What your car knows about you

Seven phones in the paired device list of a rental I picked up at an airport, and two of them still had contacts downloaded.

I only opened the menu because I wanted to clear an old entry before adding mine. The list was right there, no tools and no cleverness required, with a name attached to every line.

That is the part of this subject people react to. The rest of it is quieter and quite a lot bigger.

The claim worth putting down first

Your car is not streaming your conversations to a server.

The cabin microphone is wired to the voice assistant and to hands free calling, and it opens on a button press or a wake word. Continuous audio off every vehicle a manufacturer ever sold would be a bandwidth bill for material nobody could process at that scale.

I run mobile data lines for a living, which mostly means I know what moving bytes costs. Voice from millions of cars is expensive. Telemetry from millions of cars is nearly free. Economics picked the winner years ago.

So skip the microphone. The log is where this actually lives.

What it records because it has to

A car built in the last decade contains dozens of small computers on an internal network, and several of them keep records as an ordinary part of the job.

Location, held as a history rather than a position. Where the car was, the route it took, the time it was there.

Speed measured against that route. Navigation data carries the posted limit for most roads, so the record holds your speed sitting next to the number on the sign.

Braking events with a severity attached, because the stability systems have to know when the car nearly lost grip.

Door and boot events, seatbelt latches, ignition cycles. Between them they describe how many people got in and roughly when.

And a short buffer around a serious impact, which has a legal status in several countries and exists so that a crash can be reconstructed afterwards.

None of it was added to watch you. Every item is load bearing for something that has to make a decision in milliseconds. The privacy problem starts afterwards, and it is simply that the data is kept.

The connection you did not set up

Here is the assumption that fails. I never installed the app, so the car is offline. Or, location is switched off on my phone, so the navigation cannot be recording.

Both of those are statements about a phone. The car has a line of its own.

There is a modem inside it with an embedded sim, provisioned to a carrier by the manufacturer before you ever saw the vehicle, and it is live whenever the car is. It has to be. The emergency call button works when your phone is dead in a ditch, and stolen vehicle tracking works after a thief has thrown your handset out of the window. Both of those need a permanent link back to the manufacturer, and both are printed in the brochure as reasons to buy.

So declining the app changes less than people expect. The app is a window onto data that has already left the car. Closing a window does not stop a send.

Contacts are the copy nobody expects

Pair a phone over bluetooth, accept the prompt about contacts, and the car does not read your address book live off the handset. It copies it into storage on the head unit.

Names, numbers, call history, and on many models the text messages too. That copy stays after the phone leaves. It is still there when the phone is switched off, and when the phone has been sold to somebody in another country.

The design reason is sound. Searching a contact list has to work instantly while the handset sits in a coat pocket on a weak link, so the car keeps its own copy rather than asking every time.

The consequence is that a component bolted into a dashboard now holds the address book of everyone who has ever paired with it. Nobody files a head unit under places my data lives. It is the thing that plays music.

Which is how the rental ends up with seven of them. A car that gets a new driver every four days collects those copies, because the contact prompt stands between the driver and the radio and almost everybody taps yes to make it go away. Then the keys go back and nobody opens that menu again.

Two habits fix your half of it. Decline the contact sync and pair for audio only, which every car supports. Delete your device from the list before you return it, which takes about twenty seconds.

If you plugged in with a cable instead of pairing, check anyway. On plenty of models the cable runs the same sync and asks fewer questions on the way.

Where it goes after the manufacturer

The manufacturer receives it. That is not contested and it is written down in the paperwork you were handed.

Beyond that it depends on your market. In some countries insurers buy driving behaviour, either from the manufacturer or through a company sitting in the middle, and the score is assembled out of braking, acceleration and what hours the car tends to move. Sometimes that is an opt in with a discount attached, which is a fair trade offered openly. It has also reached insurers without the driver registering that anything happened, because the consent sat inside a larger agreement about something else.

Then the broker layer buys and joins whatever it can get hold of. Location history is one of the most valuable inputs in that market, because a pattern of places pins a person down harder than a name does.

The permission is real. It was collected in the purchase paperwork, or during app setup, or on the touchscreen at handover when a screen asked you to accept something before you could drive off the forecourt. Nobody read it. The terms were drafted by people who knew nobody would.

Most cars from the last five or six years have a connectivity or privacy section. What sits inside varies by manufacturer and by country, and in a few markets it is genuinely detailed because regulation forced it.

Worth walking through:

Anything worded around sharing driving data or improving our services. Switch it off. It is normally a separate control from the one keeping the emergency call alive, and you want that one left on.
The destination history. Many cars hold hundreds of past destinations and will list them for you on request. Delete it.
The paired device list, minus anything you do not recognise or no longer own.
The manufacturer’s account website, which is a different system holding different records. The deletion controls that exist are more often there than in the dashboard.

Selling it takes two resets

Run a factory reset on the head unit. That clears the paired devices, the copied contacts and the saved destinations in one pass.

Then remove the vehicle from your account on the manufacturer’s side, which is a separate operation on a separate system.

People do the first and skip the second. The result is a live account link to a car that somebody else is now driving around in. A seller I know could still see where his old car was parked three weeks after handing it over. The dashboard reset had worked exactly as advertised. It just had no reach into a server.

If you are buying used, assume neither step was taken. Do both yourself before you pair anything to it.

The refusal that achieved nothing

For about two years my whole position on this was that I had never installed the app.

Then I read what the modem does, which I should have done first, given that I buy sim cards for a living and know perfectly well that an embedded sim does not check whether you downloaded any software.

The car had been reporting the entire time. The app would at least have shown me some of what it sent. So my clever refusal made me the only party in the arrangement who could not see the data.

That pattern turns up everywhere in this subject. The visible thing gets refused and the invisible thing carries on underneath it.

The floor you cannot get under

I have argued elsewhere that a device can be kept off the network. A speaker you can decline to buy. A television you can keep off the wifi and feed from a separate box.

A car is the exception, and I would rather say so than pretend the advice scales. The connectivity is wired into safety systems, parts of it are required by law, and there is no version where you pull the fuse and keep the crash call. The available settings are whatever the manufacturer decided to expose, and that is the ceiling.

So this one is exposure management. Delete the pairings, clear the destinations, turn off what the menu allows, and drive knowing the location record still leaves the vehicle.

The phone is the piece that stays yours. What you pair it to, and what you leave sitting in a car you are about to hand back.

The settings I change on a car I am about to drive, in order, are here.