A modern connected vehicle generates approximately 25GB of data per hour, according to McKinsey’s Connected Car Report. That includes location, speed, braking patterns, destination history, and in some models, in-cabin audio. Mozilla’s *Privacy Not Included car privacy guide rates exactly what each major manufacturer collects. Connected vehicle data privacy is genuinely difficult to opt out of once you own the car.
Connected vehicle data privacy has become one of the least understood categories of personal data collection, largely because most drivers still think of a car as a machine rather than as one of the most data-rich environments in their daily life.
The FBI issued warnings in 2025 about fake QR codes placed on EV charging stations and parking meters across the US, directing drivers to payment-harvesting pages that exploit the routine, low-suspicion act of paying for a charge or a parking spot.
This post covers EV charging data and location tracking, dashcam and telemetry exposure, ride-sharing app vulnerabilities, and how to limit vehicle data collection where that is genuinely possible. For the full section overview, see the full guide to high-risk threats.
What Do EV Charging Stations Actually Track?
EV charging sessions log location, timing, and charging duration by design, building a detailed record of where and when a vehicle has been that is considerably more granular than most drivers realise they are generating simply by charging their car.
Fake QR codes at charging stations and parking meters, the specific scam the FBI warned about in 2025, redirect drivers to convincing payment pages that harvest card details under the guise of a routine parking or charging transaction.
This connects to how QR code scams and quishing work more broadly, since the charging station version follows the same underlying mechanism applied to a specifically plausible, low-suspicion physical context.
Charging networks also retain account and payment data tied to a registered vehicle across an entire ownership history, which becomes relevant if a vehicle is later sold without the previous owner’s app account being properly disconnected, a step many sale processes do not explicitly prompt for and that owners simply forget.
India’s expanding public charging network has introduced a similar version of this same fake QR code pattern at charging points in several major cities, with a sticker placed over the genuine payment code redirecting to a lookalike page. Checking that a QR code sits flush against the machine’s surface, rather than on a separate sticker layered on top, is a simple physical check worth making before scanning.
What Do Dashcams and Vehicle Telemetry Actually Expose?
Dashcam footage, increasingly cloud-connected by default, can capture and store far more than intended, including audio from inside the cabin in some models, creating a record of private conversations that most drivers assume the device is not capturing.
Vehicle telemetry data, driving behaviour, braking patterns, speed history, is frequently shared with insurers, manufacturers, and in some cases third-party data brokers under terms most drivers accept without reading in detail during setup.
This overlaps with how data brokers accumulate detailed profiles over time, since vehicle telemetry is an increasingly significant category within the broader profile a broker can assemble and sell.
Voice assistants built into modern infotainment systems raise a related, less obvious concern, since a system designed to listen continuously for a wake word necessarily processes audio it ultimately discards, but the boundary between what is discarded locally and what is briefly transmitted for processing is rarely made clear in the accompanying documentation. Reviewing your specific manufacturer’s privacy disclosure for the voice assistant feature, rather than assuming it behaves like a phone’s assistant, is worth the ten minutes it takes.
How Does Location History From Connected Vehicles Create Risk?
A detailed, continuous location history reveals patterns most people would never volunteer directly, home address, workplace, daily routine, places of worship, medical visits, all inferable from where a vehicle regularly travels and parks.
This connects directly to your phone’s location data and physical safety risks, since a vehicle’s location history creates a second, often less scrutinised, stream of the same category of sensitive information.
Ride-sharing apps carry a related risk specifically around driver and passenger verification, since a compromised or spoofed driver account can place a passenger in a vehicle with someone who is not who the app indicates, a genuine physical safety concern documented in multiple reported cases.
Fleet and rental vehicles introduce a further wrinkle, since the connected services installed by a rental company or fleet operator sometimes persist a renter’s paired device and navigation history well beyond the rental period, quietly available to the next renter or to the fleet operator itself. Treating a rental car’s infotainment system with the same caution as a hotel’s shared computer, avoiding account logins you would not want a stranger to inherit, is a reasonable working rule.
How Do You Limit Vehicle Data Collection Where Possible?
Review your vehicle’s connected services settings, many manufacturers allow disabling specific data-sharing features, including third-party sharing with insurers or advertisers, without disabling core vehicle functions.
Before selling or returning a leased vehicle, perform a factory data reset specifically for the infotainment and connected systems, since paired phones, saved locations, and stored contacts frequently persist through a standard vehicle handover otherwise.
Verify ride-share driver and vehicle details directly against the app before entering any vehicle, and trust a mismatch as a reason to decline the ride entirely, regardless of how minor the discrepancy seems in the moment.
Only scan QR codes at charging stations or parking meters that appear to be part of the original equipment, and if a machine also accepts a tap-to-pay card or the operator’s own app directly, use that route instead of a QR code wherever the option exists, since it removes the specific vulnerability a pasted-over sticker relies on entirely.
When buying a used connected vehicle, ask the previous owner directly, or check the settings menu yourself, for any lingering paired accounts, saved locations, or active subscriptions to connected services, since these can otherwise persist invisibly under a previous owner’s identity for months after a sale completes.
For more on this, see Mozilla’s *Privacy Not Included guide, EFF’s Surveillance Self-Defense guide, and the FTC’s consumer protection guidance.
Frequently Asked Questions
Can I opt out of my car sharing telemetry data with the manufacturer entirely?
Often only partially. Core safety and diagnostic data collection is frequently mandatory, but sharing with insurers, advertisers, or other third parties can usually be disabled separately in the connected services settings.
Is a rental car’s data as much of a risk as my own vehicle’s data?
Yes, and it is frequently overlooked. Rental and ride-share vehicles often retain paired phone data, navigation history, and saved locations from previous renters, which is worth checking and clearing when you return or exit a shared vehicle.
Connected vehicle data privacy matters because your car has become one of the most data-rich environments in your daily life, and most of the data collection has no clear off switch built in by default.
For better connected vehicle data privacy, check your vehicle’s connected services settings this week and disable any third-party data sharing you did not deliberately opt into.
If this was useful, share it with someone who needs to know.
