Dutch intelligence: your smart car could be a spy. How to protect yourself

On 30 September 2026 the AIVD, the Netherlands' General Intelligence and Security Service, published a short brochure with a striking title: The modern car as a possible spy. The message: the microphones, cameras, navigation and internet connection of a modern car collect a lot of data about who is inside and what happens around it. According to the service, malicious parties, including foreign states, very probably have ways to reach that data. The advice is aimed mainly at people in sensitive positions, but the AIVD itself says every driver can use it.

This article covers what the brochure really says, what the coverage added that is not in it, how big the risk is for an ordinary driver and ten measures you can take today. With extra attention to a privacy trap almost everyone forgets: buying and selling a used car.

Be aware of the espionage risks that come with modern vehicles. (AIVD, September 2026)

What the AIVD actually says

The brochure is three pages long and sober in tone. Its core: a modern car automatically and silently collects data about its occupants, about the vehicle itself and about people and objects in the immediate surroundings. According to the AIVD, drivers often have no control over it.

Who can reach that data? Not just the manufacturer. The AIVD also names dealers, lease and maintenance companies, app developers, parts makers and cloud services. Beyond them, malicious parties are interested and, in the service's words, 'very probably also have ways to access it'. Some states can request the data from companies or hack their way in. Ordinary cybercriminals may want it to hold for ransom or to sell.

What it does not say: a country or a car brand. International and social media quickly read the warning as a warning about Chinese cars. The AIVD itself names no country and no manufacturer. The risks it describes apply to every car with microphones, cameras and an internet connection, wherever it was built.

Who is the warning meant for?

The advice is aimed first at dignitaries, people in key positions in business or government and others who hold sensitive information. Their conversations and movements interest foreign intelligence services.

But the AIVD explicitly adds that the advice also gives 'people outside that group' a handle on the broad data collection by cars, and helps them 'take themselves off autopilot'. Just as important: not every piece of advice fits every situation. Weigh up what each situation needs.

Does this mean your car is listening to you right now? No. The AIVD describes what is technically possible, not that ordinary drivers are being bugged at scale. For most people the realistic risk lies elsewhere: commercial data collection, data breaches and an app account that falls into the wrong hands.

The seven systems where the risk lies

The AIVD lists seven 'high-risk systems'. For each one, here is what the service says and the advice that goes with it.

1. Microphones

Many cars have several microphones: for hands-free calls, voice control and the emergency call system (eCall). According to the AIVD it is technically possible to switch them on remotely. Advice: do not hold confidential conversations in or around the car.

2. Cameras

Modern cars have cameras inside and out: reversing cameras, 360-degree cameras, guard modes that film the surroundings while the car is parked and cameras that watch the driver. These too can technically be switched on remotely. Advice: be aware of what the camera can see, and do not drive a car with an external camera to a sensitive location.

3. Pairing your phone

Bluetooth, Wi-Fi, a USB cable and the wireless charging pad are all links between your phone and the car. According to the AIVD, an attacker can use each of them to reach the car's systems, or reach the data on your phone from the car. Advice: avoid automatic Bluetooth or Wi-Fi connections, do not use wireless charging and do not simply plug your phone into USB; use a data blocker.

4. The infotainment system

The screen in the dashboard is the central point where the car collects and stores data. Think of the unique identifiers of paired devices, your contacts, internet traffic, messages you sent and navigation history. Part of it is passed on to the manufacturer and others. Advice: be careful about entering your home address or the address of a sensitive location, and decide per trip whether to use the built-in navigation.

5. GPS and track and trace

Manufacturers use these systems to follow a car live and log its journeys. Attackers can technically follow that live location too.

6. The telematics module

This is the car's built-in modem. It is always online, for traffic information, location data and software updates, and shares vehicle data with the manufacturer along the way.

7. Charging points

With electric cars, the charging point exchanges data about the vehicle plugged into it.

For these last three systems the AIVD is strikingly frank: 'The risks from these systems cannot be prevented by technology or behaviour.' The only advice is to weigh whether you want to use this car for a particular trip at all.

How to protect yourself: ten measures

The first four come straight from the brochure. The rest is our advice for anyone who wants more control over their car data, even if you are not a minister.

