BMW ConnectedDrive lets me control my returned rental car (Sixt)

72•derturm666•14h ago

Last week I rented a BMW from Sixt (Italy).

The default rental driver profile had Bluetooth disabled, so I created my own BMW ID, paired it with the car, removed the existing profile, and even triggered software updates.

When returning the car, I told the Sixt representative that I had linked my BMW ID — they assured me that the vehicle would be reset.

Today — just before deleting the “My BMW” app — I checked out of curiosity.

Surprise: I still had full remote access:

- live location tracking

- remote lock/unlock

- honking (hehe)

- turn lights on/off

At this point, the car was presumably already rented to someone else. I could track the new renter’s location and remotely interact with the car.

IMO, this exposes a serious security/privacy issue:

- BMW ConnectedDrive still had my account associated to the vehicle VIN

- Sixt’s reset procedure didn’t revoke my BMW ID access

I suspect this may not be limited to Sixt, but could affect other rental fleets using ConnectedDrive if proper backend disassociation isn’t done.

BMW allows fleet integrations via ConnectedDrive Fleet Services, but I wonder how many rental cars globally still have previous renters’ IDs attached.

Comments

7bit•13h ago

If you want to invest the time you can report this DPA violation. They are obliged to reset the car to ensure the next renters privacy, especially if you told them. Violations can be expensive and it is generally a good idea to report so the big corps keep getting reminded that privacy is an important right of their customers.

bryant•7h ago

Enterprise Holdings manages theirs via fleet, so while a BMW ID can be added, the car is generally fleet restricted. Includes restrictions on capabilities like using (the cursed) subscription "features" you've paid for.

So yeah at least one of the big renters has handled it appropriately on the cars I've rented from them.

monster_truck•6h ago

They seem to be better with some brands of cars than others, the sports car I rented from them was not reset or restricted in any way.

thatjoeoverthr•6h ago

What timing. I rented a BMW from Sixt in Italy last week. Worst thing I have ever experienced as a driver. I wrote about it here: https://x.com/thejoephase/status/1933156741031633159

Constant interruptions and problems from the computer. I've dealt with a few "modern cars" but this was over the top. I'll never rent or buy a BMW going forward.

powvans•6h ago

This is amazing! I am vacationing in Spain and rented, I think, the same model as you. A BMW X2 M something or other.

Absolutely rock bottom by far the worst driving experience ever. Ultimate driving experience indeed. Insane and subtle annoyance, major wtfbbq moments, endless alarm dinging when you exceed whatever speed limit it incorrectly read from a sign, and on and on. The slamming on of the parking brake as you approach a large blade of grass in reverse is nerve wracking and startling even when you know it’s going to happen.

On narrow streets and in parking lots it feels less maneuverable than my full size American SUV. It may have the same turning radius despite being half the size.

Your tweet is making me laugh because honestly you cannot exaggerate how bad this car is. Every time we get in and start going my wife and I share a moment of incredulity. How can they have made this car this bad?

wil421•6h ago

None of these things happen in my X5. It will even detect my bike rack and not automatically stop like my wife’s X7 does with iDrive 7. You can turn off all the speed warnings but no one is going to do it in a rental.

Not surprised the X2 sucks it’s the cheapest model and usually the Germans do not do well in this category. The cheap small Mercedes are similar.

The biggest annoyance is the horn beeps when I leave the car running and grab something from the trunk.

thatjoeoverthr•6h ago

I believe some of it should be configurable, but I'm mystified that the default configuration should be so aggressively unempathatic to the driver. I did manage to turn off the thing where it covers the map with my forward camera view. But if Car Play worked, I wouldn't have bothered, and would have kept using Google Maps.

skylurk•6h ago

Same experience here, with a brand new Audi I got "upgraded" to. I'd take an old Yaris over that zoo any day.

FirmwareBurner•5h ago

>How can they have made this car this bad?

Typical German beancounter MBA run company treating SW like a cost center.

"We need to add interactive computers on cars because that's the latest hip trend, but we need to outsource it to the cheapest bidder because SW development is not a "real" engineering discipline and we don't like paying for good SW developers."

Then a manager from another division hears there's computers in cars and decides to improve his KPIs by forcing ConnectedDrive signup in every car and gets a massive promotion.

bayindirh•5h ago

When I saw Mercedes' "HyperScreen (TM)", and read that EQS doesn't recommend you pop the trunk and hide the latch behind a screwed cover, I decided that I'd never approach them for a very long time.

BMW lost its (not only visual but whole company) soul when they decided that catering to Chinese aesthetics will be their global image forward, and the details of how the car behaves is... nuts.

