How to disconnect the tracking telemetry on the 5th gen 4Runner

I'm not worried. I wasn't calling you or anyone idiotic personally, but that statement is used way too often. The fact that someone thinks there's nothing for them to hide often seems to add comfort to them when their privacy is breached. We're giving up too much IMO.

 

Interesting. So pulling the fuse kills the lights and signal and no sound/mic issues?

Vehicle info is mainly in the ECM, and the/a portion of the data recorder is in it as well if memory serves correct. I think the LDA camera is part as well? Not sure.

 

NP Dk. It's just that, that comment, " nothing to hide " is a broad subject. No biggie...

 

Just a quick update:

I pulled the fuse again, drove about an hour, car sat an hour, drove back.

Confirmed the microphone did not work. Car didn't register verbal commands I gave through the OEM system, and the guy on the other end of the line couldn't hear me when I made a call with my phone connected via CarPlay.

But to my surprise all stereo speakers worked. I used the fader to send all signals to the right side and even put my hand and ears up against the speakers to confirm it. Stereo sounded great. This stereo on the Limited is pretty nice.

As before, no error messages etc.

Punched in a new destination and Navigation worked, though oddly it showed traffic slowdowns. Can't figure that one out. (Maybe it had loaded live traffic data just before I pulled the fuse?)

As before, confirmed no data transfer happening. Wifi wouldn’t work. Toyota App wouldn’t connect with the car. SOS button dead.

Key fob worked as normal, including allowing lock and unlock by just touching the door handle. As before it would not remote start the engine.

Conclusion: so far, at least on my 2020 Limited, the microphone is the only thing you lose that you wouldn’t lose anyway with expiration of your Connected Services trial period. (I used an AirPod to make a call on my way home — oh the horrors lol)

The unknown: will problems arise if the fuse remains pulled long enough for the DCM backup battery to die?

 

@ElectroBoy, Yes and no.

For our model years (14-19) you would be correct in that the GPS antenna is up under the dash behind the radio unit. This antenna is for in vehicle navigation use only as far as I know. For 14-19 without safety connect (DCM telematics) the shark fin is a XM only radio antenna. For the 14-19 Limiteds, the GPS under the dash is the same, but the shark fin houses a cellular antenna and secondary GPS antenna in addition to the XM antenna.

For the 2020+ it is very similar. The XM antenna houses XM, Cellular, GPS. The under dash antenna houses NAV only GPS, but based on the factory wiring diagrams it also has a cellular sub antenna. Both cellular antenna lines go to the safety connect DCM telematics ECU. Pulling the plug on both cell antennas effectively isolates the DCM without affecting its GPS function and interface with the rest of the vehicle.

 

Well it is a lithium ion battery and they don't really like to be fully discharged past 20% capacity. It is probably dead already.

The speaker circuit in the DCM likely gets power directly from the radio speaker lines, so if the radio is on, that part of the DCM is functioning.

The microphone will work with or without an active connected services subscription, but the DCM needs power to in turn power the mic as it is wired directly to the DCM for input, output, etc.

Best way to accomplish what you want is to put the fuse back in, and unplug the antenna cables at the DCM module.

I can post a wiring diagram of the 20+ DCM showing what I mean if that helps anyone?

 

Yes and thanks, that would be great. I agree that pulling the cellular antenna should be the most elegant solution (so long as that really prevents cellular transmission). Better to have the car think it’s simply in a no-cell-service area than to screw with other stuff. Plus of course I rather have the mic than not, so I can make calls through CarPlay.

Doubt that big backup battery would die after less than a day, but I may reinstall the fuse to be on the safe side — thanks for raising the concern.

 

Here are some screenshots of the 20+ telematics system. Let me know if they are readable or not based on the upload format.

The backup battery is a single 3.7V that is only a little larger than a AA. It's small compared to the previous generations backup, and only meant to keep the DCM functioning for a little while in the event of a crash to communicate.

 

To clarify my post, yes, this is an important point and I understand.

My point was that the downsides of pulling the DCM fuse appear to be the same as the downsides of losing your Connected Services subscription (no more SOS functionality, the inability to remote start or lock the vehicle) -- except for the microphone.

In other words, there are only benefits from pulling the fuse (no hanky-panky data transmission possible) with nothing lost that you wouldn't lose anyway when Connected Services expires --- except for the microphone.

So, again, if there's a solution like yanking the antenna that causes no other problems and preserves the mic, that would be ideal.

As previously mentioned, I don't want to pay for Connected Services. So there's no good reason to accept its risks when I can't have any of its benefits.

EDIT: Thanks for the added info on the backup battery, and for the wiring diagrams

 

Thanks @Old Red for posting the wiring diagrams and the explanations.

