I Left My Tesla in the Garage and Grok Could Have Told the Mechanic My Entire Life

By leaving my Tesla in the garage with its key fob, I also entrusted my emails, calendar, and Grok, my AI assistant connected to my professional life. Driver mode, guest profile, code lock: an investigation into what each brand plans to do to protect your personal data.

It all started at the Leclerc parking lot. A man came out of Brico carrying a metal trailer, took a turn too wide, and scraped the left front of my Tesla, a Model Y that was one year old and had 21,000 kilometers on it. As for me? I just stood there, watching the scene in shock, my hands on my shopping cart—the one where things are supposed to be cheaper. Wrong. After taking some photos and sighing, I headed to an authorized Tesla body shop, not a Tesla service center.

It was while preparing the car for the shop that the problem struck me. To move it, the body shop needs my key card. But this card isn’t just for starting the car—it gives access to the central screen and everything I’ve connected to it over the months. I, who would never lend my laptop without closing my session, was about to hand over a two-ton computer with my session still open.

Inventory before liquidation

Let’s do an inventory. I’m in control of my Apple Music playlists. My Netflix account is logged in—great. My calendar and emails too. My favorite and recent addresses tell more about my current life than a private detective, which isn’t new since the advent of GPS. The real game-changer is Grok. My assistant is connected to my account and, by extension, to work-related connections that are confidential. On top of that, there are some conversations about my health.

The funny thing is that computers have solved this problem for a long time. On a PC, guest sessions have existed for decades. On smartphones, Samsung took the lead at the end of 2022 with a maintenance mode that isolates your data during repairs, followed by Google on its Pixel devices and Apple with iOS 17.5. Technicians can test the screen without seeing your photos. In the automotive industry, where the central screen consumes a large portion of our phone functionality, nothing similar is widely adopted.

The day the mechanic resumed my series

Let’s give our imagination five minutes to work. During the lunch break at the workshop, one of the crew members sits behind the wheel, opens Netflix, and clicks “Resume watching.” They discover the series I never admit to anyone, watches two episodes in a row, and soon the algorithm will recommend tutorials on panel removal to me. Another one blasts my most embarrassing playlist at full volume in the workshop. By the time I come to pick up the car, everyone will know the lyrics. And among recent destinations, “Brico Leclerc” sums up the whole situation.

The workshop supervisor then asks Grok what I think of mechanics, with the “Unhinged” personality mode activated to liven things up. He reviews my favorite addresses and finds that my favorite kebab place comes before the office. Then he opens the recordings from Sentinel mode and comes across the Brico trailer: finally, a useful purpose for all this snooping. It’s reassuring—while writing these lines, I see in the app that the car is in maintenance mode. So they’re working. For now.

The serious version isn’t as funny at all

Take away the red nose. A favorite home address, a garage door remote that the car can integrate via HomeLink, and a schedule showing when one is away: this is an almost ready-made burglary kit. With emails and appointments right in front of them, someone could also craft a convincing fake message, such as a fake body shop invoice, citing a real date. There has never been better raw material for tailored phishing attacks.

The assistant remains. Since Grok was introduced in European Teslas in February 2026, Tesla claims that communications stay anonymous, unless one logs into Grok to sync the Grok Bot. That’s exactly my situation. And a voice assistant responds to the voice in the cabin, not to its owner. If it accesses my connections, it’s getting at classified information, communications with sources, or internal projects. Not to mention my health data.

Paranoia? In 2023, Reuters revealed that Tesla employees shared, between 2019 and 2022, images captured by customers’ car cameras, even in private garages. This involved the automaker itself, not repair shops. The vast majority of body shops have far more important things to do than snoop through our screens. But this story reminds us of a rule that every computer scientist knows by heart: when access is easy, someone will eventually look.

My brilliant trick had a flaw

Tesla does offer a valet mode that is locked with a code. According to the manual, it limits speed and power, locks the glove box and front trunk, and disables HomeLink, voice commands, Wi-Fi, and Bluetooth. It also hides the home address, work location, favorites, and recent destinations. The manual says nothing about Netflix, Grok, or the calendar, and most importantly, the body shop will likely need to open the front trunk to work on the vehicle.

I created a local profile named “Garage,” which was empty and linked to my key fob. It was only after rereading the manual, with the car already gone, that I thought I saw a hole in the steering wheel. The PIN code for driving only prevents the car from moving and gets erased in valet mode. Nothing protects a profile from this. A curious companion would simply need to touch the profile icon and select “Régis” to access my entire setup.

