Hacker News Reader

Comment by alasdair_ | Hacker News Reader

I bought my tesla used, directly from Tesla (for the warranty etc.) The previous owner's address and other sensitive information was still listed on the "My Tesla" pages at tesla.com when I logged in to my own account.

Comically, on the car itself, the previous navigation searches were not cleared and included a nearby strip club that my wife found before I did.

On my wife's X (also bought from tesla.com second-hand), she was sent a whole bunch of financial information about the previous owner, both through text messages and on the online portal.

They really don't do an especially good job of securing customer information.

View on HN

Regarding the car itself, shouldn't some responsibility lie with the previous owner? The first thing I do before selling a phone or laptop is wipe or factory reset it.

We rented a car last week that had 11 paired Bluetooth devices and like 1400 entries in the phone book. I was kind of jealous because my Leaf only allows 3 devices. I wiped it all out before returning the car.

>Regarding the car itself, shouldn't some responsibility lie with the previous owner? The first thing I do before selling a phone or laptop is wipe or factory reset it.

Sure, but considering that most users don't even know how to pair a device without step-by-step instructions, I find it highly unlikely that they'll understand the implications of the car reading and storing personal information provided by their phone much less how to delete it.

And given that this is Tesla we're talking about, whose products directly encourage you to have your phone paired (more than any other car of its type), even more people would be affected than they would be from, say, a Leaf (where you don't have to do that, and where it's unlikely to be as easy as it is on a Tesla).

> whose products directly encourage you to have your phone paired (more than any other car of its type)

They do? The cars all come with wireless data, streaming, maps, and internet. In the Model 3, using your phone as a Key is done via BLE and doesn't involve pairing which is a sperate function.

I would say they're indifferent to your phone but let you use it if you choose.

You would need some understanding of the device/car interaction to know this is necessary. For example you might assume that any SMS content the car displays is fetched in real time from the device.

> shouldn't some responsibility lie with the previous owner?

If the secondhand purchase was a general person-to-person sale, sure.

If buying secondhand from a dealer, or the manufacturer, I'd be expecting some sort of refurbishment. At the minimum a proper detailed cleaned, full service, and software factory reset plus latest software upgrades at the relevant price-point.

Other car manufacturers call it ‘certified pre-owned’, or CPO.

The thoroughness of a CPO inspection/refurbishment can vary from "We did all 200 items the manufacturer specifies" to "We washed it".

https://www.youtube.com/watch?v=f037K2Fr2FU

Well, as always, a certification is only as good as its certifier.

Have anything I can read instead of sitting through 12 minutes of a talking head?

If it is a true certified, the checklist (standarized by the manufacturer) will have to be signed off by a factory-certified technician, so there is a paper-trail.

and we all know that a car dealer would never do something like sign off the checklist without actually having done the work. /s

No, there is no responsibility with the previous owner. If I return a tesla, to tesla, its entirely reasonable, and in the UK at least a legal requirement, that they clear out my data before reselling it.

What's this law you mention? While Tesla shouldn't be sending you other customer info (against GDPR), I'm not sure it would actually be their responsibility to wipe data, I thought it'd be the previous customer's.

If there is a law covering it, I'd be interested to know it.

The pre-GDPR UK Data Protection Act obliged companies to hold data for no longer than necessary and not to transfer it to other parties, and is generally interpreted as requiring companies to wipe drives of computers it's disposing of. Difficult to see how a repair outlet selling on a disk drive full of its client's data as a "refurbished computer" would be exempted from that

That's a massive stretch. Has this ever made court?

I believe a court would find it was the owner's responsibility to wipe it, not Tesla's. Tesla didn't put it there.

Sounds like you theory crafting rather than an actual law.

The GDPR doesn't say its my job to make sure my data doesn't get shared with other people. I think it would be a clear case myself.

It looks like not even all Tesla models have a factory reset functionality: https://forums.tesla.com/forum/forums/factory-reset

That's potentially difficult if the car is totaled.

Can you even factory reset a Tesla? I don't know, I don't own one. Just curious.

If so, does it clear out data on car only or does it clear me out of Tesla's cloud as well?

Rich Rebuilds vidéos about his Tesla purchase suggests that Tesla’s used car market is just a front-end for Mannheim, the same auction house that every other car company uses to buy/sell its used working cars.

This is not only Tesla. I bought a used Mercedes from a Mercedes dealer and the navigation system still had the previous owners address and every other data that was synced (like smartphones) were all visible.

Every time something crappy about Tesla is revealed, someone also needs to point to other car manufacturers. PR?

Hmm, or they are warning Mercedes owners as well?

I wish I would get paid by Tesla lol.

Not just buying, either -- next time you get a loaner from the dealer's service department, check out its history as well.

In that case it really isn't obvious that the dealer is the one who should be responsible for wiping the car's memory.

I've a similar experience with my CPO Tesla, though in my case it's limited to the previous owners Spotify music being still there, and I've had lots of trouble trying to remove it - random shuffle picks their music as often as mine

This is starting to sound like a class action lawsuit waiting to happen lol

Do you mean Slacker?

Spotify in Europe.

In my state, there is a public record of all car sales so if you have a car you can look up the address and names of previous owners.

Names and addresses are generally not even considered 'private' information here; its only that the situation for apartment dwellers are inconsistent so no one bothers with record keeping there.

That is quite shameful. How to store data in the car is at least a complex problem. Theoretically I might want the data there and other car companies might be doing the same. I assume the GPS devices store previous navigation that is readily accessible in case of a crash. But not wiping data on a refurbished device has no excuse.

Reply on news.ycombinator.com