On May 13, 2026, security researcher Arkadiy Tetelman physically removed the Data Communication Module (DCM) and built-in GPS from his 2024 Toyota RAV4 Hybrid. This action blocks the car’s ability to transmit telemetry data such as location, speed, and driver behavior to Toyota and third-party data brokers including LexisNexis and Verisk. While this disables over-the-air updates and emergency SOS features, the vehicle’s core functions remain operational, preserving basic drivability and safety 1.
Tetelman’s move reflects rising concerns about automotive data privacy as modern vehicles collect hundreds of data points, including real-time GPS location, fuel levels, sudden acceleration and deceleration, video footage from inward- and outward-facing cameras, and driver attention metrics via eye-tracking systems. This data is often shared with insurance companies to adjust premiums and sold to data brokers for profiling. Toyota’s RAV4 Hybrid, like many connected cars, enables these features by default, with opt-out options described as difficult or ineffective 1.
The blog post details multiple security and privacy incidents involving connected cars. In 2025, Subaru faced vulnerabilities that allowed remote unlocking and real-time GPS tracking of customer vehicles. Tesla employees were found sharing sensitive camera footage of customers in 2023, including images of naked individuals. In 2017, a Tesla vulnerability enabled remote access to vehicle locations and control over features such as summoning. Mozilla’s 2023 review of 25 car manufacturers revealed widespread data collection practices, including tracking sexual activity, immigration status, and facial expressions 1.
Removing the DCM and GPS from the RAV4 Hybrid disables all data-dependent features including over-the-air software updates and Toyota’s cloud-based services. This also disables automatic crash notification and emergency calling, a safety tradeoff acknowledged by Tetelman. However, core vehicle functions such as driving remain unaffected. The car’s microphone, wired through the DCM, initially stops working but is restored by installing a DCM Bypass Kit, which Tetelman uses to maintain hands-free calling functionality 1.
A notable side effect of removing the DCM is its impact on Apple CarPlay. The phone relies on its own GPS but also accepts location signals from the car’s GPS unit. Without the DCM, the RAV4’s GPS sends erratic location data, causing navigation apps to jump to incorrect locations, such as the middle of Nevada while Tetelman was in San Francisco. To fix this, Tetelman fully disconnects the car’s GPS, forcing the phone to rely solely on its own location services, which stabilizes navigation performance 1.
Tetelman’s blog highlights broader implications of connected car data collection. Data brokers like LexisNexis and Verisk aggregate telemetry data to build detailed driver profiles used for insurance underwriting and targeted advertising. Mozilla’s 2023 report found car manufacturers collect data on race, weight, and even genetic information, which is then sold to third parties. The report concluded that all 25 reviewed brands failed to meet basic privacy standards, underscoring systemic privacy issues in automotive telemetry 1.
The post also recalls a 2015 incident where security researchers Charlie Miller and Chris Valasek remotely hacked a Jeep Cherokee, gaining control over brakes, steering, and ignition. This demonstrated the risk of connected car vulnerabilities. More recently, a 2020 Tesla hack allowed attackers to access the entire fleet’s location data and remotely control vehicles, highlighting the dangers of always-on connectivity and the potential for malicious exploitation 1.
Tetelman’s solution of physically removing the modem and GPS is presented as a last-resort option for privacy-conscious drivers. While it disables convenience features such as remote diagnostics and emergency services, it guarantees no telemetry data is transmitted. The blog post provides step-by-step instructions for the procedure, including installing a DCM Bypass Kit to restore microphone functionality for hands-free calls, offering a practical guide for those seeking to regain control over their vehicle data 1.