However, I had checked the option in my profile settings that required my phone to open it. The online manual doesn’t mention this at all. Without my smartphone, “Régis” remains inaccessible to the mechanic, even if he insists. Still, I had to find this setting first. How many owners have done this? I’ll check when the car comes back, though, like with my documents, the fewer mechanics I see, the better for me.

At Renault, the Legacy of Smartphones

What about other cars? Renault models equipped with openR link run on Android Automotive with integrated Google services. It’s noticeable. The system supports up to five profiles plus one guest profile, which is reset every time the car starts up. Each profile can be locked using a pattern, PIN code, or password, something Renault strongly recommends. Even better: the profile can unlock itself when your phone is in the car. The mechanic, however, won’t have access to it. Of course, this requires that this locking feature has been enabled first.

The same logic applies at Polestar and Volvo, pioneers of Android Automotive. It features a proprietary profile, co-drivers, and a guest account that resets after each driving session, along with a lock secured by code or pattern. Even better: without a key linked to your profile, the car starts in guest mode every time it’s unlocked. On paper, this is better than Tesla’s system. In practice, who bothers to activate a lock that requires a code every morning? And who thinks to switch to guest mode before entering the garage?

BMW thought of the mechanic, Mercedes charges for it

The title for best clarity goes to BMW. The X4 manual clearly states that before handing over the car, especially for maintenance, one must set a code, disable key recognition, and switch to guest mode. Exactly what I do informally, but now it’s documented. Of course, one still needs to have read the manual before going to the garage, which almost no one does. According to some owners, iDrive 9 has replaced the old driver mode with a locked screen.

Mercedes protects the calendar, tasks, and emails of MBUX profiles using codes or fingerprints. Its valet mode makes itineraries, addresses, and profile data inaccessible—through a paid Digital Extra service, available on a monthly basis or for multiple years. Privacy as a subscription service—bold of them. Hyundai and Kia offer a password-protected valet mode in certain versions, with a tracker as a bonus: the app displays the distance traveled and the maximum speed reached.

Elsewhere, two different concepts are confused. At Peugeot, the guest session resets every time the vehicle starts, but the “private mode” only affects sharing data and location with the manufacturer. Volkswagen refers to a simple offline mode as privacy settings. At BYD, I found no documentation specific to Europe. Either brand’s private mode or the other’s offline mode does not protect the person sitting in your seat.

Brand

What exists

What’s problematic

Tesla

Valet mode with code and key fob, profile that may require the owner’s phone

Phone setting missing from the manual, front trunk locked in Valet mode

Renault (openR link)

Guest profile, lock via password, pattern, or code

Lock that must be activated manually

Polestar and Volvo

Guest account reset, locked with code or pattern

Default guest account only if no key is associated with the profile

BMW

Guest profile, code on the profile, explicit instructions for maintenance

According to owners, the valet mode has been replaced by a locked screen on iDrive 9

Mercedes

Profile protected by code or fingerprint, valet service mode

Valet mode available in Digital Extra

Hyundai and Kia

Valet mode with password and tracking in the app

Depends on the version

Peugeot

Guest session reset every time the vehicle starts

Private mode limited to communication with the manufacturer

Volkswagen

Offline mode

No documented valet mode found

Two private modes that are mixed together

There are indeed two private lives in a connected car. The first one involves interactions with the manufacturer, and sometimes even the insurance company. It’s not a bright outlook: in 2023, the Mozilla Foundation ranked automobiles as the worst category of products ever evaluated, with all 25 brands studied failing. Nissan even mentioned collecting data on sexual activity. On June 30, 2026, the CNIL issued a recommendation advocating for a mode that shuts off all optional connected services.

The second scenario involves dealing with the person who holds the key. Here, almost nothing is framed. To make matters worse, since September 12, 2025, the Data Act allows the vehicle owner to access their car’s data and share it with a third party, such as a repair shop. The law regulates access to the technical data, which is the most tedious, while the more personal data is displayed openly. The ultimate paradox: the most discreet car relies solely on CarPlay.

Before handing over the key fob

While waiting for a true “garage mode,” the hardest part remains thinking of it at the right time. Check what your car offers: guest profile, code lock, or valet mode. Separate your key from your personal profile before handing it over, otherwise the car will recognize the mechanic as you. If your surveillance camera records to a USB drive, bring it along. On a rental car, remove your phone from the Bluetooth list: contacts and call logs may remain there.

My Tesla will be back soon with a new fender, a still-empty garage profile, and hopefully an intact Netflix history. Until then, I’m counting on you. Does your brand offer a real garage mode that I might have missed? Have you ever found an unknown radio station or a mysterious destination after taking a car to the shop? What are your home remedies? And if you’re a mechanic, tell us what you really see when you get behind the wheel of our cars. Comments are welcome.