What is your phone telling your rental car?

Share This Page

When I rent a car, it’s fun to get all the bells and whistles – like navigation, hands-free calls and texts, streaming music and even web browsing. But did you know that cars with these features might keep your personal information, long after you’ve returned your rental car? Here are some things to keep in mind when renting a connected car.

What happens when you rent a connected car? When you use the car’s infotainment system, it may store personal information. It may keep locations you entered in GPS or visited when travelling in the rental car – like where you work or live. 

If you connect a mobile device, the car may also keep your mobile phone number, call and message logs, or even contacts and text messages. Unless you delete that data before you return the car, other people may view it, including future renters and rental car employees or even hackers.

If you decide to rent a connected car, here are some steps you can take to protect your personal information:

  • Avoid connecting your mobile phones or devices to the infotainment system just for charging. It’s safer to use a cigarette lighter adapter to charge devices, instead of the car’s USB port. Why? In some cases, the USB connection may transfer data automatically.  
  • Check your permissions. If you do connect your device to the car, the infotainment system may present a screen that lets you specify which types of information you want the system to access. Grant access only to the information you think is necessary – if you just want to play music, for example, you don’t need to okay access to your contacts.
  • Delete your data from the infotainment system before returning the car. Go into the infotainment system’s settings menu to find a list of devices that have been paired with the system. Locate your device and follow the prompts to delete it. The owner’s manual and the rental car company may have more information about how to delete your data.

Want to learn more about how your personal information is shared and used every day? Watch this short video.

 

Comments

Interesting info.

Why can I not view any of your videos? This one, like most, says: "The video is bad or in a format that cannot be played on your browser Error Code: Media_Err_Decode"

I can’t say for sure what is wrong, but it sounds like you may need to upgrade your browser. In the meantime, you can access our videos on the FTC’s YouTube channel. For the video in this blog post, please watch, Sharing Information: A Day in Your Life. Hope this helps.

Very useful info,f.t.c:) thank you.

Thank you for supplying such great information! I will re-post this.

This happened to me 4 years ago, and I have had terrible, terrible problems since then. Thank you for informing others.

Thank you so much for the information and continue to do amazing work.

Thank You did not know how easy info can be shared or sold. Its an awareness tip too always keep in mind.

Very helpful, thanks

OMG that is really scary. I never would have realize how much of me is out there and who has Me! Terrible, Scary, I really do not feel okay about this at all. Thank you for all the information I'm surely going to change a lot of things. Thanks again I'm speechless

Good information, but what are the alternatives?

Don't use any technology. Plenty of people have got by without.

I was a victim of Hertz. My rental was stolen by someone who broke into my house I reported it to the police with Hertz rental while I made the call they know I didn't steal there was a police report made against me saying I did not return saying I stole it but how can that justice when the rental company drew out of my bank account $2700.00 and put me in 3057$ in the negative and the card I gave them had to be turned off but they still let it go through. I was told that I was not at fault so why write a police report saying I intentionally stole the car this is ludicrous and a false charge of brought to trial but a credit union let this charge go through knowing I did not have that kinda money. So what is the best recrouse for this action?

You can file a complaint about a company at FTC.gov/complaint. You may also want to contact the car rental company and your credit union and show them the police report and ask if they can refund you for overcharges that occurred becuase of a crime.

You should never use a debit card to rent a car, because if there's a dispute, this is exactly what happens. Also, you are likely liable for their loss of use (look at your contract) and an insurance deductible unless you bought their insurance. Sorry this happened to you, what a bummer.

Thanks for warning the public Now get to work applying that to all the government sites that are constantly being hacked including the Obamacare website, Dept of Homeland Security the IRS etc etc. You government folks love to lecture us but fail to protect our most basic rights.

Awesome. Thank you

This would include Uber/Lyft/Cabs too! I've been in a few cars where the driver offers to charge your phone or let you play your own music!

I suggest resetting the car's infotainment system to the factory default before returning.

Good article, thank you

Great information. Thanks.

Seems like the rental companies should take precautions to avoid liability by adding a "reset infotainment system" task to the vehicle preparation procedures.

So you mean my flashlight app that has access to my location, contacts, phone and browsing history might be giving my information to people who will sell it? What about Pokemon? Is Pikachu selling where I am and what I'm doing as well? Is my fitbit and wifi scale telling my health insurance company how sedentary I am and what my BMI is? Are Walmart, Amazon and every other retailer and service provider data mining site tracking, purchase, location, health, contact and income information to find out what I want or need and what type of communication might manipulate me in their favor? Is any of this fraudulent, deceptive or unfair?

Yes.

The article is very vague on what data is accessible. Almost all vehicle hands free systems have basic security built in. At best, a follow-on user can access your device's profile name (John's iPhone), and sometimes a MAC address of the Bluetooth connection. Now, given the proper vehicle forensic tools, one could extract your personal information within minutes over USB, depending on the manufacturer. Best bet, just use a 12v charger and smartphone navigation when renting.

Also good advice for selling your car to ensure no personal data loss. I purchased a car from a very well known car dealer and the previous owners information was still present. Do not trust the dealer to take this step. I had their home address, names, and it was likely the programmable remote was still configured to open their garage door.

Seems like good advice when you trade/return your personal vehicles as well.

Go to prison and then think about what rental car companies in the United States have been allowed to do with consumers.

This is common sense. People are still to close minded to think about the obvious.

I noticed this when I recently rented a car. There was a whole list of previous renters phones listed on the display. I asked the rental agent about it and he claimed no data was obtainable from it, that it was just a list of phones that had connected to the car's system. I would not even think of connecting my personal information to a vehicle I was just renting for a few days and would make sure I erased my activity and phone information if I did connect for some reason. People need to be very careful what information they leave behind digitally.

Looking for permission to reprint this article for use within the Crime Stoppers organization. Please contact me

You're free to use any of the information here at consumer.ftc.gov. -- you don't need our permission. We're happy to share!

It's the information is free and in the public domain. You can copy, print, link to it on social media, add it to a newsletter ... whatever you wish, and you don't need to say the information came from the FTC.

Leave a Comment

Comment Policy

Read Our Privacy Act Statement

It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system, and user names also are part of the FTC’s computer user records system. We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.