Used cars: The previous owner's app may still unlock your car

When a used car changes hands, the paperwork changes too. The app on the previous owner's phone often doesn't. If nobody removes the link, their account stays connected to the car, sometimes for months. A case from the US showed what that looks like back in 2018. A woman had traded in her VW Jetta at a dealer, and months later, The Drive reported, she could still see its mileage, lock status and location in her app.

What the previous owner can still see

In late 2023, Austrian auto club ÖAMTC tested this on four EVs, a BMW i3, a Renault Megane E-Tech, a Tesla Model Y and a VW ID.3. If the connection stays active, the former user can see mileage and consumption depending on the brand, and on EVs the charge level and range as well. In some cases they can locate the car to within a few meters and lock or unlock it, from any distance and with no time limit. A test by German auto club ADAC, covered by Auto Bild a few months earlier, came to similar results. In the worst case, that means a stranger can see where your car is parked at night and open it remotely.

The car itself doesn't always tell you whether that link is still there. In the test, neither the BMW nor the VW showed whether a phone was still connected, so there was no warning in the car that someone else had access.

How carmakers handle it

BMW was the easiest in the test. The primary user can be changed at any time, and the old one loses access immediately. ÖAMTC didn't find a factory reset for the whole system, though, and personal data could only be deleted on the center display. VW also let testers change the primary user quickly, and both seller and buyer got an email about it. The factory reset, however, often took several tries. ÖAMTC also saw a risk of abuse in how easy the switch was, since a renter, for example, could make themselves the primary user with little effort. In November 2023, VW replaced the We Connect app used in the test with the Volkswagen app.

Tesla was the hardest of the four. Turning off mobile data and resetting the car only worked with the seller's login, as long as the seller hadn't removed the car from their app. Tesla's owner's manual spells out the right order. The seller first runs a factory reset under Controls, Service, Factory Reset and only then transfers ownership in the app. It doesn't work the other way around, because once the car is removed from the account, a factory reset is no longer possible. If the seller skipped this, you can request the transfer yourself with Add Product in the Tesla app. If the seller can't be reached, Tesla's support page says it will review the request and complete the transfer or contact you within 48 hours. In the ÖAMTC test, the change still took three to five days because documents had to be checked, and fleet cars couldn't be transferred through the app at all.

On a Tesla, also check the keys. Under Controls, Locks, the car lists every phone key, key card and key fob with access, up to 19 on a Model Y. Delete anything you don't recognize with the trash icon and confirm by scanning one of your own key cards on the card reader.

Android Automotive: The Google account stays in the car

Many newer cars run Android Automotive, an infotainment system with built-in Google services. On those, a Google account is often signed in on the car in addition to the carmaker's app. ÖAMTC specifically advises checking for linked Google accounts on these models. On the Renault in the test, a factory reset removed all accounts, and individual accounts could also be removed on the screen. There was no notification once the buyer had unlinked them. The club also pointed out that passwords can end up in Google's password manager in the car.

What to do when you buy

The test drive is the best time to check. Look through the car's menu for items like connected services, remote services or paired devices, and ask the seller about what's listed. If one of the seller's phones shows up in the device list, have it removed on the spot. A dealer should handle this as part of preparing the car for sale, but the US case shows you shouldn't take it for granted. ADAC and ÖAMTC both recommend putting it in writing in the sales contract that all online connections to the previous owner have been removed. It takes one sentence, for example "The seller confirms that all connections between the vehicle and the seller's accounts and apps have been removed." That gives you something to point to if another account turns up later.

After the handover, register yourself as the primary user in the carmaker's app. With brands like BMW, that removes the previous primary user. Then reset the infotainment system to factory settings if the car offers it, and on Android Automotive check which Google accounts are signed in. ADAC warns that a factory reset doesn't always remove every connection, so if you're unsure, ask a workshop or the carmaker's customer service.

Sellers should check too

This protects both sides. A seller who skips it leaves behind contacts, navigation destinations and possibly an account, all data that tells the buyer about you. Pairing a phone over Bluetooth often copies its contacts to the car. Back in 2021, ADAC criticized rental cars for burying the factory reset option deep in the menus, depending on the model, and noted that unpairing the phone leaves things like navigation destinations behind. On a Tesla, removing the car from your account also cancels paid subscriptions, according to Tesla's support page. Volvo's help for selling a car lists two steps. Disconnect the Volvo Cars app, then perform a factory reset on the center display. That order works for most brands. The same idea applies to phones, and our guide covers what to check when you buy a used phone.

I write about IT security and artificial intelligence. Cybersecurity is one of my regular topics, among others for Golem.de. At Notebookcheck, my focus is on practical AI for everyday users. I have worked hands-on with AI for years, most recently with a focus on AI agents and their use in everyday work, and I test tools and models myself rather than just reading about them.