Your Car Is a Privacy Problem (and So Is the Hire Car)

Why are connected cars in Australia's privacy reforms?

When the Attorney-General's Department released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August, most coverage focused on the big-ticket items: a "fair and reasonable" test on data collection and a right to erasure against large digital platforms. Less noticed was the scope. Among roughly 40 measures, the draft includes new obligations aimed at AI, wearable surveillance technologies, connected vehicles and targeted advertising — categories the current Privacy Act doesn't address directly.

Consultation closed on 18 September. The Government has said it wants the Bill tabled before the end of the year, but no start date has been announced.

So the law is catching up, slowly. In the meantime, it's worth knowing what your car is already keeping.

What does a connected car actually record?

A modern car is a computer on wheels, and it behaves like one. Depending on the make and model, it can log where you went and when, how fast you drove, and which phones were paired to it.

The phone pairing is the part most people miss. When you connect your phone over Bluetooth for hands-free calls or music, the car often copies your contacts, your recent calls and sometimes your messages into its own memory, so it can show them on the screen. Navigation systems keep recent destinations and a "home" address. Many cars also have a manufacturer app that connects your account to the vehicle, and some send driving data back to the manufacturer.

None of that disappears when the car changes hands. Sell it, trade it in, or return a lease, and the next owner — or the next person at the dealership — may be able to scroll through your address book and see where you live.

How to wipe your car before you sell it

This takes about fifteen minutes and should be part of every sale, trade-in or lease return. Menu names vary by manufacturer, so look for anything labelled "factory reset", "reset to defaults", "clear personal data" or "delete all users". Your owner's manual or the manufacturer's website will have the exact steps for your model.

1. In the car's Bluetooth or phone settings, delete every paired phone — yours and anyone else's.
2. On your own phone, "forget" the car in its Bluetooth settings too.
3. Clear navigation history, saved destinations and your home and work addresses.
4. Sign out of any accounts the car holds, such as music, maps or the manufacturer's own service.
5. In the manufacturer's app or website, remove the vehicle from your account and cancel any connected-services subscription, so you're not still receiving its location after it's gone.
6. Run a full factory reset of the infotainment system, then check the phone and navigation menus to confirm your data has gone.
7. Hand over or delete any garage-door or gate openers programmed into the car.

The hire car you forgot about

Here's the one that catches almost everyone. You pick up a rental at the airport, connect your phone for maps and music, and return it three days later without a second thought. Your contacts, call log and destinations may still be sitting in that car when the next driver gets in.

Open the phone menu in a hire car and there's a fair chance you'll find a list of previous renters' phones. That tells you everything you need to know.

The fix is quick. Before you hand the keys back, delete your phone from the car's paired devices and clear the navigation history. If you'd rather avoid the problem altogether, use a USB cable for charging only and decline any prompt to sync contacts or messages — or just use your phone's own maps on a dash mount.

Hire cars are one piece of a wider travel-privacy picture that also includes hotel Wi-Fi and airport charging points. We maintain a separate site, NoSpyTravel, focused on practical travel privacy gear, if you're planning a trip and want to cover the rest.

See travel privacy essentials at NoSpyTravel →

Your watch and fitness tracker know even more

The same draft reform that names connected vehicles also names wearables. The OAIC raised the issue itself in an August 2026 blog post titled "Surveillance wearables — are we through the looking glasses?"

A watch that tracks your heart rate, sleep and location is, in plain terms, a monitoring device you paid for and put on voluntarily. That doesn't mean you should stop wearing it. It means you should know where its data goes.

Open the companion app and check three things. First, what it syncs: location, health measurements, sleep, contacts, messages. Turn off anything you don't use. Second, who it syncs to: look for "connected apps", "partners" or "third-party access" and remove anything you don't recognise or no longer need. Third, what's public: many fitness apps share activity maps by default, and a map of your regular run usually starts and ends at your front door. Set your profile and activities to private, and use any "privacy zone" feature to hide the area around your home.

If you've stopped using an old device or app, delete the account rather than just the app. JustDeleteMe is a free directory of deletion links for hundreds of services. Mozilla's free Privacy Not Included guide is also a useful place to read about the privacy policies of connected products before you buy.

Who else gets your car and wearable data?

This is where it gets uncomfortable. Ask a government agency for the records it holds about you and, in most cases, it's legally required to answer. Ask a car maker, an app developer or the data partners they share with, and you'll usually get a link to a long privacy policy and not much else.

Under the current Privacy Act, you can request access to the personal information an organisation holds about you, and complain to the Office of the Australian Information Commissioner (OAIC) if it won't respond properly. In the UK, it's the ICO; in the EU, your national data protection authority. It's worth doing, but be realistic: answers are often slow, partial or buried in raw data. The most dependable protection is limiting what gets collected and wiping what you leave behind.

Keyless entry and relay theft: a quieter risk

One more car issue, and it's about physical security rather than data. Many modern cars use keyless entry: walk up with the fob in your pocket and the doors unlock; press a button and the engine starts. It works because the car and the fob talk to each other by radio over a short distance.

Relay theft takes advantage of that. It's a well-documented technique in which thieves use equipment to pick up the signal from a key fob — say, one sitting on a hallway table inside the house — and relay it to the car parked outside, so the car behaves as if the key is right next to it. It doesn't work on every car, and manufacturers have added protections to some newer models, but it's a known risk worth taking seriously.

The protections are simple. Keep keys away from your front door and windows. Check your manual to see whether your fob has a sleep mode or a way to switch off keyless entry when you don't need it. A steering lock adds a visible, physical barrier. And store your keys at home in a signal-blocking pouch or a closed metal tin, which stops the fob communicating until you take it out — test it by standing next to the car with the key inside and checking the doors stay locked.

A signal-blocking pouch only works when it's fully closed. Test yours at the car every so often, as the lining can wear with use.

What to do this week

Check your car's phone menu and delete any paired devices you don't recognise. If you're selling or returning a car soon, run the factory reset and remove it from your manufacturer account. Open your wearable's app and review what it syncs and to whom. And find somewhere better than the hallway table for your keys.

The law may eventually require carmakers and device companies to handle this data more carefully. You don't have to wait for it.