Is Your Rental Car Tracking You? What It Logs

Yes, your rental car is tracking you. Every major rental company runs a telematics system that records GPS position, speed, hard braking events, and trip timestamps in real time. This is not a side note buried in the contract. It is the core operating infrastructure of every fleet above a few hundred vehicles, and you agreed to it when you signed the rental agreement.

The bigger surprise is not the GPS. It is everything else the car logs when you plug in your phone.

Key Takeaways

• All major rental fleets use GPS telematics that record location, speed, and trip data continuously. You cannot opt out.
• Rental companies share driving data with “business partners” and “service providers” under privacy policies broad enough to include insurers and data brokers.
• Bluetooth pairing copies your contacts and call log to the car’s storage at the moment of connection. The data can persist after you disconnect.
• The pairing trap is the real privacy risk: the rental company may not see your contacts, but the next renter who gets the same car might.
• Five steps before you return the keys can delete most of your personal data from the vehicle’s onboard systems.

What the telematics box actually records

Every rental vehicle in a major fleet carries a telematics unit, a cellular-connected hardware module typically mounted behind the dashboard or integrated into the OBD-II diagnostic port. It runs independently of anything you do with the car.

A standard telematics system records:

• GPS position logged at intervals as short as 30 seconds or continuously in high-frequency mode
• Speed with timestamps accurate enough to reconstruct your entire route
• Hard braking and rapid acceleration events, tagged to location
• Ignition on/off times, which reveal when and where the car was parked
• Geofence crossings, such as crossing a state or national border, or entering a toll zone without a transponder

Enterprise Holdings (which operates Enterprise, National, and Alamo) discloses in its rental terms that vehicles are equipped with GPS devices and that the company tracks location and driving behavior. Hertz, Avis, and Budget carry similar disclosures. The data is used for vehicle recovery, cross-border restriction enforcement (many rental agreements prohibit taking the car to Mexico or Canada without prior authorization), mileage calculation, and utilization analytics.

If you drove fast, the car knows. If you crossed a border you were not supposed to, the car knows. If you left the car parked in a neighborhood for six hours at 2 a.m., the car knows.

Who sees the data

The rental company sees everything the telematics system captures. That is expected. What is less expected is where the data goes after.

Mozilla’s Privacy Not Included research team spent over 600 hours reviewing the privacy practices of 25 major automakers in 2023 and rated them the worst product category they had ever reviewed. Their key findings apply directly to rental fleets:

• 84% of car brands share or sell driver data with service providers, data brokers, and other businesses.
• 76% say they can sell your personal data outright.
• 56% will share data with government or law enforcement based on an informal request, not a court order.

Rental companies operate within the same connected-services ecosystem as automakers. Enterprise, Hertz, and Avis all have privacy policies that permit data sharing with “business partners” and “service providers,” broad categories that include marketing firms, insurers, and data aggregators. Your driving profile from a one-week rental can flow into a data pipeline that eventually informs insurance pricing for a vehicle you own.

Under the Stored Communications Act (18 U.S.C. § 2702), a rental company can produce stored GPS records to law enforcement with a subpoena. Several criminal cases have used rental car telematics logs as evidence, and courts have generally upheld their admissibility because the renter agreed to the tracking in the rental contract.

The FTC has flagged connected vehicle data as a priority consumer privacy issue, noting that the combination of precise GPS location, behavioral patterns, and third-party sharing creates risks that go well beyond what most consumers expect.

The pairing trap: your contacts are in the car

The GPS tracking is disclosed (however small the print). The infotainment pairing problem is not disclosed at all, and it is the more immediate privacy exposure for most renters.

When you pair your phone via Bluetooth to the rental car’s infotainment system, the car copies your data at the moment of connection. Depending on the system (Ford Sync, GM Infotainment, Toyota Entune, Honda Link, Hyundai Bluelink, and similar), it can copy:

• Your entire phonebook, sometimes thousands of contacts
• Recent call history
• Your phone’s device name and Bluetooth MAC address
• Text message previews if you granted messaging permissions

USB connection transfers the same data and sometimes more. Apple CarPlay and Android Auto operate through an encrypted tunnel that limits what the car can cache, but the initial connection still registers your device’s identity, and any map searches or calls made during the session are logged by the car system.

The critical detail: disconnecting your phone from your end does not delete the data from the car. The car stores paired device profiles in persistent memory. The rental company may not be reading your contact list, but the next customer who rents the same vehicle can see your previous connections, and a technically curious person can browse them in seconds through the Bluetooth settings menu.

