Your car may already have the hardware for a feature you haven't paid for. In 2022 and 2023 BMW sold heated seats as a monthly subscription in several countries, Mercedes-Benz sold American owners of its EQE and EQS electric cars a software unlock for more acceleration, and Toyota in the US tied key-fob remote start to a paid connected-services plan. Each was a car-maker turning something bolted into the car into a recurring bill.
Australia has its own version of the trend, mostly in connected-services apps: remote start, remote lock, stolen-vehicle tracking and live maps, free for a period and then charged or switched off. The same systems collect location and driving data, and Australia's privacy regulator now has two car-makers under investigation over how much of that data they keep.
That matters most on the used market. A feature can be paid for by the first owner and quietly vanish for the second, the first owner's phone can still be linked to a car they've sold, and nobody prints any of it on the window sticker. Here's what has actually happened, what the law here says, how Europe is handling it, and what to check before you buy or sell.
At a glance
- BMW heated seats
- Sold by subscription in some markets, dropped for hardware features in September 2023
- Mercedes EQE unlock (US)
- US$60 a month, US$600 a year or US$1,950 lifetime
- Toyota Connect+ (Australia)
- From $9.95 a month after the free period, as reported in 2022
- Hyundai Bluelink
- Free for 5 years from first registration, 7 with the extended warranty
- Australian regulator
- OAIC investigating Toyota and Hyundai over driver data
- EU Data Act
- Gives car owners a right to their car's data from 12 September 2025
Paying again for parts you already own
The best-known case is BMW. The company offered heated seats as a monthly subscription, with a one-year, three-year or unlimited option, in markets including the UK, Germany, New Zealand, South Korea and South Africa, according to ArenaEV (opens in a new tab), which put the monthly price at about US$18. In September 2023 BMW backed away. Board member Pieter Nota told Autocar that "the user acceptance isn't that high", and BMW said hardware such as heated seats would be either fitted at the factory or not offered, as The Drive reported (opens in a new tab). Software-based features such as driver-assistance functions stayed on sale as on-demand extras.
Mercedes-Benz went further in the US with performance. Its Acceleration Increase upgrade for the EQE and EQS sedans and SUVs unlocks power the motors already have, delivered as an over-the-air software update. The Drive reported in April 2023 that the EQE version costs US$60 a month, US$600 a year or US$1,950 for the life of the vehicle (opens in a new tab), and the EQS version US$90, US$900 or US$2,950. The same report said the motors produce more power from the factory but need unlocking. We could not find whether a "lifetime" purchase follows the car to its next owner.
Toyota's US example is smaller but more telling, because it involved the key in your pocket. In late 2021 Toyota confirmed to Motor1 that key-fob remote start on some 2018-and-later models (opens in a new tab) would stop working once the car's connected-services trial ended unless the owner paid for a Remote Connect subscription. Toyota said the feature would stay active for any open trial period, with trials of three years on certain 2018 to 2020 vehicles and ten years on some 2020-and-newer ones. The Drive put the price at US$8 a month or US$80 a year; Toyota did not confirm those figures to Motor1.
Tesla: the feature on the screen may not be the feature you bought
Tesla sells several of its features as software, and its rules on what transfers have moved around. In 2023 Tesla changed the wording of its Full Self-Driving purchase terms. The original clause said FSD could not be transferred "to another person even if the vehicle is privately sold"; the revised clause dropped the private-sale reference, Drive Tesla Canada reported (opens in a new tab), which owners read as meaning FSD would now stay with a car when it was sold. Tesla's own FSD transfer program page (opens in a new tab) says a purchased FSD stays with the vehicle when it is sold to a third party, and that the program for moving FSD from an old Tesla to a new one has closed.
The used-car risk is not theoretical. In 2020 Engadget reported that a buyer of a used Model S listed with Enhanced Autopilot and FSD (opens in a new tab) found both disabled by a software update after he bought the car from a dealer, who had bought it at a Tesla auction. Tesla told him the car had been "incorrectly configured for Autopilot versions that they did not pay for." The car hadn't changed; the licence attached to it had.
Tesla's connectivity is another subscription. In 2020 Tesla cut the Australian price of Premium Connectivity, which adds live traffic, satellite maps and streaming over the mobile network, from A$16.99 to A$9.99 a month (opens in a new tab), according to The Driven. We could not open Tesla Australia's current page to confirm today's price, so check it in the app before you buy.
What Australian owners are being charged
In Australia the trend shows up mainly in connected-services apps rather than heated seats.
