[tzs]

Would GDPR actually do anything in this situation?

From what I understand the data the car acquires is not being sent anywhere. It just gets uploaded to the car and is used to speed up operations that would be slow if the car had to talk to the phone over Bluetooth when it needed the data.

The car vendor is not processing your data. They are selling you a device that processes your data. I'd have guessed then that you are the controller for this data processing and so you are the one responsible for GDPR compliance.

In the case of a rental car, I'd have guessed that the rental company is the controller, and their GDPR obligation would be to tell you that the car caches data if you pair your phone with it and for them to erase that data when you return the car.