Syncing a Phone to a Rental Car Can Leave Private Data for the Next Driver
Engadget reports that pairing a phone with a rental car can expose contacts, music-account log-ins and navigation history to the next driver. Renters can decline contact syncing, use encrypted CarPlay or Android Auto, and unpair devices before returning the vehicle.
Renting a car in an unfamiliar city often leads drivers to connect a smartphone to the vehicle's infotainment system for navigation or music. That convenience can leave personal data in the car after it is returned. The data at risk includes a driver's name, stored contact information and log-ins for music-streaming accounts. Phone and account names can reveal more than users expect. In 2015, Engadget reported, a Baltimore man was able to track down the teenagers who stole his car through one of their phones, which had a name matching a public Instagram handle.
Navigation and GPS history may be the most sensitive data visible in a rental car. It can show the next driver where a renter was staying or where the renter may work, Engadget reported. The risk depends on how a phone is connected and what the driver does before returning the car.
Bluetooth pairing carries more risk, while a USB connection to Apple CarPlay or Android Auto is encrypted, meaning data transmitted between the device and vehicle is protected from outside access. Car entertainment systems typically do not access a phone by default. When connecting via Bluetooth, a pop-up on the vehicle or phone screen asks whether to sync all contacts. Selecting no lets a driver use the phone for music and navigation without sharing unnecessary information.
Most rental car privacy policies state that customers are responsible for data transmitted while using the vehicle. Avis, for example, says connected vehicles may automatically transmit data to the manufacturer, and that drivers who sync devices should know data can be stored in the infotainment center indefinitely by default.
"Please always unpair your device and ensure that you take the necessary steps to remove your information from the system when you return the car at the end of your rental period," the Avis policy says. "We are not responsible for any data that is left in the vehicle as a result of your use."
Before returning a rental car, the Federal Communications Commission suggests in its Consumer Guide on security for Bluetooth connections that a driver first disconnect from the car completely in the phone's Bluetooth settings and remove the vehicle from paired devices. The driver should then go directly into the navigation system and delete the phone from its history. If the in-car navigation was used without connecting a phone, any history should also be deleted, including saved addresses.
Many cars offer a factory reset process that will completely wipe away traces of the rental period, and the vehicle manual can explain how to perform it. A driver who wants to be extremely safe can avoid connecting to the car at all and navigate from the phone instead. That may prevent using the car system as a music player, but it leaves the phone's data untouched.