Study Finds Connected Cars Share Data With Advertisers, Trackers and Big Tech

The testing measured traffic from actual cars under several scenarios, including when the vehicles were idling and when they were being driven. That approach differs from earlier privacy research. In 2023, the Mozilla Foundation published a widely covered report that examined the privacy policies of more than two dozen automakers. Mozilla wrote that "cars are the worst product category we have ever reviewed for privacy." The new study by Northeastern University and Consumer Reports instead measured network traffic generated by vehicles themselves.

The researchers tried to inspect the contents of data packets using modified certificates, but those attempts failed in every case. Even without reading the packets, the network traces still yielded valuable information, the study found. That information included the domains contacted through DNS traffic, the Server Name Indication (SNI) in TLS handshakes, the volume and timing of transmissions, and differences in behavior across the experimental scenarios.

To examine what happens when a car loses its cellular connection, the researchers parked 11 electric cars in a Faraday tent. The test was designed to see whether the loss of a cellular signal would push the traffic to the car's Wi-Fi connection instead. The study thus combined measurements taken while cars were idling and being driven with an experiment that altered the vehicles' network conditions.

The testing found that using a car's companion app can multiply the data-sharing problem. The study also found patterns of traffic to advertisers and trackers and data shared with companies such as Microsoft and Adobe. Mozilla's 2023 report had already described cars as a severe privacy concern based on automakers' policies. According to Ars Technica, the new research provides a more detailed view by measuring traffic from actual vehicles across 19 brands.

Editor's Summary A Northeastern University and Consumer Reports study found that connected cars send data to advertisers, trackers and Big Tech companies, and that companion apps can increase the sharing. Testing covered 21 cars from 19 brands under idling, driving and Faraday tent scenarios. The findings follow Mozilla's 2023 report that called cars the worst product category it had reviewed for privacy.