Old Cars 'Tell Tales' By Storing Data That's Never Wiped

Why It Matters

Unencrypted vehicle data can be harvested from scrapped cars, creating privacy risks and potential regulatory liabilities for automakers worldwide.

Key Takeaways

• BYD TCU stored unencrypted GPS logs from factory to wreck
• Researchers recovered data from salvaged TCU's Micron NAND memory
• Logs reveal vehicle’s full journey across China, UK, Poland
• Similar TCU designs used by multiple car manufacturers
• Lack of data wiping raises privacy and regulatory concerns

Pulse Analysis

The discovery that a salvaged telematic control unit (TCU) can retain detailed, unencrypted GPS logs underscores a hidden vulnerability in modern vehicles. While automakers tout connectivity and over‑the‑air updates, many still rely on legacy storage architectures that lack automatic data sanitization. In the case of the BYD electric car, the Micron multi‑chip package preserved a complete travel record, from its assembly line in China to its final crash site in Poland, offering a stark illustration of how data can persist long after a vehicle is decommissioned.

Privacy advocates and regulators are increasingly scrutinizing the lifecycle of vehicle data. The European Union’s GDPR and emerging automotive‑specific guidelines demand that personal location information be protected and, where appropriate, erased. The fact that similar TCU designs appear across multiple brands suggests a systemic compliance gap. Manufacturers must adopt secure‑by‑design principles, including encrypted storage and mandatory wipe procedures at end‑of‑life, to avoid exposing drivers to unwanted tracking and potential legal exposure.

From a business perspective, the incident highlights a risk to brand reputation and liability. Companies that fail to secure telematics data may face consumer backlash, class‑action lawsuits, or fines from data protection authorities. Conversely, firms that proactively implement robust data‑handling policies can differentiate themselves in a competitive market, turning security into a selling point. As vehicles become ever more software‑centric, the industry’s ability to manage residual data will be a key determinant of trust and long‑term success.