VAG lost my trust with DieselGate already.

Zee Germans.

anonymousiam•4h ago

Well, I switched from BMW to Mercedes because I was done with BMW's "performance over reliability" philosophy. I'm staying away from their EVs though, thanks for the tip.

thatjoeoverthr•5h ago

It's a fair question, how does it happen? The faults resemble a lot of problems across the industry, and is even analogous to the new Apple updates, which is a total lack of empathy or care of the person who has to use it. Like the screen behind the steering wheel has this UI like from an early 00s X-box game, and I'm sure when they're in the office, and they know what everything is, they go, "wow, that sure looks futuristic, like an X-box, ship it". And nobody thinks about the fact that your eyeballs use contrast edge detection to discard information, or the fact that in some places you have a bright sun on the screen, or that I might need some information more than some other information. Careless, shameless and ignorant.

Before this, the strangest I had seen was in a new Renault Clio where they had removed the tachometer and instead had a large icon of a green leaf that fades in and out of existence.

I felt like that was peak modern UI "design" but now I know you can do so much worse.

amelius•5h ago

Reminds me of:

https://www.theverge.com/2023/9/7/23863258/bmw-cancel-heated...

PeterStuer•4h ago

I have a BMW X3 and never have had any of the problems you describe. I use Android, not Apple, so that might be a factor.

thatjoeoverthr•2h ago

I would admit it could be possible that the iPhone is what slams the brakes while I'm slowly and cautiously reversing, or turned on the parking brake while I'm trying to move, but since the pairing wouldn't restore on start up, and I gave up on having Spotify or a good map app, in fact the phone was often not connected at all.

Neywiny•6h ago

Not sure how it varies across the pond, but I've rented a few cars in the States and they've never been reset. You'd think they'd have a rental mode or something. But instead, it's full of their preferences, phones, etc. Very annoying when they turn off modern safety features and stuff

alistairSH•3h ago

Somedo have rental/fleet modes, including BMW. The rental agencies just aren't using them.

bayindirh•6h ago

I once rented a Peugeot 3008, and wanted to pair with Apple CarPlay. The car warned me that it's in "rental" mode and pairing will disable that and will share tons of data (which was listed as bullet points) about me and the car between my (apple) profile and the car.

I rejected and didn't go further. I appreciate the honesty, though.

alistairSH•5h ago

That's interesting, as CarPlay is mostly just a fancy screen share.

You don't need a profile on the car, at least not a manually entered profile. I always assumed the "pairing" was more of a basic handshake than some big data load/share/whatever.

bayindirh•5h ago

I assumed the same so, but as far as I remember, the data contained serial numbers (car VIN + phone serial), speed, location and some more data.

It's probably for automated emergency notifications, better route tracking when GPS is unavailable, etc.

Apple does a lot of magick with their own software, and also there are some telemetry related things, I guess.

Maybe car related data is used for car integration, IDK. Need to watch [0].

[0]: https://developer.apple.com/videos/play/wwdc2016/723/

dylan604•6h ago

I've read in multiple places that this "resetting" is something that is on a list of things to do, but is rarely done. I seriously doubt any person working at the rental place prepping the car for the next use does anything but the most basic/obvious of refreshing. I'm guessing after checking the fuel status and the mileage, they just don't care. I doubt that cars get vacuumed after each rental and only if it's obviously needed.

As the person that is entering their own personal information into a car that you do not own, you absolutely should be the one to remove that data. Do not depend on someone else doing their job. You took the time to add it, so take the time to remove it. It is the only way to be sure.

dboreham•5h ago

Most rental cars I get have numerous bluetooth profiles for previous drivers, confirming that the "reset" is rarely done.

nunez•5h ago

Yes, this has been known for many years.

Most rental car companies don't bother setting up fleet services for their connected vehicle services. They require infrastructure that car rental companies don't seem to consider important.

I've used this mostly to remote start my rental car in cold climates. I delete my account after my rental is done, though I've learned recently that some providers, like Hyundai, make this SURPRISINGLY difficult.

The only exceptions I've seen to this are FordPass with Avis (this was locked down a few years ago) and Tesla with Hertz (before they unloaded them all).

abcd_f•5h ago

I have a year old BMW and the software is a complete and utter f*cking trash. The whole UX is just garbage.

Basically BMW goes out of its way to force drivers onto ConnectedDrive. Half of the functionality is hidden - for no clear reason - behind online ID.

You'd assume that if my wife or I open the car with our respective keys, we'd have the matching profile loaded, the seat adjusted, etc. Mwahahaha. NO! Unless the key is linked to an online ID - no soup for you! Infuriatingly stupid.

