Persistent Personal Data Exposure Across Vehicle Ownership and Control Transitions

Modern vehicles routinely ingest, generate, and store personal data to support infotainment, navigation, and connected services. While these data enable valuable in-vehicle functionality,they may persist beyond authorized use and become accessible when a vehicle changes hands or control is lost. We study the extent and implications of persistent personal data exposure across vehicle ownership and control transitions under a realistic threat model in which an adversary acquires vehicles or electronic modules through legitimate secondary-market channels and appliescommodity forensic tools. Through empirical case studies of used infotainment systems (2011–2021 model years across multiple manufacturers), we demonstrate practical extraction paths, including removable hard-drive imaging, exploitation of exposed interfaces in Android-based systems, and hardwarelevel extraction from embedded flash storage. We also report field evidence from a used car lot: among 38 vehicles inspected without specialized tools, only three (7.9%) contained no visiblepersonal data, and all nine vehicles with built-in navigation retained prior navigation history. We characterize the exposed data and associated harms, and show how AI-enabled analysis can amplify misuse by lowering the effort required to infer sensitive attributes and generate convincing targeted content. Our findings indicate a systemic lifecycle failure in current vehicle data management practices and motivate the need for verifiable, robust mechanisms to manage and remove personal data across ownership and control transitions.