@Singleminded, good luck with your project. Keep us posted with your progress and test results. And post photos of the DCM and the two connectors to unplug. It will help others.

 

LOL, tbh I was hoping someone else would be the guinea pig for the antenna disconnect experiment. I agree it sounds like the most elegant solution, but remain concerned about breaking something. Anyhoo, if no one else tries it first I may buck up and give it a try myself. If so, I will take pics to document for the forum.

Thanks everyone for all the tips, suggestions and comments on this topic.

 

No sooner had I posted that I didn't want to be the guinea pig for this, I decided to at least take a look. Popping the access panel is super easy. But I'm not sure what I'm looking at behind it. Are you able to identify the cellular antenna in this pic? I'm not even certain this is the correct module.

 

In the movies they always say to cut the red or blue wire. So I'd start with those.

 

Ok, so it looks like you are going to have to pull the glove box. There are a couple good write ups floating around on how to do so. The DCM is probably slightly forward of the opening here, and the footwell duct (white/clear plastic).

The modules you are seeing from left to right is the smart key ecu (Top left) the network gateway ECU (For the CAN BUS, and is the forward most bundle of wires) and bottom right which is the A/C amplifier ECU. If you reach in near the front of the opening in the glove box you should be able to feel the DCM.

When you pull the glove box remember that you will have the glove box light wires attached up top and by a few clips.

 

LOL, I'm not even disconnecting any wires until I know what's what. Based on pics on the Rav4 forum ( https://www.rav4world.com/threads/2019-rav4-dcm-deactivate-procedure.304339/ ) I'm doubting that the module I photographed above even is the DCM.

Gonna let this issue rest for now, until someone can demonstrate how to disconnect the cellular antenna and can show it doesn't cause any other problems.

In the meantime, I am 95% confident in my conclusion that pulling the fuse defeats data transmission, and loses me nothing I would't have lost anyway with expiration of the Safety Connect service -- with two exceptions:

1. The cabin microphone stops working, so no ability to do hands free calling through the car. I'd have to use an earbud.

2. The DCM's backup battery will drain, which means it might no longer be available to provide automatic emergency notification of a crash, if I later decide to resubscribe to Safety Connect and have a crash that cuts power to the DCM. Unknown whether reinstalling the fuse etc would successfully recharge that battery.

Misc notes:

> This is my experience with my 2020 Limited. YMMV.

> A couple people have mentioned disconnecting the Event Data Recorder (aka the "black box"). I just want to be clear that defeating the EDR was never part of my purpose, nor something I recommend. Personally, I think EDRs are probably a good thing on balance, to help investigators understand why and how a serious crash occurred. And they do not pose the kinds of risks that I've talked about on this thread. There is no reason to believe that they are being used for data harvesting for commercial purposes. Nor are they designed to capture data other than conditions immediately preceeding a crash. Nor do they seem to create a vulnerability that bad actors could use to spy on you or take remote control of your vehicle.

> Walkabout on the Rav4 forum pulled both the fuse and the backup battery on his DCM but stated that connecting your phone via the OEM bluetooth system will turn your phone into the car's data transmission device if the DCM is defeated. I can't verify this, but mention it so that people are aware. It would be unfortunate if someone went to a lot of trouble to defeat the DCM, only to unwittingly duplicate its functions by connecting their phone to the OEM bluetooth. Regardless, as previously mentioned, I'd advise against connecting one's phone to any car's bluetooth system, since those systems generally harvest a lot of personal data from the phone and erasure of that data is typically impossible without physically destroying the unit. Much safer to use CarPlay.

Again, thanks to everyone who has contributed to this discussion.

EDIT: @Old Red , thanks for your post of a moment ago. It crossed with this one. I don't think I have the courage to pull out the glovebox, espec since I'm not certain I could then successfully disconnect the cellular antenna, and that doing so would both defeat the DCM and not cause other problems. For me anyway, it's a bit too speculative. But thanks again -- you've been super helpful in this discussion.

 

My fuse pulled yesterday morning and phone info deleted from system as I like never use my phone while driving so no biggy for me not having mic. Still no issues, I'm keeping it pull out. Where's the event data recorder?

 

I'm calling BS on the third point. I can't imagine how a person's phone can possibly be commandeered by the truck to transmit data to Toyota - unless maybe you have the crappy app on there? Anyway nobody uses that app.

 

I agree with @08TXRunner. There is no way the phone could be commandeered as a back up DCM in the event the primary can't get signal.

The amount of data that would need to be transmitted rules this out regardless if it is hooked up via USB or via bluetooth. I have no idea what the Toyota App does, but if it is like past Toyota Apps, it's half baked and entirely useless.

