PHION
Files 10 Uptime 309d Latest 0d

Disconnecting your car, and the EU’s new driver-monitoring mandate

By burt Published 2026-07-21 Class Hardware & DIY Read 10 min

In 2016 a San Francisco couple bought a Tesla Model X, with the husband set up as the vehicle’s administrator. They separated in 2018, and a family court judge found the abuse allegations against him credible. Over the following years the woman said she would return to the car to find its doors unlocked, its suspension altered, or its charging disabled — all controllable remotely through the same app her husband had used since 2016. In May 2020 a police sergeant had to formally request her own location data from Tesla. When she sued, Tesla’s position was that because his name remained on the title as co-owner, it could not remove his access without his password, and it had “no specific companywide policy” on stalking. In 2022 a judge ruled in Tesla’s favour, finding both parties “had a right” to use the vehicle’s technology and questioning how a manufacturer could even verify an abuse allegation. The case settled on undisclosed terms in 2023.

The point isn’t that Tesla is unusually careless — the same account-based access model, with no hard offline switch a car’s legal owner can flip unilaterally, is standard across the industry. A modern car’s connectivity is controlled by a cloud account, not by the person sitting in the driver’s seat, and the manufacturer’s willingness to intervene is the only thing standing between a stalker and a car that reports its target’s location on demand. That’s the case for understanding — and if you want it, disabling — the physical hardware behind that connection, independent of what any account, app or company policy says.

What’s in the car

The component doing this is the telematics control unit, or TCU: a cellular modem, a GPS receiver and a small processor, wired into the car’s other electronics. On most cars sold since the late 2010s it maintains a persistent connection to the manufacturer’s servers whenever the car is on, and on a growing number of models, while it’s parked too. Mozilla’s Foundation reviewed the privacy practices of 25 car brands in 2023 and gave all 25 its “Privacy Not Included” warning — the first product category where every single entry failed. Eighty-four percent of the brands reviewed said they share personal data with service providers or data brokers, seventy-six percent said they sell it, and fifty-six percent said they’d hand it to a government or law enforcement agency on an informal request, without requiring a court order. Nissan and Kia’s privacy policies specifically list “sexual activity” among the data categories they may collect; six of the twenty-five claim the ability to collect genetic information. None of the brands reviewed met Mozilla’s minimum standard for encrypting the data in transit.

The one channel that’s legally protected

One modem, two logically separate uses, and only one of them is legally protected — that’s the exception worth naming precisely, because it complicates the “just disconnect it” instinct. Since 31 March 2018, every new type of passenger car and light van sold in the EU has been required to carry eCall: on detecting a serious crash, the car automatically dials 112 and transmits a minimum data set — location, time, vehicle identification number, direction of travel — to route emergency responders to the scene. The regulation behind it, Regulation (EU) 2015/758, is unusually specific about privacy for a road-safety rule: Article 6(4) requires that “the 112-based eCall in-vehicle system is not traceable and is not subject to any constant tracking,” and Article 6(6) bars that location data from reaching any entity outside the system before a crash triggers it. On the European Commission’s own account, no tracking or data transmission happens during ordinary driving at all.

The problem is that eCall’s radio hardware — modem, GPS antenna, sometimes a backup battery — is the same core module manufacturers use for their own commercial connected services, fleet tracking, over-the-air updates and remote-app features. The regulation constrains what the emergency channel is allowed to do; it says nothing about the commercial channel riding the same silicon. Pull the TCU’s fuse and you switch off both channels at once, because there’s usually no way to kill one without the other from outside the dealership’s diagnostic tools — one fuse, not two. Whether an owner is legally entitled to disable the emergency channel on their own registered vehicle is a question that stays unsettled and varies by EU member state and isn’t something to take a manufacturer’s word on either way — some claim outright it can’t be done, others less certainly; check your own country’s roadworthiness rules before treating this as your problem to solve unilaterally, rather than the manufacturer’s rule to enforce.

The EU’s new mandate makes this bigger, not smaller

From 7 July 2026, under the second EU General Safety Regulation (GSR2), every newly registered passenger car, van, truck and bus sold in the EU must carry an Advanced Driver Distraction Warning system — typically an infrared camera pointed at the driver’s face, tracking gaze direction and head position. The thresholds are specific: at 20–50km/h, a warning fires if the driver’s gaze sits in a defined “distracted” zone for more than six seconds; above 50km/h, that drops to 3.5 seconds. A related Driver Drowsiness and Attention Warning requirement, in force since 2021, assesses alertness through steering and lane-position patterns rather than requiring a camera outright.

The regulatory text leans toward privacy by design: the delegated rules require these systems to run without relying on stored biometric identification such as facial recognition, and to retain no more data than the warning function itself needs. In principle, gaze-tracking happens on-device and nothing about your face leaves the car. In practice, that camera is wired into the same electrical architecture as everything else described above, the regulation doesn’t require it to be physically isolated from the TCU, and “the manufacturer says it doesn’t transmit footage” is a policy promise, not a hardware guarantee — precisely the distinction eCall’s own legal privacy protections don’t erase for the commercial channel sitting next to it.

