Digital access can outlast ownership
Connected-car apps can show a vehicle's location and, on some models, let users lock doors, unlock them or start the engine remotely. If an account remains linked after a sale, those capabilities may remain available to someone who no longer owns the car.
Mazda Australia's terms and conditions explicitly acknowledge that possibility: "The previous owner may be able to continue to use the Services in respect of the Connected Vehicle." Mazda also says an unreported sale could leave vehicle reports and other information going to the seller's registered contact details.
Hyundai and Kia acknowledge that sellers can still track cars through their apps when accounts remain connected. Mercedes-Benz warns that a former owner may retain location tracking and remote unlocking access. Ford Australia's guidance for Ranger pickup buyers and sellers calls for a master reset to remove previous users, while Volvo, Nissan, Tesla and Polestar provide instructions for unlinking accounts or transferring digital ownership.
The issue affects a substantial resale market: Australia recorded more than 258,000 used-vehicle sales in September alone. Connectivity is also expected to become more widespread. In its December 1, 2025, advisory on smart-car misuse, the eSafety Commissioner estimated that more than 90% of new cars sold in Australia by 2031 would have embedded connectivity.
Dealers begin work on a national process
The Australian Automotive Dealer Association told Yahoo News Australia that it had started preliminary work on a national process to address access left over from previous ownership.
"We are not aware of a single, consistent industry-wide standard specifically addressing the transfer of connected vehicle accounts and remote access when a vehicle changes ownership," an association spokesperson said.
Australia also has no national equivalent to California's Senate Bill 1394. Signed on September 27, 2024, the measure was the first connected-vehicle protection law in the United States. It requires manufacturers to end a person's access to connected services within two business days after receiving a documented request from a driver who supplies proof of legal vehicle possession or a domestic violence restraining order. Manufacturers cannot charge a fee for doing so.
Connected-car controls used in abuse
Resale is not the only setting in which retained access poses a risk. In December 2025, eSafety Commissioner Julie Inman Grant warned that abusive partners were using connected vehicles to monitor and intimidate victims.
"Through our service, we're hearing of cases where abusers access trip histories to keep tabs on a partner's movements, remotely lock doors or change the heating to intimidate them, and use kill switches to prevent them travelling beyond certain distances," she said.
The Sydney Morning Herald reported that month that more than 20,000 frontline workers had accessed eSafety's Technology-Facilitated Abuse Support Service during its first year.
An earlier case in Tasmania involved a man who admitted stalking his former girlfriend by secretly following her movements through an app linked to her Land Rover. The court heard that the app also allowed him to operate the windows, air conditioning and engine functions remotely. He received a suspended prison sentence in March 2020. Although the case was not an ordinary used-car transaction, it illustrated the potential for misuse when a person keeps access without the driver's knowledge.
In September 2026, a Sydney court sentenced Enrico Pucci, 50, to two years and three months in prison following convictions on 30 domestic violence-related charges, including one count of coercive control, according to Tech Times. He used Tesla's remote parental controls to limit his former partner's speed to 40 km/h, alternate the cabin temperature between extremes and make seven attempts to interrupt the car's charging. Pucci has appealed all 30 convictions.
New South Wales was the first Australian state to make coercive control a standalone offense. The Crimes Legislation Amendment (Coercive Control) Act 2022 took effect on July 1, 2024, as Section 54D of the Crimes Act 1900 (NSW), with a maximum prison term of seven years. A state monitoring report recorded 297 victims in the law's first year; 94% were female.
Broader scrutiny of vehicle security and data
A separate demonstration reported by ABC Four Corners in September 2026 examined remote access to a BYD Shark 6. Cybersecurity researcher Dan Hreszczuk, co-founder of Canberra-based Fortify Labs, gained physical access to the vehicle for about two weeks before demonstrating remote control of several functions.
He could lock the doors, operate the lights and wipers, use the infotainment system, access the microphone and track the vehicle's location. The demonstration did not provide access to safety-critical functions such as the brakes and cameras.
Data handling has also drawn regulatory scrutiny. According to the Australian Automotive Aftermarket Association, reporting in October 2026 noted that the Office of the Australian Information Commissioner had confirmed in April that it was investigating Toyota and Hyundai over their management of connected-vehicle data.
The aftermarket association wants the federal government's privacy reforms to address connected vehicles explicitly. It argues that the draft legislation does not generally require affirmative consent before collecting vehicle-generated personal information. It is also seeking stronger protections for passengers and secondary drivers, along with stronger rights to have vehicle data deleted.