Toyota. When it updated its Connected Services in 2022, Toyota Australia priced its Connect+ tier from $9.95 a month after 12 free months (opens in a new tab), according to GoAuto. That tier covered remote lock and unlock, remote engine start and climate control, stolen-vehicle tracking, alerts when another driver uses the car, and trip and location history. Toyota's connected services FAQ (opens in a new tab) now says the length of the free period and the cost after it vary by package and by the data module fitted to the car, and that its emergency features are free for the life of the relevant mobile network. Toyota has also offered owners a free three-month Connect or Connect+ subscription (opens in a new tab) for completing a service at a participating dealer, a sign the paid tier is something it actively sells.
Hyundai. Hyundai's Bluelink terms of use (opens in a new tab) give five years free from the date of first registration, extended to seven where the car meets the servicing conditions of Hyundai's extended warranty. After that, Hyundai says it will tell owners the fees and terms if it chooses to keep offering the service, and if the owner doesn't subscribe it can "turn off your Bluelink Device." A new owner inherits whatever free time remains.
Kia. Kia's Kia Connect page (opens in a new tab) promises seven free years from the warranty start date, says the period does not restart when the car changes hands, and lists remote climate control, remote lock and unlock, remote engine start and vehicle tracking among its features. We could not find a published Australian price for either Bluelink or Kia Connect after the free period.
None of this is unusual or hidden: the free periods are generous and clearly stated. Our concern is what happens at year six or eight, when a car is on its second or third owner and remote start is a feature someone paid for once and is now asked to pay for again.
Who owns the data your car collects?
Connected services work because the car reports back. Mozilla Foundation's Privacy Not Included team reviewed 25 car brands in 2023 and failed every one (opens in a new tab), which Mozilla said was the first time in the guide's seven-year history that every product in a category had failed. Mozilla said none met its minimum security standards and that owners had almost no control beyond buying an older model.
All new cars today are privacy nightmares on wheels that collect huge amounts of personal information.
The clearest legal test of where that data goes came in the US. The Federal Trade Commission finalised an order against General Motors and OnStar (opens in a new tab) on 14 January 2026, settling allegations that GM used a misleading enrolment process for its OnStar Smart Driver feature and sold drivers' precise location and driving-behaviour data without informed consent. The order bans GM for five years from passing that data to consumer reporting agencies, and requires express consent before collecting or sharing connected-vehicle data, plus ways for owners to get a copy of their data and have it deleted. TechCrunch reported (opens in a new tab) that the data had gone to brokers including LexisNexis and Verisk, which sold it on to insurers, and that GM ended Smart Driver in April 2024. GM did not admit wrongdoing.
In Australia, CHOICE asked the makers of the ten most popular brands about their practices in 2024 and found seven collecting or sharing driver data (opens in a new tab), including Toyota's driving-behaviour scores and location data and Tesla's in-cabin camera clips. Mitsubishi, Subaru and Isuzu Ute said they didn't collect or share driver data here. In February 2026 Privacy Commissioner Carly Kind told Senate Estimates the Office of the Australian Information Commissioner had open investigations into two car-makers (opens in a new tab), and CHOICE later reported they were Toyota and Hyundai (opens in a new tab), with the OAIC saying it aims to finish investigations within 18 months. Neither company has been found to have breached the law, and Hyundai told CHOICE it takes privacy seriously.
What protects you here? The Privacy Act's principles apply to these companies, and since 10 June 2025 there has been a statutory tort for serious invasions of privacy (opens in a new tab) that individuals can take to court. The bigger change is still a draft. On 31 August 2026 the government released the Privacy Amendment (Personal Data Protection) Bill 2026, which would make every collection and use of personal information pass a "fair and reasonable in the circumstances" test (opens in a new tab), according to law firm Allens. Its proposed right to have data erased would apply only to large digital platforms, and it is not yet law.
We could not find any Australian right, in force or in the draft bill, for an owner to get their car's own technical data. The motor vehicle repair information scheme gives independent workshops access to repair and servicing information, which we covered in Australia's repair information scheme, three years on (opens in a new tab); it isn't a data right for owners.
The case for remote control, fairly put
Connectivity has a real upside, and it would be dishonest to skip it. In December 2023 Tesla filed a recall covering 2,031,220 vehicles (opens in a new tab) in the US to add controls and alerts to its Autosteer system, delivered as an over-the-air software update. More than two million cars were fixed without a workshop visit. Stolen-vehicle tracking and automatic crash calls are genuinely useful too, and Toyota keeps its emergency features free.
Our answer is that the same pipe carries both. A connection that can fix two million cars overnight can also change two million cars overnight, and a feature that can be switched on remotely can be switched off remotely, as that Model S owner found. Not every fix travels over the air either: Toyota's recent electric C-HR software recall still needs a dealer visit (opens in a new tab).
What Europe did: a legal right to your car's data
The European Union has gone furthest in giving owners a say. Its Data Act applies from 12 September 2025 (opens in a new tab) and covers connected products, with connected cars among the Commission's own examples. Under it, anyone who owns, rents or leases a connected product can get the data their use of it generates, free of charge, through a simple process, and can have it shared with a third party of their choosing. Makers must tell buyers before the sale what data the product generates, and a data holder cannot use the product's non-personal data without the user's agreement.
