Vehicle Data Removal Raises Practical Questions for Collision Repair Shops

Personal information can remain accessible long after a vehicle changes hands. At a Collision Industry Conference (CIC) meeting in Chicago, Privacy4Cars founder and CEO Andrea Amico said 90 percent of vehicles sent to salvage auctions still contain accessible personal information. For collision shops, the issue has two parts: helping customers understand what to clear, and setting clear limits on who is responsible for doing it.

Cars store more than drivers may expect

The connected car now holds a substantial amount of personal information. Amico said the average vehicle from the past 10 years has about 250 sensors, compared with roughly 40 in an average cell phone. He described cars as “the third personal computing device that consumers use every day.”

Cameras, microphones, GPS and phones paired to a vehicle can all contribute to its data store. Depending on the vehicle and its features, that information may include call logs, contacts, garage access codes, biometric data and passwords. Amico said vehicles often lack the encryption or less visible privacy controls people associate with phones and computers. Even a vehicle without navigation or connected services may retain a Bluetooth pairing that creates privacy concerns.

That point matters for used and damaged vehicles alike. A customer may think a vehicle’s data is limited to a phone connection, while an account or app could still provide access to some functions after the vehicle is sold. During a separate CIC presentation, Tracy Dombrowski of Collision Advice described a woman who sold her car to a dealer but left it connected to her app. The former owner tracked the vehicle from Florida to Texas and could still remotely start it and access it.

Set expectations before touching vehicle settings

Removing personal data typically falls to the vehicle owner, Dombrowski said, though a repair shop can offer guidance as a courtesy. Amico cautioned that shops may assume liability if they sell data removal as a service. If a shop promises to remove information and fails to do so correctly, the customer may have grounds to bring a claim, he said.

That distinction gives shops a practical way to help without making a promise they may not be equipped to fulfill: provide the owner with the right instructions and let the owner carry out the steps. If a shop is asked to take action, Dombrowski said it should first obtain the customer’s authorization. Clear communication about what the shop will do—and what the customer must complete—can help avoid confusion when a vehicle is leaving for sale, salvage or another repair facility.

Timing can determine which steps are possible

Dombrowski described four steps for clearing personal information, while emphasizing that the process varies by vehicle make, model and year. Manufacturer owner’s manuals and support materials often explain the relevant procedures. Common search terms include “factory reset,” “master reset,” “delete profile,” “remove vehicle” and “ownership transfer.”

The vehicle’s condition and location also affect the process. Dombrowski outlined three situations: the vehicle is powered on, powered off, or has already been towed away and is no longer accessible to its owner. The sequence matters because some actions can only be completed while the vehicle remains paired with the owner’s app. A shop that waits until the vehicle has been moved may find that the customer has fewer options for disconnecting accounts or changing access.

Bluetooth alone is a reminder to check

Amico said personal information may be present in vehicles that owners would not consider connected. He cited a 2025 Dodge Ram 2500 Truck SLT without self-driving features, telematics, Apple CarPlay or navigation. It still has Bluetooth, which can retain a connection to a user’s phone.

The wider context is growing attention to how vehicle data is collected and shared. Amico referred to disputes involving automakers and insurers, including matters involving General Motors and data from connected vehicles. One report on a California settlement with GM and a separate report on a GM and OnStar order address data collection and sharing allegations. The practical takeaway for repairers is more immediate: document customer authorization, direct owners to the correct instructions, and consider data access before the vehicle is powered down or moved off-site.

The GM and OnStar order is also available online. Dombrowski shared manufacturer webpages with data-removal resources, giving shops and customers a place to confirm instructions for a particular vehicle.

For shops, the strongest workflow begins while the owner still has access to the vehicle and its paired apps. A short conversation about account access, phone pairings and the owner’s preferred next steps can prevent an overlooked connection from following the vehicle to its next destination.

Andrea Amico, Privacy4Cars founder and CEO, speaks during a Collision Industry Conference (CIC) meeting in Chicago on July 22, 2026/Teresa Moss