Digital dirt: Why the data you leave in a rental car could threaten your privacy

Car rental companies and vehicle resellers often don’t delete data left in the infotainment system by previous drivers, creating a digital footprint that can threaten the privacy of those unsuspecting drivers.

Information not deleted from onboard infotainment systems in vehicles is a 'considerable problem'

Larissa Reinders regularly rents cars and has always assumed the rental agencies delete personal information left behind by customers. (Submitted)

Larissa Reinders plugs her phone into her rental car the moment she gets in and often has to delete information from previous drivers that pops up on the screen.

The Fredericton woman admits it hasn't crossed her mind that she might be leaving behind her own digital fingerprint when she returns the vehicle.

"You do the quick check," she said.

"Unplug your phone and then you make sure there's no Tim Hortons cups and then you leave. I never think to delete that phone information. Ever."

Reinders isn't alone. CBC checked several cars in Fredericton and found contact information on both rental and pre-owned cars, leaving breadcrumb trails of information visible to the next person who sits behind the wheel.

Drivers often pair their phones with the infotainment system in cars. (Catherine Harrop/CBC)

It's information car rental companies and resellers are often not deleting, leaving a digital footprint that can threaten the privacy of those unsuspecting drivers.

"It's a considerable problem, actually," said Rajen Akalu, an assistant professor at the University of Ontario Institute of Technology.

"Most people don't realize the amount of information that they leave behind when they pair their phone, for example, on any rental car."

The rental experience

CBC News paired a phone to a Toyota Camry rented from Enterprise Car Rental in Fredericton.

Three names and numbers were stored on the screen.

A 'my contacts' list can easily become an 'other people's' contact list if it's left behind in a car that's rented or sold. (Catherine Harrop/CBC)

When each number was called, each person who answered was surprised. All three wanted to remain anonymous, and most thought the car rental company should have done what they hadn't.

"There's nothing stopping them from deleting them if we haven't done it," said one businessman.

What's stopping them

Laura T. Bryant, communications vice-president at Enterprise Holdings, said the company has almost two million vehicles worldwide, in 300 makes and models, making it almost impossible to have staff trained to delete information.

"We can't train every employee," Bryant said.

"It's hard to train someone to do this 10 different ways."

She said Enterprise Holdings, which owns Alamo, Enterprise, and National rental car agencies, is working with auto manufacturers to come up with a "consistent way" to delete information.

A blue Infiniti and a white BMW arrived on a Fredericton car lot with information from previous drivers stored in their dashboards. (Catherine Harrop/CBC)

In other words, the company wants a delete button for data that is the same in all vehicles.

"We buy more cars than anybody else in the world, so they do listen," Bryant said.

She also said Enterprise staff look at vehicles between rentals and before they sell the cars and are supposed to remind customers about deleting their data.

When told that none of the renters who spoke to CBC had been reminded to delete their personal data, Bryant replied: "They should be asking you."

Hertz and Avis both said they take customer privacy seriously but neither rental car agency said staff delete the information for customers.

Click of a button

Lucas DiCarlo, a salesman with York Auto in Fredericton, said leaving digital fingerprints behind in a car is as common as forgetting about the snow brush in the trunk.

As he cycled through the menu in one vehicle, he pointed out "previous addresses, favourites, address book, frequently visited addresses."

People who sell or rent cars almost always leave a digital trail, because car dealerships, rental agencies and drivers themselves don't erase the data before new people take over a car. 1:12

In a shiny blue Infiniti FX35, with a click of a button, the navigation system took us to the former owner's home address.

A check of that address online soon led to a name, a photo of a house, a streetview and phone number.

A picture emerges

In a white BMW 328i purchased at auction in Ottawa, a single name popped up: "Daphne." That led to another contact, with a phone number.

That contact was a man named Antwon Christian. It took very little detective work to link him to his wife, Daphne Marie Christian, see pictures and read about their family, including Daphne Marie's Cape Breton roots and where they are living now — Florida. 

When reached by phone, Antwon Christian said he was surprised his number was left in his wife's former car but he wasn't surprised about the information trail that led to him.

A scrap of information that Daphne Marie Christian left behind in a rented BMW led to the online discovery of this picture of her and her husband, Antwon Christian. (Facebook)

"No matter how much you hide any of your data, if someone wanted to find something out about [you], they can," Antwon said.

"But I see your point about how easy it was for you to find out about us."

He said he and his wife should have wiped things clean, but he felt the reseller should be the second line of defence.

"The car dealership should do a factory reset on everything before they actually sell the car," Antwon Christian said.

KAR Auction Services sold the white BMW at an Ottawa auction and the blue SUV at a Montreal auction to the New Brunswick dealer.

'They check whether or not the car has a full tank of gas when you return it. They can equally ensure that the data is wiped from the unit, right?- Rajen Akalu

KAR doesn't own the vehicles and only offers a menu of services such as repainting and repairing, spokesman Tobin Richer said.

Staff have only wiped a few vehicles on special request and there isn't a standard way to do this across all vehicles, he said.

"Given the complexity and variation of the technology, the liability associated with the work and the level of resources and investment required to perform the services thoroughly and accurately, it is not a service we are currently offering to vehicle consignors."

Just another check

Akalu, of the University of Ontario Institute of Technology, did a report for Canada's privacy commissioner on infotainment platforms in vehicles and their implications for privacy.

Rajen Akalu, who has studied infotainment platforms in cars and their implications for privacy, says that ideally, drivers' data would leave cars with their phones. (Submitted)

The thinking in the industry now is that the information on a phone should remain there, so that when you disconnect, it goes with you, he said.

Renting a car would be like sharing a laptop. You would sign in with your own personal settings, which otherwise remain invisible to other users.

"But it's not really clear how that will be borne out," Akalu said.

Ultimately, if you are going to pair your phone, experts suggest finding out how to reset the car to its factory setting.

In the case of car rental companies, "they check whether or not the car has a full tank of gas when you return it," Akalu said.

"They can equally ensure that the data is wiped from the unit, right?"

About the Author

Catherine Harrop

Catherine Harrop loves a good story. She has been a journalist for more than 25 years.

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.