Your Dead Car Just Snitched — GPS Logs From Factory to Junkyard Were Never Deleted
Your Dead Car Just Snitched — GPS Logs From Factory to Junkyard Were Never DeletedA security researcher bought a $40 car part from a Polish junkyard. It told him everywhere the car had ever been — unencrypted, undeleted, just sitting there.
A single chip from a scrapped BYD Seal contained every GPS coordinate from its life — from a Chinese factory floor, across UK roads, all the way to a Polish salvage yard. No password. No encryption. Just plug in and read.
Romain Marchand, a researcher at Paris-based security firm Quarkslab, pulled a telematic control unit (basically the car’s always-on internet brain) from a junked electric car. What he found is wild — and it applies to basically every car brand on the road right now.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| TCU (Telematic Control Unit) | A little computer inside your car that’s always connected to the internet. Think of it like your car’s hidden phone. |
| NAND storage | The memory chip that keeps data even when the power’s off. Like a USB stick that never forgets. |
| GPS/GNSS logs | A diary of everywhere your car has ever driven, recorded automatically. |
| System-on-chip (SoC) | One tiny chip that does everything — processor, memory, radio. Your car has one made by Qualcomm. |
| Unencrypted | Not locked. Anyone who grabs the chip can read it like a book. No password needed. |
| GDPR | European law that says companies have to protect your personal data. (Spoiler: cars don’t care.) |
| ECU | Electronic Control Unit — your car has dozens of these mini-computers running different systems. |
🔍 What Exactly Did He Find?
Look, this dude bought a telematic control unit from a BYD Seal (a popular Chinese electric car) at a salvage yard in Poland. Cost almost nothing.
He cracked it open, pulled the Micron memory chip, and dumped the data. Here’s what was just sitting there:
- Complete GPS trail — every coordinate from factory in China → roads in the UK → scrapyard in Poland
- System config files — what software the car was running, what servers it talked to
- Travel patterns — enough to map out the previous owner’s daily routine
- All of it stored on a Linux-based file system. Unencrypted. No password. No nothing.
He even cross-referenced the GPS coordinates with Facebook posts and found photos of this exact car flipped on its side. That’s how detailed the data was.
😤 Wait, Can't You Just Factory Reset a Car?
Real talk: no. Not really.
Here’s the thing — your phone has a factory reset button. Your car? Marchand says “a complete memory wipe is not feasible with current architectures.”
The infotainment screen (the touchscreen you use for music and maps) might let you delete some stuff. But the TCU? The engine computer? The airbag module? Those ECUs don’t even have a user interface. There’s no button to press. No menu to find.
And even if you wipe the infotainment, forensic tools can still recover traces from the memory chips.
(I sold a car two years ago. Didn’t even think about this. That car knows my gym, my kid’s school, and every drive-thru I hit at 1 AM. Cool.)
📊 What Data Your Car Is Hoarding Right Now
| Data Type | How It Gets There | Who Wants It |
|---|---|---|
| GPS coordinates | Recorded automatically every few seconds | Insurance companies, stalkers, cops, data brokers |
| Phone contacts & texts | Synced via Bluetooth pairing | Anyone who buys your old car |
| WiFi passwords | Stored when you connect to hotspots | Hackers, investigators |
| Driving behavior | Speed, braking, acceleration logs | Insurance companies already buy this |
| Voice commands | Some cars store audio clips locally | Forensic investigators |
| 2FA codes & messages | Synced from phone through car’s network | Shown at BarbHack conference in 2021 |
🌍 This Isn't Just a BYD Problem
Marchand was very clear about this: “The hardware architecture of the Chinese car maker’s TCU is broadly similar to what can be found in other brands.”
Every major car maker uses Qualcomm chips, NAND storage, and Linux-based systems. Ford, BMW, Tesla, Toyota — all the same basic setup.
Poland already banned Chinese vehicles at military bases in February 2026. Personnel can’t even plug their phones into Chinese car infotainment systems anymore.
And the regulations that exist? They’re a joke. GDPR says data should be anonymized before manufacturers transmit it. But nobody’s checking what stays on the car itself after you sell it or scrap it.
🗣️ What the Experts Are Saying
Australia’s Signals Directorate (their version of the NSA):
“Review privacy policies before purchase. Disable data sharing where possible.”
(Good luck finding that setting in a menu buried six screens deep.)
Australia’s Information Commissioner:
“Location data enables detailed movement pictures, creating privacy and safety threats when combined with other data sources.”
Romain Marchand (the researcher):
“A complete memory wipe is not feasible with current architectures.”
Look, the experts are basically saying: your car is a surveillance device on wheels, and there’s no off switch. 15 US states have now passed privacy laws similar to California’s, and three more kick in during 2026 — but none of them specifically address what happens to your data when the car dies.
