How to Protect Your Privacy When Selling Your Car

Modern cars are rolling data centers. Your vehicle's infotainment system, connected services, and onboard sensors have been quietly collecting your personal information since the day you first paired your phone. Before you sell, trade in, or lease-return your car, you need to scrub every trace of your digital life from it -- because one in three used car buyers report finding the previous owner's personal data still stored in the vehicle they purchased.

Your Car Knows More About You Than You Think

Today's connected vehicles store an alarming amount of personal information. Here is what your car's systems may have recorded:

• Contact lists and call history: Every phone number, name, and call log synced from your paired smartphone
• Text message previews: Recent messages displayed on the infotainment screen that remain cached in the system
• Navigation destinations: Your home address, workplace, frequented locations, and complete travel history
• Garage door codes: HomeLink or similar systems that store codes to open your garage, gate, or other access points
• WiFi passwords: Saved network credentials from your home, office, and other locations
• Paired phone details: Bluetooth device names, MAC addresses, and connection profiles
• Voice commands: Some manufacturers record and store voice assistant interactions
• Search history: Queries entered into the infotainment system's search functions

This is not a theoretical concern. A study found that roughly one-third of used car buyers discovered the previous owner's personal data still accessible in the infotainment system. That means your contact list, home address, and even garage door codes could end up in a stranger's hands if you skip the data wipe.

The Complete Data Wipe Checklist

Follow every step on this list before handing over your keys. Skipping even one can leave your personal information exposed.

Step 1: Factory Reset the Infotainment System

Every modern infotainment system has a factory reset option, usually found in the Settings or System menu. This is your most important single action -- it should erase saved contacts, call history, message caches, and personalization settings. However, a factory reset alone is not always comprehensive, which is why you need to complete every remaining step as well.

To find the reset option, look under Settings, then System, then Reset or Restore Factory Settings. The exact path varies by manufacturer. Check your owner's manual if you cannot locate it.

Step 2: Unpair All Bluetooth Devices

Before or after the factory reset, go into the Bluetooth settings and manually delete every paired device. Some systems retain Bluetooth pairing records even after a factory reset. Removing them ensures that your phone's name, identifier, and connection history are erased from the vehicle.

Step 3: Remove Saved WiFi Networks

If your car has WiFi connectivity, it may have saved your home network name and password, along with credentials for other networks you connected to. Navigate to the WiFi settings and delete all saved networks individually.

Step 4: Delete Navigation History and Saved Destinations

Your navigation system contains a detailed record of everywhere you have driven, searched for, or saved as a favorite. This includes your home address, workplace, and any other locations you frequented. Clear the navigation history, delete all saved favorites, and remove your home and work addresses from the system.

Step 5: Sign Out of All Connected Accounts

If you have used Apple CarPlay, Android Auto, or any streaming services through the infotainment system, sign out of every account. This includes music services like Spotify or Apple Music, podcast apps, and any other service you logged into through the car's interface.

Step 6: Contact the Manufacturer to Deactivate Connected Services

This is the step most people miss, and it may be the most important one. Connected car services like OnStar (GM), Toyota Connected Services, HondaLink, FordPass, BMW ConnectedDrive, and Mercedes me continue to operate through the vehicle's built-in cellular connection -- independently of your phone. If you do not contact the manufacturer to deactivate these services, the car may continue transmitting location data and other information tied to your account even after the sale.

Call the manufacturer's customer service line or visit their website to request full deactivation of connected services and deletion of your account data associated with that vehicle.

Step 7: Remove the Car From Your Manufacturer's App

Open the manufacturer's smartphone app (FordPass, myChevrolet, Toyota, Honda, BMW, etc.) and remove the vehicle from your account. As long as the car remains linked to your account, you may continue receiving data from it -- and the manufacturer may continue associating it with your personal profile.

Step 8: Reset Garage Door Opener Memory

If your car has a built-in garage door opener like HomeLink, the programmed codes need to be erased. The process typically involves holding two of the three HomeLink buttons simultaneously for about 10 seconds until the indicator light flashes. Check your owner's manual for the specific procedure. Failing to do this means the next owner can open your garage door.

Step 9: Remove Dashcam SD Cards and Data

If you installed an aftermarket dashcam or your vehicle has a built-in recording system, remove any SD cards and verify that stored footage has been deleted. Dashcam recordings can reveal your daily routes, home location, license plates of people you know, and audio conversations recorded inside the vehicle.

Step 10: Handle Lease Returns Properly

If you are returning a leased vehicle rather than selling one you own, complete all of the steps above and then take one additional action: contact the leasing company and request that your personal data be deleted from their systems and from the vehicle before it is resold. Document this request in writing so you have a record.

State Privacy Laws Can Help

If a manufacturer is uncooperative about deleting your data, you may have legal leverage. California's Consumer Privacy Act (CCPA) and similar laws in other states give residents the right to request deletion of personal data collected by businesses, including automakers. When contacting the manufacturer, reference these rights explicitly and request written confirmation that your data has been removed from their servers -- not just from the vehicle itself.

What About Data Already Collected by the Manufacturer?

Even after you wipe the car and deactivate connected services, years of driving data, location history, and behavioral patterns may still exist on the manufacturer's servers. The 84% of car companies that sell or share data have likely already distributed some of your information to third-party data brokers, advertisers, and insurance companies.

This is where the problem extends beyond what you can fix by wiping the car alone. Your driving patterns, location history, and personal details may have already been aggregated into data broker profiles that link your name, address, phone number, and other personal information.

Protect the Data That Has Already Left Your Car

Wiping your vehicle's infotainment system handles the data stored on the car itself, but it cannot undo years of data sharing between your car's manufacturer and third-party data brokers. These brokers may already have your home address, daily routines, and personal details derived from connected car data -- information that anyone can find through a simple online search.

PrivacyOn removes your personal information from over 100 data broker sites, including those that may have received data from connected car services. While a factory reset protects the data physically stored in your vehicle, PrivacyOn protects the personal data that has already been collected, aggregated, and made publicly available across the internet. Selling your car should not mean selling your privacy along with it.