Study exposes car data leaks

Researchers at Northeastern University and Consumer Reports tested twenty-one cars from nineteen brands. They found connected cars transmit data to advertisers, trackers, and tech firms like Microsoft and Adobe.

How the researchers measured the problem

Instead of reading privacy policies, the team measured actual network traffic from cars while idling, driving, and parked in a Faraday tent without cellular signal. They tracked which domains the cars contacted.

Tesla leads in data sharing

Most cars contacted only their manufacturer's domain. But Tesla's Model three contacted thirty-four advertising, tracking, and analytics domains, plus thirty-seven from apps in the infotainment system.

Google dominates the tracking

Alphabet's domains were contacted most frequently. Many were unnecessary for core services: doubleclick dot net and googlesyndication dot com are used for advertising, not navigation or safety.

“many of the second-level domains we observed were not necessary for core services”

Car apps multiply the tracking problem

Testing thirty connected car apps from General Motors, Toyota, and Nissan found they exposed users to more than twenty new advertising, tracking, and analytics companies each.

Automakers claim contracts protect you

Fourteen of seventeen automakers responded to the researchers. All said third-party data sharing was covered by contracts prohibiting personal information use outside their privacy agreements.

Users have little real choice

Automakers said users can decline cookies or read terms, but declining data sharing often means losing car features. Honda changed its practices after contact, but the broader problem remains unsolved.

“declining a data-sharing agreement can result in a loss of services and functionality”