Cool. Your car’s been snitching on you since the factory. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
💰 Hustle 1: Start a Car Data Wipe Service for Dealerships
Look, Privacy4Cars already proved this works — they cover 600 million vehicles and got named a US Chamber of Commerce top honoree. But they charge dealerships. Here’s the flip: most independent used car lots (the ones with 30 cars and a guy named Dave) can’t afford enterprise tools. Build a simple service where you show up with an OBD-II reader and a laptop, wipe what you can, and hand them a “Data Cleared” certificate they can show buyers. Charge $25-50 per car. Dave has 30 cars? That’s $750-1,500 per lot visit.
Example: A freelancer in Melbourne, Australia started doing exactly this for three dealerships in his suburb after reading about Privacy4Cars. He charges AUD $40 per vehicle, hits each lot monthly, and bags about AUD $3,200/month working two days a week.
Timeline: 2-3 weeks to learn the OBD protocols, buy a $30 adapter, build a one-page site. First clients within a month if you cold-call local lots.
🔧 Hustle 2: Flip Junkyard TCUs to OSINT Researchers and Journalists
This is the sideways play nobody’s talking about. Investigative journalists, OSINT researchers, and even law firms doing divorce cases NEED vehicle data. A TCU from a junkyard costs $20-80. The GPS data on it? That’s worth $200-500 to someone building a story or a legal case. There’s an entire Vehicle OSINT tool collection on GitHub. Learn to extract, package the data clean, and sell it to people who need it.
Example: An OSINT hobbyist in Warsaw, Poland bought 12 TCUs from local scrap yards for about €300 total. He extracted GPS logs, mapped travel patterns, and sold anonymized datasets to two European security research firms for €2,100. Took him three weekends.
📱 Hustle 3: Build a 'Check Your Car's Privacy Score' Tool
Privacy4Cars built a Vehicle Privacy Report that shows what data manufacturers collect. But there’s nothing consumer-facing that’s free and simple. Build a quick web tool: user enters their car make/model/year, and you show them a privacy score based on publicly available manufacturer policies. Monetize with affiliate links to OBD-II tools, VPN services for in-car WiFi, and a “premium wipe guide” PDF for $9. The content already exists in manufacturer privacy policies — you’re just translating it into plain English.
Example: A developer in Nairobi, Kenya built a similar “phone privacy score” site last year using just public data. Got 40K monthly visitors within 3 months. Sold it for $8,500. Same model, different niche.
🛡️ Hustle 4: Sell 'Pre-Sale Data Wipe' as an Add-On to Car Flippers
The used car flipping community is massive — r/Flipping, r/CarFlipping, Facebook groups with 100K+ members. These people buy cars cheap, clean them up, and resell. Nobody in that world is talking about data privacy yet. Position yourself as the data guy. Offer a remote consultation: buyer sends you photos of the infotainment and you walk them through every reset and deletion step via video call. Charge $35-75 per car. As regulations tighten (three more state privacy laws hit in 2026), this becomes a compliance thing, not just a nice-to-have.
Example: A car flipper in Texas added “personal data cleared” to his Craigslist listings after watching a news segment about car data. His listings started selling 40% faster because buyers felt safer. He now charges other flippers $50 to walk them through the process.
🧠 Hustle 5: Create a YouTube/TikTok Channel Around 'What Your Car Knows About You'
This topic is SCARY and SHAREABLE. That’s the perfect combo for viral content. Buy a cheap TCU from eBay ($30-60), film yourself extracting the data, and show people the GPS logs of a stranger’s life mapped out on screen. The shock factor alone will carry the content. Monetize with tool affiliate links, sponsor deals from privacy companies, and a course on “how to protect your car data.” The niche is EMPTY right now.
Example: A cybersecurity student in São Paulo made a TikTok showing data extracted from a used car’s Bluetooth system — contacts, call logs, text messages. Got 2.3 million views. Landed a sponsorship from a VPN company within a week. Now posts weekly and pulls $1,800/month from the channel.
🛠️ Follow-Up Actions
| Step | Action | Link |
|---|---|---|
| 1 | Read Quarkslab’s full technical breakdown | Quarkslab Blog |
| 2 | Get an OBD-II Bluetooth adapter ($15-30) | Amazon OBD-II Scanners |
| 3 | Study the Vehicle OSINT tool collection | GitHub: Vehicle-OSINT-Collection |
| 4 | Check your own car’s privacy policy | Privacy4Cars Vehicle Privacy Report |
| 5 | Join OSINT communities for networking | OSINT Curious |
| 6 | Read upcoming 2026 state privacy regulations | Nelson Mullins Privacy Analysis |
Quick Hits
| Want to… | Do this |
|---|---|
 See what data YOUR car stores |
Enter your make/model at Privacy4Cars |
 Wipe your infotainment before selling |
Go to Settings → System → Factory Reset (but know it won’t get everything) |
 Stop your car from phoning home |
Disable cellular/WiFi in your TCU settings (if your car even lets you) |
 Unpair your phone properly |
Delete your phone from the car’s Bluetooth menu AND delete the car from your phone |
 Start a car data wipe side hustle |
Grab an OBD-II adapter, learn the basics, cold-call local used car lots |
Your car forgot your birthday. It remembered every parking lot you’ve ever sat in at 2 AM.
!