I have a few year old Volkswagen. I'm security conscious and made sure to disable all the data collection I could find in the companion app, turn off remote access services, dig through the infotainment to turn off what I could, etc.

Last year I requested a Carfax on it, and one of the fields in the request was current mileage. I entered an estimate like 75000 miles. On form submission, that field failed validation with the red subtext along the lines of 'this is less than the last reported mileage of 75345, reported <5 or so days prior>'. Checking my odometer and looking at my past few days' trips, that was indeed accurate.

The car hadn't been to a shop or out of my possession in weeks, so I can only assume the telemetry was still dialing home and selling to third parties despite my best efforts to disable it.

Anecdotal and not unexpected in the grand scheme, but it still surprised me.

> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. However, if you use a wired USB connection then it does not do that (see the discussion here and elsewhere), so I exclusively use CarPlay via USB.

The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.

They are both very cagey with how they talk about this (or don't).

Does anyone have any details on this claim?

  Important: Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. However, if you use a wired USB connection then it does not do that (see the discussion here and elsewhere), so I exclusively use CarPlay via USB. I wish I had a way to completely disable the car’s Bluetooth functionality, but it’s deeply integrated into the head unit.

Following the thread linked to, the only thing I can find is very unsubstantiated; https://www.rav4world.com/threads/2019-rav4-dcm-deactivate-p... :

  One caveat, if you use bluetooth to connect your phone to the car DCM will use your phone to connect to the mother ship and presumably send your data. I only use my iPhone cable to connect to the car which does not have this effect.

I have the same car and want to do this, but not for the reasons the author noted but because the GPS unit in the car is broken when paired with Carplay and has the wrong compass heading causing navigation to be completely useless.

I have reported this to Toyota multiple times with videos detailing the problem and they have denied the problem and ultimately when faced with the evidence simply refused to fix it.

I've been a big fan of Toyota's Production System and their management culture, but this experience has really diminished the brand for me. I realize these problems exist with all cars today. The pattern seems to be to foist low-quality hardware and software on their customers and take no responsibility for the results. Software bugs aren't what they consider a "typical car problem" so they simply don't fix them.

The 2024 Ford Maverick has a single fuse for the telematics unit that you can remove without throwing a code or an error. No idea if this remained true after the 2025-2026 refresh, but worth knowing.

https://www.mavericktruckclub.com/forum/threads/telematics-f...

Just a note about Toyota specifically - There are many blog posts and articles out there alleging that Toyota shares your data with insurance companies.

As I own two Toyota's I have read through these carefully and consistently the theme is that the owner was opted into this program without knowing it (likely by the sales person clicking through setup steps to enable every feature). If you are not opted in, I have seen no evidence they share driving data.

When I set up my Toyotas, the app clearly walks through the programs they have and you must click either "yes/opt in" or "no/opt out" for each program. It is not opted in by default.

Be careful messing with your (modern) car like this. It may work at first glance. In some time in the future you may not be able to unlock your car.

As mentioned in the article as part of the introduction, there were problems with those car regarding security. Especially with the Rav4 where a colleague, Ken Tindell, showed a very serious flaw: https://kentindell.github.io/2023/04/03/can-injection/

Because of this OEMs build in more and more security, like SecOC with Autosar and other similar things. More and more of those security feature depend certificates in the devices that have an expiration time. Those certificates needs to be rotated regularly. If the rotation does not happen, because of missing communication with the mothership, then the security will fail, which finally will lock you out of your car.

That will be true for all the coming luxury car models.

IRC, Tesla has something like this for years in their cars. They can be offline for a certain period of time. But when this runs out, you will be out of luck.

> Unfortunately I think it’s only a matter of time before the modem and GPS become more deeply integrated into the car (making this blog post infeasible), or cars have more drastic failure modes when the modem/GPS is removed, or anti-right-to-repair laws get passed to further clamp down on this behavior.

Guaranteed

> Important: Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota.

How is this the case? I thought bluetooth was just sharing my phone's audio. Why would it allow requests over the internet? Surely there's a way to tell the phone not to give its internet connection to any connected bluetooth device?

I would like everyone to know that if you have a brand new Kia, the process is even easier. I spent $20 on the Kia service manual access (didn't even know that was a thing until I read OP's post) it finally figured it out.

Modern Kias with the CCNC cockpit have a data connectivity unit that exclusively handles cellular. If you can get this unit unplugged, which only requires two Phillips head screws to remove, your set. It took me nearly 2 years to figure this out. Thanks OP

> Strong Federal privacy laws would make posts like this unnecessary, that’s the world I’d rather live in.

yes. there ought to be a right to reasonable expectation of behavioral privacy where if it's not obvious and intrinsic to function that behavior is being recorded then it must be consented with functional opt-out.

gps tracking to the manufacturer of a car seems egregious. i wonder if it runs afoul of anti-stalking laws.

I was looking into this with Teslas. Apparently the car will not be bricked if you cut the antenna wires. They are in the side mirrors (both sides) and the wires are exposed when you pull the interior door panels.

