29.11.2023
3 min
1593
Modern vehicles actively connect to advertising, analytics, and other third-party services even when the owner has not installed the manufacturer’s companion app. In the study, 19 of the 21 tested vehicles sent traffic to at least one third-party domain over Wi-Fi alone.
Researchers from Northeastern University and Consumer Reports examined 21 vehicles from the 2022–2025 model years along with 30 related mobile apps. They tracked where the cars and apps connected during normal use and found that a modern vehicle has effectively become another always-connected device, exchanging data with more than just its manufacturer. The authors detailed their methodology and findings in a study on data privacy in connected vehicles.
Among the companies whose servers the vehicles contacted were Alphabet, Amazon, Microsoft, and Meta, as well as advertising and analytics platforms. Of the 21 vehicles tested, 13 connected to Google, 12 to Amazon, eight to Spotify, and three exchanged traffic with Meta. Some of these domains, including doubleclick.net and googlesyndication.com, are used for advertising and tracking and are not required for a vehicle’s basic operation.
Tesla Model 3 had the highest number of external connections among the vehicles tested over Wi-Fi. It contacted 34 domains associated with advertising, tracking, and analytics, along with dozens of other third-party domains. Tesla Cybertruck, Cadillac Lyriq, Lucid Air, and Chevrolet Blazer were also among the vehicles with the largest number of such connections. Mercedes EQS and Buick Envista, by contrast, mostly limited their traffic to domains operated by their manufacturers in this test.
“It seems that a buyer simply cannot purchase a new car that does not track them,” said study co-author Sarah Elizabeth Gillespie.
The authors emphasize that the findings may reveal only part of the actual data exchange. Nearly all of the tested vehicles had built-in eSIMs, but the researchers were largely unable to intercept and analyze cellular traffic. As a result, the number of third-party companies that actually receive vehicle data could be significantly higher.
The only exception in the tests was a Tesla Model 3 with a physical SIM card slot. Researchers installed their own SIM card and were able to intercept some of the cellular traffic. During this experiment, they discovered another tracking domain that had not appeared during the Wi-Fi analysis.
To better understand how vehicles behave without access to a mobile network, some electric cars were even placed inside a large shielded tent that functioned as a Faraday cage. When the cellular signal was blocked, most vehicles began routing more traffic through Wi-Fi, allowing researchers to observe connections to tracking services that would normally remain hidden.
At the same time, the mere fact that a vehicle connected to a domain did not reveal exactly what data was being transmitted. The traffic was encrypted, so researchers could identify the destination and type of connection, but could not read the contents of each transmission.
The team separately analyzed 30 mobile apps provided by automakers for owners to control their vehicles from a smartphone. The result was even more striking: 28 of the 30 apps sent information to at least one third-party advertising or analytics company. On average, connecting one of these apps roughly doubled the number of advertising and tracking companies associated with the vehicle, and in some cases added more than 20 new data recipients.
Seven apps shared sensitive identifiers with third-party companies. In myCadillac, myChevrolet, myBuick, and myGMC, as well as HondaLink, MyNissan, and Lincoln, researchers observed vehicle VINs being transmitted together with the owner’s email address or location data. The authors suggest that a VIN could be used as a persistent unique identifier in much the same way as an IMEI or a smartphone advertising ID.
Among the apps, myCadillac connected to the highest number of advertising, tracking, and analytics domains, reaching 51 in total. Buick, My BMW, and Toyota apps each contacted 47 domains. Researchers also observed data being sent to services operated by DoubleClick and Google Analytics, Facebook, and Adobe.
Consumer Reports, which provided the vehicles for the experiment, separately published the study findings and described what types of data may be shared with major technology companies. The report notes that combining a VIN with an email address, name, or precise location can make it much easier to link the behavior of a specific vehicle to its owner’s profile.
Researchers received responses from 14 of the 17 automakers they contacted. Some companies explained that their mobile apps may open external web pages where third parties set their own cookies and tracking pixels. General Motors, Honda, Nissan, and Stellantis said that certain data recipients are prohibited from independently using or selling the information they receive.
However, the researchers showed that contractual restrictions alone may not be enough. After Honda was informed that location data had been shared with one of its vendors, the company asked the service provider to delete the information it had already received and stopped further transmission of that data.
Seven automakers also said that owners are responsible for reading and accepting the terms of use for each third-party app or service, even when those services are already built into the vehicle. The problem is that refusing those agreements can disable navigation, driver-assistance systems, or over-the-air software updates. In some cases, manufacturers explicitly warn that declining the terms may significantly limit the vehicle’s functionality.
The issue of vehicle data collection has existed for several years. Modern cars are equipped with GPS, cameras, microphones, telematics modules, cellular connectivity, and infotainment systems, while some manufacturers have already faced regulatory scrutiny over sharing information with data brokers and insurance companies.
What makes the new study different is that the researchers examined not only privacy policies or individual vehicle components, but the actual network traffic generated by cars and their companion mobile apps. Because access to cellular connections was limited, the findings still do not provide a complete picture, so the researchers describe the observed level of data sharing as only a lower bound of the true scale.