Australia has none of this — yet

Australia and New Zealand have no equivalent of eCall or GSR2’s driver-monitoring mandate in their vehicle standards. ANCAP, the voluntary safety-rating body, is folding eCall assessment into its 2026–2028 crash-test protocols and has said it will penalise driver-monitoring systems that irritate rather than support the driver from January 2026 — but these are rating incentives that affect a car’s star rating, not Australian Design Rules with the force of law. A car sold in Australia can still ship with a full commercial telematics package regardless of any of this; it’s simply not compelled to carry the EU’s specific emergency-call or driver-camera hardware. The same one-modem, two-channel setup — persistent commercial connection, data sold to brokers and insurers — still applies here; it just isn’t compelled into existence by an EU-style mandate, only by manufacturer choice.

Disconnecting the TCU

The reliable method is physical, not digital — there’s no settings menu that cuts the cellular link, only ones that ask the same servers nicely not to look. The steps generalise, but it helps to see them worked through on one specific car. The Toyota RAV4 is a reasonable choice: it was the best-selling car model in the world in 2025, over a million units, so this is the TCU sitting in more driveways than any other.

Toyota calls its module a DCM (Data Communication Module) rather than a TCU, but it’s the same thing: cellular modem, GPS, and the hardware behind Toyota’s Connected Services and the SOS/crash-notification feature. On current RAV4 generations it’s a fuse in the passenger-side interior fuse box, explicitly labelled “DCM” or “Telematics system” on the box’s own diagram — Toyota doesn’t hide which fuse it is, though the exact number and amperage shift between model years and trims, so the diagram printed inside your own fuse box cover is the one to trust, not a number quoted for a different year. Owners working through the procedure on the RAV4 owners’ forum report a 7.5A fuse on their model years, and two details worth knowing before you start: the module keeps an internal backup battery, so it can stay briefly live after the fuse is pulled, and it will keep reaching Toyota’s servers through a paired phone’s own connection if you leave Bluetooth linked — pulling the fuse and then handing the car your phone’s data connection anyway defeats the point.

The general procedure, RAV4 or otherwise:

  1. Find the fuse. Check the diagram printed on the fuse box cover, or the owner’s manual, for anything labelled “Telematics,” “TCU,” “DCM,” “OnStar,” “Connected Services” or similar. It moves around by make and even by model year: fuse #10 on some Ford Mustangs, fuse #31 on the Chevrolet Bolt, a fuse labelled “UC4 Modem” on some Ram trucks, alongside the RAV4’s labelled DCM fuse above.
  2. Pull it. This cuts power to the module entirely, which stops both GPS logging and server communication. It’s reversible — refit the fuse and connectivity returns, including for a dealer service visit that expects it.
  3. Disconnect the antennas too, if you want to be thorough. Most TCUs have two or three antenna leads — cellular and one or two GPS. A module with the fuse removed but antennas still attached can still draw down the battery hunting for signal; owners report this contributing to parasitic drain. Pulling the fuse and leaving the antennas connected, or vice versa, is a half-measure.
  4. Know what it doesn’t kill. On many cars the TCU and the infotainment head unit share or duplicate hardware — the same cellular or Wi-Fi capability may be dual-homed to both, so a TCU fuse alone can leave a separate Wi-Fi hotspot function running. A paired phone can also keep relaying data on the module’s behalf, as above. Check for both rather than assuming one fuse handles everything.

What you give up

This is not a free action, and the trade-offs are concrete rather than hypothetical.

Automatic crash notification. If your car has eCall or a manufacturer equivalent (OnStar, BMW Assist, and similar all use the same TCU hardware), pulling the fuse disables it along with everything commercial. Nobody gets automatically notified if you crash somewhere you can’t call for help yourself.

Remote and convenience features. Remote start, remote lock/unlock via app, stolen-vehicle recovery tracking, over-the-air software updates, and live traffic data all stop working, because they all depend on the same connection.

Any insurance discount tied to a manufacturer telematics feed. Usage-based “pay how you drive” policies that pull data through the TCU rather than a separate plug-in OBD-II dongle will lose their data source; check with your insurer before disconnecting if you’re on one of these policies, since some treat a data gap as a policy violation rather than a neutral non-event.

A separate OBD-II dongle isn’t touched by any of this. If your insurer or employer has plugged a telematics dongle into the diagnostic port under the dashboard for a pay-per-kilometre or fleet-tracking scheme, that’s an independent device on a different bus, and disconnecting the TCU does nothing to it. It has to be found and removed on its own terms — and doing so may itself void the terms of the policy or lease that required it.

Limitations

Pulling the TCU fuse addresses one specific data path: the manufacturer’s own cellular connection. It does not anonymise you generally. Toll-road transponders, number-plate recognition cameras, an insurer’s separate OBD-II dongle, and your phone’s own location history while it’s paired to the car via Bluetooth or CarPlay all keep working exactly as before, on entirely separate systems this doesn’t touch.

It’s also not permanent in the way it might feel. A dealer service visit will typically refit the fuse as a matter of course, since diagnostic tools and some safety functions expect the module to be present and powered. Anyone relying on this for an extended period needs to check after every service.

Finally, the legal picture is not uniform. Manufacturer obligations under EU type-approval law are one thing; what an individual owner may lawfully do to their own registered vehicle afterwards is a separate question governed by national roadworthiness and vehicle-modification rules that this article can’t authoritatively resolve for every jurisdiction. Treat the practical steps above as a description of what’s mechanically possible, not as legal advice for your specific country.

Sources