If you then charge only at home you’re even more private than gas cars, which must stop at gas stations with cameras.

But both types of vehicles are easily spotted with Flock cameras. And if you keep your phone on that tracks you, too.

I’m not that paranoid so I won’t do it, I just wanted to know.

What is the suspected method of Bluetooth communication?

Afaik phones do not share their internet blindly to Bluetooth devices.

> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota

What is the basis for this claim? I've never heard of this capability.

Modern cars are horrible. I recently discovered that all new cars sold in the EU constantly beep at you for supposedly speeding, even though the system doesn’t work well, and it has to be turned off every time you start the car.

Related: Can I disable all data collection from my vehicle? (rivian.com) 760 points 14 days ago 361 comments

(https://news.ycombinator.com/item?id=47967786)

Buy Nissan instead, they will do that for you free of charge. I own 2021 Nissan Leaf and Nissan sent me an email early this year telling that the communication infrastructure costs too much for them and they are taking it down.

Jokes aside, I am seriously pissed at Nissan because it was one of reasons I bought it in the first place: to pre-heat or pre-cool the car remotely before going to work, while it is still plugged to the wall charger. And they just decided to take it down. Funny thing, they even mentioned in the email that "not to worry, I can still use my AC when I am in the car". Wow.

Sorry, rant. Anyway, my point being - buy Nissan Leaf, no connectivity guaranteed by the manufacturer, LOL.

There's going to be a lot of this going on in the future. RabbitLabs CAN Commander go BRRRRRRRRRRRRRRRRRRR.

I was debating replacing the head unit in my old VW, but I actually like that it has a six-disc CD changer, SD card slot (32GB max, with support for MP3, WAV, etc.), 40-pin iPod connection, and regular AUX in. I use my phone with a USB-C DAC and have never felt like I needed anything else. With AUX I can plug in my Walkmans as well (both cassette and MiniDisc)!

Dangerous, but hilarious (Dubai raver has set up a 303 and 606 to make acid house while he drives): https://www.youtube.com/watch?v=mwYtjQk0QaU

Thanks - Seeing how easy this was, encouraged me to do the same for my Subaru. The info and parts were easy enough to find.

Interestingly, Subaru itself used to make a DCM bypass kit for its cars. When AT&T shut down its 3G network, Subaru was stuck replacing all the DCMs, because they would search and search forever for a connection to a network that no longer existed, and slowly drain the battery. But there initially wasn't enough inventory to replace them all, so they offered these bypass kits if you weren't an active Starlink (cloud svcs) subscriber.

Apps like Spotify in my Volvo are convinced I am in New Jersey while I'm on the opposite coast. On one hand I like that inaccurate data is being peddled to advertisers but at the same time I would actually prefer regionally relevant ads if I have to listen to them anyway.

We need more posts like this. I'd love a follow-up where instead of removing it injects fake data to the system. I am tired of passively being digitally assaulted. If they are going to do this to me without my knowing consent I want to fight back.

It’s pretty unhelpful to list off other ways one’s privacy could be compromised in response to efforts like this. Privacy isn’t all all or nothing binary choice. Taking measures to improve privacy are worthwhile, even if you don’t continue the journey to absolute anonymity.

I dread the day I will have to start doing this when the 2015 vehicle I have finally goes

This is really cool. One of my favorite parts of the internet is getting to see these kinds of projects by people who aren't afraid to tear into stuff and take it apart and put it back together.

But you do all that for privacy... and then you use CarPlay?

Can't do that in Fr*nce and likely other European countries, all vehicles must have eCall and your vechicle might not pass the mandatory routine check you need to do once in a while to be allowed on the road. Hope you like biking a lot.

The reason I think this is a bad idea is that it lulls you into a false sense of security. The article makes recommendations that seem thorough and sensible - keyword "seem" - but, as mentioned elsewhere here, there are other potential hidden sources of telemetry (in CarPlay and Android Auto), and who knows what else.

For this kind of thing to succeed as a general lifestyle, you would need to invest an enormous amount of time making potentially irreversible modifications to all kinds of electronic equipment - only to be virtually guaranteed to miss something.

Do this kind of thing if you want, but don't be fooled into thinking you're actually solving the problem for real.

Modern cars are like Smart TVs.

losing SOS/cloud features is real cost, but so is having an always-on telemetry device in a thing you own. this should be a software setting and a clear privacy contract

About removing the modem. ....

I always though ...just need to remove the ... the antenna .. modem would always get no signal and transmissons would always fail....

Same for the GPS.

To verify- no other hiddwen transmitters could use some RF( Radio Frequency) analyzers

[RF analyzer (ie spectrum analyzer) is a tool for measuring the power, frequency, and signal strength of radio frequency signals.]

We need a Framework laptop equivalent for cars.

You buy a $40k car and it's still monetizing you. The hardware is just the entry fee. The real product is everything you do inside it.

