Your phone and your car: How to keep your personal data private

Connecting your phone to your car makes life easier. But it can also leave your contacts, calls, messages and other personal information stored in the vehicle, even long after you’ve disconnected your phone.

That matters when you sell, part-exchange or return a car. Unless the data is properly deleted, the next person behind the wheel could potentially see it.

Here’s what your car may be storing and how you can protect yourself.

Looking for the bigger picture? Check our follow-up guide, A guide to connected-car data: What you need to know and what you can do

What does your car copy from your phone?

When you connect your phone through Bluetooth, your car may copy information so you can use features such as hands-free calling.

Depending on the vehicle, this can include:

• your contacts
• call history and messages
• recent journeys and saved destinations
• your home address
• garage door information
• logins for apps you’ve used in the car.

Crucially, disconnecting your phone doesn’t necessarily delete that information from the car.

Apple CarPlay and Android Auto can reduce the amount of information stored directly by the vehicle, but don’t assume that means nothing is being saved.

Your data could still be there when you sell your car

Research suggests this isn’t just a theoretical risk. A Privacy4Cars investigation of 46 UK dealerships found personal information in 40 of 70 vehicles test-driven, despite many dealers saying they routinely wiped previous owners’ data.

Another investigation found personal information in 27 out of 30 ex-lease vehicles, with 121 phones still paired to them.The idea that “most” cars contain data is not fanciful – research from Privacy4Cars showed that four in five customers had found  personal data in cars sold at retailers in the UK, Italy and Germany.

That means the next owner or driver – in most cases – could access information left behind by previous users. The same problem applies to cars you don’t own. Hire cars and courtesy cars can store information from your phone too.

Who could see your information?

The most obvious risk is the next person who uses the car. They may be able to open the infotainment system and see contacts, previous journeys or other information you’ve left behind.

More detailed information can potentially be recovered using specialist equipment too. Security researchers have demonstrated that information including contact lists and journey histories can be extracted from vehicle systems. This becomes particularly important when a car is sold, part-exchanged, returned after a lease or hire, written off or scrapped.

How to protect your phone data

You don’t need to stop using your car’s connected features altogether. But think about what you’re sharing.

When you connect your phone, check the permissions you’re being asked to give. If you don’t need to sync messages or contacts, say no. You can usually change these permissions later through your phone’s Bluetooth settings.

In hire and courtesy cars, consider whether you need to connect your phone at all. If you do, remove your device from the car before handing it back.

Avoid saving your exact home address as “Home” in the satnav. You could use a nearby location instead.

And remember that deleting the Bluetooth connection isn’t necessarily the same as deleting your information.

Selling or returning your car? Factory reset it

Before you sell, part-exchange or return a car, carry out a factory reset of its infotainment system.

You should also remove:

• paired phones
• saved addresses and journeys
• garage door codes
• in-car app accounts and logins.

You’ll usually find the factory reset under System, General or a similar section in the car’s settings. Check your handbook or ask the manufacturer or dealer if you’re unsure.

If your car has been written off, ask your insurer whether you can wipe the system before it’s collected. If that’s no longer possible, ask what will happen to the personal information stored on it.

Buying a used car? Check it’s been wiped

The responsibility doesn’t only sit with the previous owner. If you’re buying used, check that the infotainment system has been reset and that you can’t see previous users’ contacts, destinations or paired phones.

If you discover someone else’s personal information, don’t use it or contact them. Tell the dealer or business responsible so it can investigate and delete the information.

Your data rights

If a dealer, leasing company, hire company or another organisation passes on a vehicle containing your personal data, that could raise data protection concerns. Businesses handling vehicles containing customer data need to make sure that information is dealt with appropriately.

You can also ask an organisation what personal information it holds about you and, in some circumstances, ask for it to be deleted.

You can usually request a copy of your data for free. Find out how in our Resolver guide to making a Subject Access Request (SAR).

Don’t leave your digital life behind

We routinely clear personal information from phones and laptops before selling them. It’s worth treating your car in exactly the same way. Before a car leaves your control, disconnect your accounts, remove your phone and factory reset the infotainment system.

A few minutes spent wiping it could prevent your contacts, journeys and other personal information being handed to the next driver.

Join the Data Protection Foundation – and take action over data misuse

The Data Protection Foundation (DPF) investigates how organisations collect, share and use your personal information and helps people take action where their data may have been misused.

Membership is free and eligible members may be able to take part in collective claims, with free legal representation and the potential to receive compensation if a claim succeeds or reaches a settlement. Compensation isn’t guaranteed, but joining means you’ll hear about relevant investigations and opportunities to take action.

The DPF is currently researching how personal data is collected and stored by cars, so joining could be particularly useful if you’re concerned about what happens to your information when you connect your phone to a vehicle.

Join the Data Protection Foundation for free

This information is intended for general guidance only and does not constitute legal advice. Resolver is not a law firm or a claims management company and cannot offer legal advice. You should read the settlement terms carefully and consider seeking independent legal advice if required.

Some links in this blog are affiliated. This means we may receive a commission on them, at no cost to you. These affiliate links help us keep Resolver free and independent for everyone.