The dealer essentially forced me to create an online ID and activate ConnectedDrive saying they can't deliver the car otherwise. Immediately after, the car enrolled itself in some sort of Premium trial and never bothered to mark what functions are included and which are premium. It took 2 phone calls to get the trial cancelled and - what do you know - the traffic info was a part of it! What a bunch of wankers.

Even then, you'd assume that if they are so set of online bullshit, it would be polished. Ha, dream on. If you unlock the car and it has no cell connectivity, you get a guest profile. Car starts speaking German, all settings are at defaults, including the seat position.

I mean ... it's not my first BMW, but the pace of its enshittification is beyond belief. Stay the heck away.

dboreham•5h ago

Not limited to BMW. I have owned and rented cars from many different marques and terrible software is a constant. Haven't tried Tesla, but people say it is better.

My biggest peeve is when the car has several different contexts for configuration and/or auth that have been layer on each other like mud deposits. The user meanwhile has no idea that's what happened. So for example the seat position can be saved by pressing a button. But also is saved in a driver profile when the vehicle is locked. And then that driver profile can be backed by a cloud account. There's no user feedback at all as to what and where the car stored your seat position and the driver is left bemused as to why the seat is where it is and how to have it in the right place.

thatjoeoverthr•2h ago

Not limited, for sure. Many vendors are behaving this way. They should all be named and shunned.

jsumrall•5h ago

I rented a BMW from Sixt in the USA earlier this year. I wanted to use the ConnectedDrive features, but it was blocked by BMW because the vehicle VIN was (correctly) registered as a Fleet Vehicle (i.e. a rental car) and thus none of those features were allowed with that car.

I have rented BMWs in the Netherlands and don't recall being able to use these features either.

Thus you seem to have encountered a situation which BMW and Sixt know about and have procedures in place to prevent, but their Italian subsidiary seems to have missed it with a certain batch of fleet vehicles, or just this specific one. I'd report it Sixt and move on.

bosse•4h ago

I've rented beamers with Sixt at LAX and O'Hare, the latter just a couple of weeks ago. I didn't have any issues connecting to bluetooth so that I could use CarPlay. Could it be inconsistencies in how their BMW fleet is set up?

I ususally set up the bluetooth connection before driving off the lot, just so I can get staff assistance if it doesn't work - not being able to connect to the car is enough for me to insist on a new vehicle if they're unable to fix it.

jsumrall•2h ago

Bluetooth and carplay do indeed work as you need to be connected to the vehicle. I used those features too. The ConnectedDrive feature discussed here is when you install the BMW app on your phone and register the VIN number of the car to your personal BMW account, verified by tapping some buttons in the vehicle while linking, and "owning" the car in your BMW app. This gives access to things like remote location tracking, starting the car from anywhere to get the airco etc working.

n.b. Doing this in a rental car probably violates some of the terms and conditions one would have to agree to when linking the car, like "I promise this is _my_ car and/or I have permission from the owner to link it to my personal BMW account"...

drdunce•5h ago

I'm baffled how we've come to accept such poor quality software in our products and key services. We seem to shrug off software issues that would deter purchase if they were material or mechanical.

bastawhiz•5h ago

How is this a software quality issue? This is a process issue with the rental company. It doesn't sound like the car itself is doing anything wrong.

drdunce•5h ago

I don't have a BMW, so I may be wrong, but from the comments it sounds as though:

1) physical access gives remote privileged access - this is a car, not a server! We don't lock cars in data centers, friends, family, mechanics, the car wash, valets or an entire custom base in this case may have access.

2) there is an idiosyncratic process that must be followed to ensure the vehicle is suitable for this use which is sufficiently obscure that it's often overlooked. The risks of which, are quite grave (remote tracking).

3) even if everything is done "correctly", it will limit the functionality to the product you've paid to rent.

alistairSH•3h ago

I built an exploding pie, put it in the fridge with a "do not eat me" sign, not my problem somebody blew off their arm.

Processes should/must be built with the users in mind. Users do unexpected, stupid things.

So, yeah, the car itself isn't doing anything wrong, but the whole "fleet use" system designed by BMW+fleet owners appears massively flawed. And that system includes all the software.

bastawhiz•5h ago

I bought a Tesla from Carvana in 2021. It was still linked to the previous owner, along with their card details. I could have pulled up to a supercharger and plugged in and charged on their dime.

This is frankly just bad customer service. Companies don't take it seriously as a problem because nobody is upset about it and it doesn't affect their bottom line.

icedchai•4h ago

My standards are low. I wouldn't even expect a car rental company to handle this sort of thing properly.

paul7986•4h ago

OMG rental cars AV systems and bluetooth are the bain of traveling ... my travel buddies and I will spend up to 5% of our entire trip talking and dealing with this pain cause we have iPhone and or Android.

