El Reg ran a nice warning article about JLR vehicles and woes of thier online features when they get into the second hand market.
Its worth a read:
This isn’t unique to JLR either. When I bought my 2017 TTS last summer; I got the car at a Mercedes dealer so none of the previous owners digital crumbs were scrubbed. This meant that I not only had to have the extra key deprogrammed to eliminate that theft risk I also found out that the previous owner was still registered on the VIN for the online stuff.
This meant I could only add myself as a user and did not have admin control of my own car, that still belonged to the original owner. It took approximately 2 months talking direct with Audi to get the previous owner booted and myself as the admin due to them not having any real process for this sort of thing. Just like JLR they were relying on the owner to scrub themselves when they sell the car.
So when you buy a connected car second hand, make sure the dealer cleaned off the old user or get ready to deal with it yourself. It shouldn't be ignored through... There are real privacy concerns with leaving your car connected to a stranger.