A 2019 investigation found that rental cars returned at multiple major airports had phonebooks and call logs from dozens of previous renters still stored in the infotainment system. Nothing about this is illegal. Nothing about the rental process prompts you to clean it up.

The data table: what’s tracked where

The distinction between telematics data (everything logged by the GPS unit) and infotainment data (everything stored by the screen and audio system) matters. The rental company actively monitors telematics. Infotainment data tends to sit dormant, which is both reassuring and misleading: dormant data is not deleted data.

What you can opt out of (almost nothing)

You cannot opt out of fleet telematics. It is a condition of the rental, and there is no fleet-level option to disable GPS recording for an individual vehicle. This is not unreasonable. A company with 500,000 cars needs to know where its assets are.

The California Consumer Privacy Act (CCPA) gives California residents the right to request deletion of personal data held by businesses, and the rental company’s privacy policy technically covers this. In practice, submitting a CCPA deletion request for driving data collected during a completed rental is a process that takes weeks and requires knowing which policy covers which data stream.

The more practical approach: protect your infotainment data yourself, before you return the car.

If you rented because of a work trip, the employer tracking overlap is real too. If your company rented the car, the company may have access to telematics data through a corporate account. The same GPS-plus-behavior data that the rental company sees is visible to fleet managers at enterprise business accounts.

The 5-minute checklist before you return

This is the part that is actually in your control.

Step 1: Delete your Bluetooth device from the car’s paired list. Go to Settings or Connectivity in the infotainment menu. Find the Bluetooth paired devices list. Select your phone. Delete it. Do not just disconnect; delete the entire pairing.

Step 2: Clear navigation history. Go to the navigation app or map screen. Find History or Recent Destinations. Clear all entries. Some systems call this “Delete All Favorites and History.”

Step 3: Log out of any streaming or app account you signed into. If you signed into Spotify, Pandora, SiriusXM, or any other service on the car’s screen, log out. These accounts sometimes stay authenticated across rentals.

Step 4: Eject and delete any USB or CarPlay session. If you used a USB cable, safely eject. Then go to the phone management or device menu and delete your device profile.

Step 5: Use the factory reset or “Delete Personal Data” option if available. Many newer infotainment systems include a dedicated option under Settings to wipe all personal data. Kia, Hyundai, Ford, Honda, and GM have added this in recent model years. It takes about 60 seconds and removes phonebook, call history, navigation history, and paired devices in one step.

If the car does not have a factory reset option, complete steps 1 through 4 manually.

You cannot do this after returning the keys. Once you hand the car back, you have no access to the system.

What about hidden tracking hardware?

Rental cars contain legitimate telematics units. The question of whether someone has added aftermarket tracking hardware to a rental car is different and rare, but not impossible.

If you are concerned about surveillance beyond the fleet’s own systems, the physical inspection approach covers the five zones where aftermarket trackers are most commonly hidden. For a rental car, focus on the OBD-II port under the driver’s-side dashboard, which is the easiest place to attach a tracker without tools.

Fleet telematics units are integrated into the vehicle and not visible from inside the cabin. An aftermarket tracker plugged into the OBD-II port by someone other than the rental company would be visible as a device sticking out from the port.

The personal car comparison

The rental car situation is a compressed, more exposed version of what modern connected personal vehicles do by default.

All major automakers sell connected services that continuously log location. Ford’s Connected Services, Toyota Connected, GM OnStar, Hyundai Bluelink, and similar platforms transmit GPS data back to manufacturer servers as a standard feature. As Mozilla found, 84% of these brands share or sell that data with third parties, and most car owners have not meaningfully opted out because doing so is intentionally obscured.

The difference with a rental car is that a second party (the rental company) also has full access, the car is shared with other renters, and the infotainment data is almost never cleaned between rentals.

If you are curious whether your own phone is part of a broader tracking picture, the approach to detecting whether your phone is being tracked applies to the apps and permissions you may have granted to automaker companion apps (FordPass, MyHyundai, Toyota app, OnStar) that run on your personal phone.

What the rental company is not doing

To be precise: rental companies are not reading your contact list in real time. The infotainment data is not actively monitored, streamed to a server, or analyzed for marketing. It sits in the car’s local storage until it is either overwritten by the next renter’s data or cleared during servicing.

This is not benign. Stored-but-unmonitored data is still a privacy exposure. But the threat model is different from what most people imagine when they ask “is my rental car tracking me?” The GPS and speed data is actively collected, stored centrally, and in some cases shared. The infotainment data is locally stored, largely ignored by the company, and casually visible to anyone who uses the car next.

The five-step checklist addresses both exposures. The GPS you cannot control. The infotainment data you can.