The UX is painful and now bluetooth is controlling even more portions of the car ... hilarious yet dumb and concerning.

alistairSH•3h ago

I'm about 50/50 with rental cars working with CarPlay easily (ie, the pairing dialogs pop up and run without issue).

But, when the pairing fails, I just don't bother. There's nothing on CarPlay that is 100% necessary to use a rental. Yeah, it's nice to have. But, I'd rather do without than waste a few hours trying to configure it on a car I don't own.

rcx141•4h ago

I just rented a BMW from Sixt and there was no way to disable the annoying wheel-yanking "lane departure" technology.

It showed disabled in the menu, but it was definitely still active.

So SIXT are forcing this horrible feature on everyone

A much worse feature than the one everyone complains about, the one that kills the engine when idling

In the rain, driving through roadwork, with abrupt lane changes, you have to cope with the car yanking the wheel back and forth when it can't figure out where the lanes are.

hyllos•4h ago

So, which carmaker does surprise you pleasantly nowadays?

hchak•2h ago

Love these types of 'hacks' :)

kylehotchkiss•1h ago

So... did you press the honk button?

The Grug Brained Developer (2022)

Honda conducts successful launch and landing of experimental reusable rocket

Resurrecting a dead torrent tracker and finding 3M peers

Building Effective AI Agents

Texas electricity maximum renewables record

Programming Language Design in the Era of LLMs: A Return to Mediocrity?

Making 2.5 Flash and 2.5 Pro GA, and introducing Gemini 2.5 Flash-Lite

AMD's CDNA 4 Architecture Announcement

Real-time action chunking with large models

Time Series Forecasting with Graph Transformers

Why JPEGs still rule the web (2024)

What Google Translate Can Tell Us About Vibecoding

After millions of years, why are carnivorous plants still so small?

O3 Turns Pro

Tetrachromatic Vision

Guidelines on how to be a scientific sleuth released

Iran asks its people to delete WhatsApp from their devices

The hamburger-menu icon today: Is it recognizable?

AMD's Pre-Zen Interconnect: Testing Trinity's Northbridge

Voyager: Real-Time Splatting City-Scale 3D Gaussians on Your Phone

OpenAI weighs "nuclear option" of antitrust complaint against Microsoft

Miscalculation by Spanish power grid operator REE contributed to blackout

CPU-Based Layout Design for Picker-to-Parts Pallet Warehouses

Attempting to Make the Smallest* Electric Motor [video]

AI will shrink Amazon's workforce in the coming years, CEO Jassy says

Should we design for iffy internet?

Calculating Oil Storage Tank Occupancy with Help of Satellite Imagery

What happens when clergy take psilocybin

How you breathe is like a fingerprint that can identify you

Celebrated pianist and writer Alfred Brendel dies aged 94

The Grug Brained Developer (2022)

Honda conducts successful launch and landing of experimental reusable rocket

Resurrecting a dead torrent tracker and finding 3M peers

Building Effective AI Agents

Texas electricity maximum renewables record

Programming Language Design in the Era of LLMs: A Return to Mediocrity?

Making 2.5 Flash and 2.5 Pro GA, and introducing Gemini 2.5 Flash-Lite

AMD's CDNA 4 Architecture Announcement

Real-time action chunking with large models

Time Series Forecasting with Graph Transformers

Why JPEGs still rule the web (2024)

What Google Translate Can Tell Us About Vibecoding

After millions of years, why are carnivorous plants still so small?

O3 Turns Pro

Tetrachromatic Vision

Guidelines on how to be a scientific sleuth released

Iran asks its people to delete WhatsApp from their devices

The hamburger-menu icon today: Is it recognizable?

AMD's Pre-Zen Interconnect: Testing Trinity's Northbridge

Voyager: Real-Time Splatting City-Scale 3D Gaussians on Your Phone

OpenAI weighs "nuclear option" of antitrust complaint against Microsoft

Miscalculation by Spanish power grid operator REE contributed to blackout

CPU-Based Layout Design for Picker-to-Parts Pallet Warehouses

Attempting to Make the Smallest* Electric Motor [video]

AI will shrink Amazon's workforce in the coming years, CEO Jassy says

Should we design for iffy internet?

Calculating Oil Storage Tank Occupancy with Help of Satellite Imagery

What happens when clergy take psilocybin

How you breathe is like a fingerprint that can identify you

Celebrated pianist and writer Alfred Brendel dies aged 94

BMW ConnectedDrive lets me control my returned rental car (Sixt)

Comments