assistance to keep working.
The bigger picture
For most drivers, the realistic exposure is mundane, and dramatic hacking scenarios are far down the list. Data left behind on a car that changes hands. Driving data that ends up feeding into an insurer’s or data broker’s models, without much visibility into where it goes next. For people navigating a specific interpersonal risk, like an ex partner who still has access to a shared vehicle’s companion app or knows what’s paired to the infotainment system, that access can matter more day to day. It can matter more than anything happening on a manufacturer’s server.
Cars aren’t going to stop collecting this data. There’s no single toggle that opts you out of the whole picture. But knowing which system does what, and actually clearing your data before someone else drives your car, closes off the exposure most people run into in practice.
If this kind of thing is useful, we cover connected devices, tracking, and practical privacy steps regularly over at The Privacy Wire.