There are limits. Data holders can refuse or restrict sharing where they show it would very likely cause serious economic damage through trade-secret disclosure, or undermine safety and security requirements set by law, and the data can't be used to build a competing product. The biggest tech gatekeepers are excluded as recipients.
The Commission published guidance on vehicle data the day the Act took effect. According to law firm Mayer Brown (opens in a new tab), it treats raw and lightly processed data such as sensor signals, vehicle speed, battery level and fluid levels as in scope, along with services such as remote control and some repair and maintenance, while new information derived by combining sources, such as predictions, is out. A second step began last month. Products placed on the EU market from 12 September 2026 (opens in a new tab) must be designed so users can reach their data directly where that is relevant and technically feasible, law firm Travers Smith says.
| Feature | Australia | European Union |
|---|---|---|
| Owner's right to the car's own data | No | Yes |
| Right to send that data to a repairer or other third party | Workshops get repair information, not your car's data | Yes |
| Maker needs your agreement to use non-personal car data | No | Yes |
| Must tell you what data the car generates before you buy | General privacy notices only | Yes |
| Status | Privacy reform still a draft | In force since September 2025 |
We think there are three things Australia can take from this.
- Make the data the owner's, not the brand's. The Data Act starts from the user, not the manufacturer. A right for owners to get their car's data and pass it to a mechanic of their choice would sit naturally beside our repair information scheme.
- Tell buyers before the sale. A plain statement of what a car collects, shown before you sign, would cost makers little and help used buyers most.
- Tie paid features to the car. Europe's law doesn't do this, and neither does ours. A rule that a paid-for, permanently unlocked feature stays with the vehicle on resale would be a genuinely Australian improvement.
What it means if you're buying or selling
Buying a used connected car. Ask the seller, in writing, which features are factory-fitted and which are subscriptions or software unlocks, and whether each one transfers. For a Tesla, check in the app which features are licensed to the car. Find out when the free connected-services period started: Hyundai counts from first registration and Kia from the warranty start date, and neither restarts for you. Budget for any paid tier you'll want once it ends, especially remote start or stolen-vehicle tracking.
Then make the car yours. Factory-reset the infotainment system, register your own account with the brand's app, and confirm the previous owner's account is gone. Kia's own page warns that a used buyer should reset the system because a previous owner who never disconnected may still be able to track the car (opens in a new tab) through the app.
That risk is spelled out in Hyundai's terms, which say anyone with a Bluelink account linked to a car can see its location and use remote start, lock and unlock.
Selling one. Hyundai's terms set out the steps for Bluelink owners: reset Bluelink to factory settings through the infotainment screen, cancel the subscription in the app, delete the car's VIN from your account, and delete any shared digital keys. Kia's equivalent is the deactivate button in the car and Account Reset in the app. Do the same for any brand: unlink your phone, delete saved addresses and contacts from the car, and tell the buyer how much free connected-service time is left. If you bought a transferable software feature, show the buyer where it appears in the app, because a buyer who can see it is a buyer more likely to pay for it.
A seller's statement that a feature is included is only useful if it's on paper. Put any paid or unlocked feature, and whether it transfers, on the receipt or contract of sale.
Our take
This is our view. A car should be something you own, not something you rent in parts. The subscriptions so far have been modest, and BMW's retreat shows buyers can push back. But the direction is clear: features that once came with the car now come with a login, the login belongs to a person rather than the vehicle, and the data flows to the maker by default.
We think that's a bad deal for the second and third owners who keep Australia's car fleet running, and the people with the least say in how the first owner's account was set up. It's also why simpler, less connected cars hold an appeal beyond nostalgia: nothing in them can be switched off from a server, and nothing in them reports where you've been.
We accept that over-the-air updates fix real faults, and that crash calls save lives. What we'd like is for Australia to follow Europe in making the car's data the owner's, to require clear disclosure before a sale, and to go one step further by making paid-for features stay with the car. Until then, treat a connected car's apps like its logbook: check them before you buy, and hand them over properly when you sell. Whatever you drive, MotorLoop is where you can buy, sell & show it, for free.
For the security side of connected cars, see our piece on why the CAN bus trusts what it hears (opens in a new tab).
Header photo: SirAsdof (opens in a new tab) via Wikimedia Commons, CC BY-SA 4.0 (opens in a new tab).
Related
- Cars are computers on wheels now, and the CAN bus trusts what it hears (opens in a new tab)
- Toyota is recalling 8,521 electric C-HRs for a software error, and the fix can't be sent over the air (opens in a new tab)
- Australia's repair information scheme, three years on (opens in a new tab)
- The ACCC is taking Subaru to court over who gets to fix your car (opens in a new tab)