Key facts
- Connected cars and their companion apps share extensive data with advertisers, trackers, and tech firms, according to a new study.
- Researchers tested 21 vehicles from 19 automakers and 30 companion apps, finding that most vehicles sent traffic to third parties.
- Seven of the 30 tested apps shared sensitive data like VINs, emails, and precise location with tracking and advertising companies.
- Tesla's Model 3 contacted 34 advertising, tracking, and analytic domains, plus 37 domains for integrated infotainment apps.
- Alphabet's domains were the most frequently contacted by the tested vehicles, often for advertising purposes.
Connected cars continue to present significant privacy challenges, with a new study by researchers at Northeastern University and Consumer Reports revealing extensive data sharing with advertisers, trackers, and major technology firms. The study tested 21 vehicles from 19 different brands, measuring network traffic and examining 30 companion mobile apps to understand the privacy implications of the connected vehicle ecosystem.
While the researchers could not inspect the content of data packets, they analyzed network traces, finding that 19 of the 21 vehicles sent traffic to at least one third party. Seven of the 30 companion apps shared sensitive data such as the vehicle identification number (VIN), emails, phone numbers, and precise location with third-party companies. This data sharing scheme allows advertisers and data brokers to build in-depth consumer profiles, which can then be sold to entities like insurers and banks. Pairing a companion app with the vehicle roughly doubled the exposure to advertising and tracking companies.
All tested vehicles connected to their original equipment manufacturer's (OEM) domains. Some, like the Buick Envista and Mercedes-Benz EQS, appeared to limit their external connections. However, Tesla's Model 3 was found to be particularly expansive, contacting 34 advertising, tracking, and analytic domains, in addition to 37 domains associated with integrated infotainment apps. Alphabet's domains were the most frequently contacted across the tested vehicles, a finding attributed in part to the prevalence of its Android Automotive OS. Many of these domains are used for advertising purposes, and the traffic also included media streaming services and mapping companies.