Ian Fogg watched his car being driven away on his doorbell camera. He had an Apple AirTag hidden inside. He had Kia's own Connect app, which showed the car's live location. More than three months later, he still hasn't got it back.
The technology analyst at FDM CCS Insight had left his Kia outside his house in March when thieves broke in without the keys. His phone pinged to say he had lost access to the Kia Connect app. Through an unsecured process designed to make it easy for new owners to take over, the thieves disconnected Fogg's phone via the entertainment system.
“Kia owner Ian Fogg cannot retrieve his stolen car despite live location data as UK law blocks tracking.”
For a short while, he tracked the car using the AirTag – until the thieves found it and threw it away because it was making a noise, a feature Apple introduced to combat stalking. Then he turned to Kia Connect, the manufacturer's own tracking service.
But Kia told the BBC that UK law – specifically GDPR – prevents the Connect function from being used to live track vehicles. "Kia Connect is a customer convenience feature, not a certified security vehicle tracker," the firm said. "Therefore, it does not provide live‑tracking functionality for stolen vehicles." It advised customers to use the app for "convenience" rather than security.
When Fogg contacted Kia after the theft, he was told he would need to fill in a form each time he wanted the car's location. He did this eight times. Every time, the location came back 24 to 48 hours after the car had been there.
"This car was incredibly easy to hack but incredibly difficult to track," Fogg told BBC News. "It shouldn't be this easy to nick a car when they cost an order of magnitude more than a phone and have similar radio technology."
Car safety firm Thatcham Research warned there is a "genuine and growing gap" between consumer expectation and the technical reality of so-called connected car features. Fogg's story is a cautionary tale of how tech can promise security but cannot necessarily be relied upon in a crisis.
Kia's website tells customers to contact the company in the event of a theft. When Fogg did, he was met with forms and delays. The company said release of location details must comply with "all applicable laws, in particular GDPR, and the authorities to minimise risk to the customer."
For now, Fogg's car remains missing – tracked but unreachable.