1. Keep sensitive conversations out of the car. Not inside it and not next to it either. A private talk about money, health or work is better held at home or on a walk.
2. Turn off automatic connections. Switch off automatic Bluetooth and Wi-Fi pairing, and delete old phones you do not recognise from the menu.
3. Charge by cable, with a data blocker. A data blocker is a small USB adapter that passes power and blocks the data lines. It costs a few euros. A charge-only cable works too. Leave the wireless charging pad unused.
4. Do not save your home address as 'Home' in the car. Navigate with your phone in a holder instead, without pairing it to the car. Your destinations then stay out of the car's memory.
5. Go through the privacy settings. Many cars and apps have a privacy mode or let you turn off location sharing, voice recordings and driving-behaviour sharing. Check both the car's menu and the manufacturer's app.
6. Secure your manufacturer account. Your car's app is effectively a second key: it can locate the car, unlock it and sometimes start it. Use a unique password and turn on two-step verification if it is offered.
7. Install updates. Software updates close security holes. Since July 2024 every new car sold in the EU must have an approved system for managing such risks and delivering updates safely.
8. Use your right of access. Under the GDPR you can ask the manufacturer what data it holds about you, where it goes and how long it is kept. The company must answer within one month. You can also ask for data to be erased. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) offers a template letter.
9. Switch guard cameras on deliberately. A guard mode that films the surroundings is useful against damage and break-ins, but it also films everyone walking past. Turn it off where you do not want that.
10. Wipe everything when the car changes hands. More on this in the next section, because it is the step most often skipped.

Want to protect the car itself against theft as well? Read how relay attacks on keyless cars work or see our tips on the protection page.

The forgotten privacy trap: buying and selling used

A car typically passes through several hands. Every previous owner, lease company or rental firm can leave traces behind: paired phones, saved addresses and, most importantly, an app account still attached to the car.

This is not theory. In the United States, a man who traded in his Ford Escape could still see through the FordPass app where the car was, how far it had been driven and what its tyre pressures were. Back in 2017 an IBM security researcher showed he could still control his old car through an app years after selling it. With some brands, only the manufacturer or the dealer can remove a former user.

Selling your car?

• Remove the car from your account in the manufacturer's app or website, and cancel any connected services.
• Reset the infotainment system to factory settings. That wipes paired phones, contacts, addresses and Wi-Fi networks.
• Unpair extras such as the garage door opener, toll badges and charging cards.
• Then check in your app that the car has really gone.

Buying a used car?

• Ask the seller to confirm that the car has been removed from their app account.
• Check the menu for phones and accounts that are still paired, and delete them.
• Register the car on your own account as soon as possible. With some brands, the previous owner's access only ends at that moment.
• Not working? Contact the dealer or the manufacturer and have the old user removed.

With a used car, check the car itself too: whether it is registered as stolen, whether the mileage adds up and whether the details match the RDW register, the Dutch vehicle authority. Our used car checklist walks through every step.

What does the law say?

Some of the sensors in your car are mandatory. Since 31 March 2018 new car models in the EU must have eCall, the system that automatically calls 112 after a serious crash, with a microphone and a speaker. EU rules require eCall to stay dormant in normal use and not to track the car. From July 2026 every newly registered car must also have a system that warns when the driver is distracted. In practice that is done with a camera pointed at the driver.

At the same time, security requirements have tightened. Since July 2024 every new car in the EU must meet UN Regulations R155 and R156: the manufacturer must show it manages cyber risks over the car's whole life and that software updates are delivered safely. Several older models left the showroom because of it.

Other countries go further. From model year 2027 the United States bans connected-car software from companies with ties to China or Russia, and from model year 2030 the hardware too. According to Brussels Signal, some German military sites bar Chinese car brands. The Netherlands and the EU have no such ban.

How big is the risk for you?

For a minister, a senior executive or someone holding state secrets, the warning is meant literally. For that group it can be wise to take another car, a taxi or public transport to sensitive meetings.

For most people the chance that a foreign service is listening is small. The bigger and more real risk is everyday: how much data the car collects and who it is shared with. When the Mozilla Foundation examined the privacy terms of 25 car brands in 2023, every brand failed. Mozilla called cars the worst product category it had ever reviewed. Add data breaches, and the app account of a previous owner or an ex-partner that still has access.

The good news: the measures that help against espionage also protect you against all those ordinary risks. That is why the AIVD brochure is worth reading, even if you never discuss a state secret in the car.

Sources: AIVD, 'De moderne auto als mogelijke spion. Digitale dreigingen in slimme voertuigen' (brochure, 30 September 2026) and the topic page 'Spionagerisico's en moderne voertuigen' (aivd.nl), in Dutch; Security.NL and Brussels Signal (30 September 2026); Mozilla Foundation, Privacy Not Included, cars (September 2023); U.S. Bureau of Industry and Security, connected vehicles rule (January 2025); Regulation (EU) 2015/758 (eCall) and (EU) 2019/2144 (general safety); UN Regulations R155 and R156; WGME and Engadget on previous owners' app access. Status: 11 October 2026.