Two Collision Industry Conference (CIC) committees offered presentations at this summer’s conference on what collision repairers need to understand about privacy issues related to consumer data collected by or stored in vehicles, including total loss vehicles that owners may see for the last time at a body shop.
One committee offered help for those seeking information on removing such personal data. The other committee’s speaker suggested that getting involved in such removal may not be something body shops want to do in any formal way.
Andrea Amico, founder and CEO of Privacy4Cars, said he’s been involved in personal data issues related to vehicles for more than a decade, working with both governments and businesses. To help consumers understand the issue, he created a free website where anyone can enter the VIN of their vehicle to see “what data your car collects, where it’s going, what you can do about it and what technical rights you have about it.”
“A cell phone in the United States has about 40 sensors,” Amico said. “The average car made in the last 10 years in the United States has about 250. So, reality is that cars have become the third personal large computing device that consumers use every day.”
Thanks to Bluetooth, he said, when you connect that phone to the vehicle, it essentially has all the information that is on that phone. And unlike the phone, he said, there’s often little encryption, tools or controls for that information in the vehicle.
Even older vehicles store data
To demonstrate what that means, Amico listed five vehicles, ranging from (the oldest) a 2005 Dodge truck to a 2024 Tesla 3. He asked CIC attendees to raise their hands if they thought a driver’s medical records and credit card information might be stored in the Tesla, and most hands in the room went up. As he worked way down the list of cars to the 2005 Dodge, most hands went down.
“You can actually find them in the Dodge as well, because if you set up, like I do, one of the services that every time I swipe my credit card, you get a text message with a copy of the transaction,” Amico said. “And every time I pick up [something] at CVS, I get a notice about [it]. You actually can find these things [stored in the vehicle] because when you connect your phone over Bluetooth, your entire text message database gets sucked in and is sitting there unencrypted.”
The same may be true about Social Security numbers, bank account numbers and security PINs, he said, because many people put such information in their contact lists on their phone. He said he recently collaborated with a university to pull data [with permission] from a vehicle, then ran it through AI to craft emails.
“I know you go to Chick-fil-A, and I know who your friends are, and I'm going to send you and your friends a coupon, and you’re going to click on a [malicious] link for five bucks so you can get your Chick-fil-A for free,” Amico said.
Liability for personal data in vehicles
Amico said his organization’s work with salvage auctions has found that 90 percent of the vehicles arriving at such auctions that are capable of capturing customer personal information still have such data stored. While industry surveys have found that about one in five shops are regularly clearing such data from total losses — and more than one-third said they are being paid by insurers to do so, according to “Who Pays for What?” survey findings — Amico cautions that shops don’t have privacy-related liability for such data unless they say they are clearing it as a service to the customer.
Tracy Dombrowski said shops can help customers go through four steps to remove their personal data from a vehicle.
“Once you start to do that, there's a number of things that you really want to think about very hard because you may be bringing on more liability to your shop than you actually intend to,” Amico said. “I understand trying to be nice to consumers. But who actually owns the liability? That’s the insurers, the moment they say that the vehicle is a total loss.”
Amico said the lawsuits related to information collected by or stored in vehicles are generally based on alleged unfair or deceptive acts: Consumers not being told about what’s being collected, or not being told what’s being done with such information. Shops offering data-clearing as a service could be taking on liability if it’s found they aren’t fully eliminating all such information.
“If you start to think about making this a service, then you really need to understand the law,” Amico said. “You really need to understand how to make your processes robust and repeatable, and how to build records [of what you have done].”
A four-step process to remove personal info
But many shops seek to help their customers clear personal data from their total loss vehicle, and another CIC committee offered tips on how to do so.
Tracy Dombrowski of the CIC “OEM Industry Relations Committee” said recent social media posts by a former shop owner demonstrated the importance of customers disconnecting and clearing data from their vehicle. Dombrowski said that former shop owner had sold her own vehicle to a dealer without erasing or disconnecting her app for the vehicle.
“So, she was able to follow that vehicle from the sale to [its subsequent movement] to Florida and Texas,” Dombrowski said. “She was still able to remote start that vehicle, and access where it is located at any given time, all because the personal information was never erased from it.”
Dombrowski laid out a four-step process for clearing personal information from any vehicle.
“The first thing we really need to make sure is that we’re unpairing our phones, deleting those Bluetooth pairings or connected devices, from the infotainment system,” she said. “Then we want to clear the infotainment systems and set them back to factory settings. Clear any saved locations, your garage codes and addresses, from the navigation systems. And finally, remove that vehicle from the automaker’s phone app.”
When it comes to total loss vehicles, she said, it’s important to not clear or reset anything without the customer’s authorization, and it’s probably better to “just be able to coach the customer, and hand them the information or point them in the right direction to know how to clear their own data.”
“Some key questions to ask them when they’re in the shop are: Do you still have the OEM app on your phone? Are you able to control the vehicle from your app? If so, let’s look at how we can clear that,” Dombrowski said. “Do you have keys or cards that allow you to power on the vehicle? And let’s look at next steps for that. And then let’s walk through how to clear that information and make sure your privacy is protected.”
John Yoswick