Excellent practical guide and pictures, if OP is around on this thread: well done! Your future self is going to appreciative too when this needs repeating at some point!

As much as I should really care about this, I have to say... I don't. I should, but I don't.

To me it's a little bit like, "I love these new cellphones but I'm keeping it in airplane mode all the time because I don't want it online"

I mean what's the point of buying a new car if you're going to cripple features that are so much better because it's connected? Sure, use CarPlay or such, but to say forever end things like over the air software updates? Anything to prevent Kia from theoretically detecting sexual activity I suppose [1].

Just buy an old car. Or convert a classic into an EV [2].

There are A LOT of things in our lives that can be completely torn apart if one wants to. Glass is a vastly inferior window covering. Do you know how easy it breaks, and people can just look into it.

1 If you ask me, there's a whole whitepaper to be written about how to detect sexual activity in a Kia.

2 https://www.bugeyeguys.com/category/electric-bugeye/

Has anyone experienced a case where they needed an over-the-air safety update/recall performed, but weren't able to because they removed the cellular modem?

I'd like to think failure to apply an OTA safety update would trigger a mail-out notification requesting you bring the vehicle into the dealer. But that's probably optimistic...

I bet in a couple of years you'll have to go straight to the dealership to fix your car, because it won't start.

On the other hand, as mentioned by others: Why bother if you use CarPlay?

How good a position can you get from GPS today in receive only mode?

You can download and store Open Street Map for individual states. Map data doesn't have to come in over the air. That's not the problem. It's enhancing GPS with cell phone tower data that's the problem. That requires a cell connection.

> Everything that relies on a data connection will no longer work. This includes things like over-the-air updates as well as Toyota cloud-based services and SOS functionality

I hate how this is a trade off. It’s totally possible for cars to broadcast their location only if the SOS is pressed or the crash sensor is triggered, but it feels like there’s no way to have that without also having everything else.

Another method is to disconnect the antenna and add a resistor so it acts as a dummy load. Here is an example with a Tacoma: https://www.tacomaworld.com/threads/simpler-solution-for-dis...

> Strong Federal privacy laws would make posts like this unnecessary, that’s the world I’d rather live in.

Amen.

Writes long article about the concerns of software phoning home

Peppers article with Amazon affiliate links

Perfect summation of 2026

I wonder if insurance would refuse to pay out in the event of an accident due to this modification?

I'm still just refusing to buy this garbage in the first place.

All these car manufacturers pushing this horrorshow deserve to go under. Tbh it looks like most will soon....

I cannot imagine the paranoia that it would take for me to go through this process.

Also worth noting that as recently as 2024, the S and SV models for Nissan did not have telematics whatsoever. This may still be true for the 2025 / 2026 models, I just haven't checked.

Could one cover the antenna with strategic foil?

Removing seems hard/complicated but foil seems within most ppls reach.

I get this desire and commend the author, but I just want self driving cars and so I think we are just stuck with this.

If you get into enough trouble they'll get all your phone data and cell tower pings or your passenger's.

Be careful as there has been precedence of insurance companies using the fact cameras were removed/disabled to deny or reduce claims.

Why not just remove the antenna or SIM card from the modem?

There's a fortune to be made for whomever produces a car that has minimal features, and and electric-drivetrain with onboard gasoline generator. No screens, knobs and buttons, no assists. Extra fortune if you can licence designs and revive some of the old-and-loved classics with new safety features.

Who’s responsible for presenting the privacy policy to passengers of a car, anyway?

Couldn't you just ground or resistor out the car's cellular antenna so it can't transmit data?

Live free or die

I love those type of posts. But there is probably gonna be an interesting discussion when he will get the car serviced at Toyota.

Maybe a simpler way is to to slap a Faraday cage on all antennas.

props for still using Skitch to annotate images in 2026

I did it for my 2025 4runner. https://6thgen4runner.com/threads/disable-telematics-with-au...

DCM Bypass kit. https://www.autoharnesshouse.com/store/AHH-DCM77

Any guesses at how large the addressable market is for a dumb car (or appliance)?

I would be the target customer, but I keep making convenience concessions and buying the nice car / appliance with smart stuff.

I appreciate this guide from a technical perspective, but despite a lot of the stated preferences, I’m not seeing a huge market for it.

Convenience is paramount.

Maybe two metal pins through the GPS and the cellular antenna coaxial cables would do the trick?

This is why I want a Chinese car. At least they won't do anything with my data.

Open-source car, please.

cool, well done. Now we just need it for the other gazillion "smart-cars" out there

If you live in the EU and bought the car there, the GDPR still applies, even if data is sent to Toyota in Japan.

You have the full right to view and ask for deletion.

Great guide! After getting to the end, I had no idea what AirPlay was so I looked it up... bro, all this effort to avoid telemetry and you are using an iPhone XD

If you are wary of all the smart features in your next car purchase, consider buying a bicycle. We do not have to entertain the creeping invasion of our privacy