@Singleminded, pulling the glove box is relatively straightforward, but I get that especially on a new vehicle.

If you do pull it, you will see the DCM with a row of three connectors, white, grey, blue. Pull the blue and white and zip tie them to the remaining grey connector wire (so that they don't rattle around and drive you nuts.

Also, the Toyota OEM diagrams for the radio system show it both with and without a DCM present, so I don't think you can cause any real problems that would incapacitate the vehicle.

 

Now that you guys mention it, yes it does seem quite farfetched. I don't think the amount of data is the issue (after all, the DCM is transmitting via a cellular chip, there's no reason your phone would be less capable using the same technology -- not to mention the vast amounts of data that our phones in fact transmit all the time).

But as you guys point out, for the phone to transmit the DCM's data it presumably would have to be running an app that is designed for that purpose. I don't know about Android phones, but there's no way Apple would knowingly allow their phones to be hijacked in this way. Anything that could force an iPhone to transmit data that's not part of the function of the OS, or an App purposefully downloaded by the user, would be considered malware.

So, yeah, a Duh on my part for not thinking that through.

 

All good man! Sometimes we all go down the rabbit hole when trying to figure out how an engineer set up a system to work that we aren't familiar with. Can't tell you how many times I've been there looking at a problem.

 

Good tip, thanks Red. I'm not afraid of pulling those blue and white connectors and seeing what happens. But I am afraid of my wife giving me a bunch of sh*t if I screw up the glovebox or dash or something!

Just a BTW Update FWIW: I reinstalled the fuse after about 22 hours, mostly out of concern that the backup battery would die and cause error messages that would be a pain to clear. Or might even compel me to get the battery replaced. Fortunately, no error messages. Guess I may never know if the battery just hadn't died yet, or if I wouldn't have gotten messages anyway. My hunch is I'd never get the messages if the fuse remained pulled, since the DCM wouldn't be able to tell the car that it had a problem. But was worried that I'd have to live with those messages should the antenna-pull method work out down the road and I want that fuse back in to restore the microphone.

 

@Singleminded, I understand your hesitation to dig into a new vehicle. I was apprehensive at first also.
If or when you are ready to attack the glovebox here are some links to instructions to review. In one thread @Old Red provides some removal advice. https://www.4runners.com/threads/5th-gen-4runner-premium-glove-box-light-issue.15271/

 

Just a quick update on the DCM battery drain issue: I had a Eureka moment today realizing it's just not logical to expect that battery to drain in a day -- or even in weeks or maybe even in months -- from pulling the fuse. When you pull the fuse the DCM should be dead. There should be no activity there. Which seemed to be confirmed by my tests showing no data transmission with the fuse out.

If there's no activity in the DCM, then there's no active drain on its battery. And if there's no active drain on its battery, it should be like any other lithium ion battery you have in any other device. A flashlight, a radio or whatever. If the device is just sitting there unused, the battery is going to drain very slowly over time. It could be months before it dies.

I mention this partly to say, don't be paranoid about having your fuse out for a short while.

But also to point out that the lack of a low/dead battery warning, eg like this: http://www.to4runner.net/backup_battery_failure_b15cc_-392.html or this: http://www.to4runner.net/backup_battery_degradation_b15ec_-390.html does not mean you're home free.

If you leave that fuse out long enough and then decide to put it back in, you may well get one of these codes and have to hassle with clearing it and/or replacing the battery.

 

First world problems.

Gosh, how did we ever get by with the 70-80's vehicles.

 

I miss the 70's and 80's.

 

Me too!

 

Me three!

 

My next vic will be from the 80's and i will upgrade the tech i want, not what the nanny state demands and most likely be 20 grand cheaper.

 

@Singleminded, I was doing some work on a family members 2020 TRDORP and I found a shortcut to disconnect the Telematics DCM ECU. You will need to remove the HVAC control panel and side garnish trim. Everything there is held in by clips, and you will need to unplug the HVAC panel connector, but you should be able to see the DCM through a gap and access the blue and white antenna connectors without having to remove the glove box. Leave everything else plugged in.



Let me know if you give it a shot. I left it alone since it wasn't my vehicle, but curious to see how the system behaves. Keep us all posted.

 

Thanks Red, this is great. I'll definitely post the results if I give it a shot!

Oh, been meaning to ask: do you know why there are two connectors for the cellular antenna, instead of just one? And what's the grey one for? Seems it might not be the GPS antenna? Cause GPS continued to work for me when I pulled the DCM fuse (sorry if this has been explained before, but I didn't see it in the thread)