Digital dirt: Why the data you leave in a rental car could threaten your privacy
Information not deleted from onboard infotainment systems in vehicles is a 'considerable problem'
Larissa Reinders plugs her phone into her rental car the moment she gets in and often has to delete information from previous drivers that pops up on the screen.
The Fredericton woman admits it hasn't crossed her mind that she might be leaving behind her own digital fingerprint when she returns the vehicle.
"You do the quick check," she said.
"Unplug your phone and then you make sure there's no Tim Hortons cups and then you leave. I never think to delete that phone information. Ever."
Reinders isn't alone. CBC checked several cars in Fredericton and found contact information on both rental and pre-owned cars, leaving breadcrumb trails of information visible to the next person who sits behind the wheel.
It's information car rental companies and resellers are often not deleting, leaving a digital footprint that can threaten the privacy of those unsuspecting drivers.
- Smart homes, smart cars
- Why privacy can be a problem with apps
- Canadians not terribly savvy about digital privacy, poll finds
"It's a considerable problem, actually," said Rajen Akalu, an assistant professor at the University of Ontario Institute of Technology.
"Most people don't realize the amount of information that they leave behind when they pair their phone, for example, on any rental car."
The rental experience
CBC News paired a phone to a Toyota Camry rented from Enterprise Car Rental in Fredericton.
Three names and numbers were stored on the screen.
When each number was called, each person who answered was surprised. All three wanted to remain anonymous, and most thought the car rental company should have done what they hadn't.
"There's nothing stopping them from deleting them if we haven't done it," said one businessman.
What's stopping them
Laura T. Bryant, communications vice-president at Enterprise Holdings, said the company has almost two million vehicles worldwide, in 300 makes and models, making it almost impossible to have staff trained to delete information.
"We can't train every employee," Bryant said.
"It's hard to train someone to do this 10 different ways."
She said Enterprise Holdings, which owns Alamo, Enterprise, and National rental car agencies, is working with auto manufacturers to come up with a "consistent way" to delete information.
In other words, the company wants a delete button for data that is the same in all vehicles.
"We buy more cars than anybody else in the world, so they do listen," Bryant said.
She also said Enterprise staff look at vehicles between rentals and before they sell the cars and are supposed to remind customers about deleting their data.
When told that none of the renters who spoke to CBC had been reminded to delete their personal data, Bryant replied: "They should be asking you."
Hertz and Avis both said they take customer privacy seriously but neither rental car agency said staff delete the information for customers.
Click of a button
Lucas DiCarlo, a salesman with York Auto in Fredericton, said leaving digital fingerprints behind in a car is as common as forgetting about the snow brush in the trunk.
As he cycled through the menu in one vehicle, he pointed out "previous addresses, favourites, address book, frequently visited addresses."
In a shiny blue Infiniti FX35, with a click of a button, the navigation system took us to the former owner's home address.
A check of that address online soon led to a name, a photo of a house, a streetview and phone number.
A picture emerges
In a white BMW 328i purchased at auction in Ottawa, a single name popped up: "Daphne." That led to another contact, with a phone number.
That contact was a man named Antwon Christian. It took very little detective work to link him to his wife, Daphne Marie Christian, see pictures and read about their family, including Daphne Marie's Cape Breton roots and where they are living now — Florida.
When reached by phone, Antwon Christian said he was surprised his number was left in his wife's former car but he wasn't surprised about the information trail that led to him.
"No matter how much you hide any of your data, if someone wanted to find something out about [you], they can," Antwon said.
"But I see your point about how easy it was for you to find out about us."
He said he and his wife should have wiped things clean, but he felt the reseller should be the second line of defence.
"The car dealership should do a factory reset on everything before they actually sell the car," Antwon Christian said.
KAR Auction Services sold the white BMW at an Ottawa auction and the blue SUV at a Montreal auction to the New Brunswick dealer.
'They check whether or not the car has a full tank of gas when you return it. They can equally ensure that the data is wiped from the unit, right?- Rajen Akalu
KAR doesn't own the vehicles and only offers a menu of services such as repainting and repairing, spokesman Tobin Richer said.
Staff have only wiped a few vehicles on special request and there isn't a standard way to do this across all vehicles, he said.
"Given the complexity and variation of the technology, the liability associated with the work and the level of resources and investment required to perform the services thoroughly and accurately, it is not a service we are currently offering to vehicle consignors."
Just another check
Akalu, of the University of Ontario Institute of Technology, did a report for Canada's privacy commissioner on infotainment platforms in vehicles and their implications for privacy.
The thinking in the industry now is that the information on a phone should remain there, so that when you disconnect, it goes with you, he said.
Renting a car would be like sharing a laptop. You would sign in with your own personal settings, which otherwise remain invisible to other users.
"But it's not really clear how that will be borne out," Akalu said.
Ultimately, if you are going to pair your phone, experts suggest finding out how to reset the car to its factory setting.
In the case of car rental companies, "they check whether or not the car has a full tank of gas when you return it," Akalu said.
"They can equally ensure that the data is wiped from the unit, right?"
ABOUT THE AUTHOR
