Your car’s data privacy problems are worse than you think

Capturing cellular traffic required a more creative approach. To avoid deploying an unauthorized cellular base station that could interfere with public networks, the team built a car-sized Faraday tent. The tent blocked all signal transmissions between the vehicle and external cell towers, forcing the car to fall back on the controlled Wi-Fi connection.

The results were stark: Every single one of the 21 vehicles transmitted data to at least one third-party domain over Wi-Fi. Over half contacted domains specializing in advertising, tracking, or analytics (ATA). These companies, like Adobe, LexisNexis, and Amplitude, gather details about your vehicle or driving behavior to sell to insurance companies or target you with ads.

Vehicles equipped with advanced infotainment systems — particularly those running Google’s Android Automotive OS with Google Automotive Services — contacted the highest number of third-party domains. Choffnes noted that an automaker’s choice of software platform directly impacts how much data reaches third parties. Google’s platform, for instance, includes built-in routines to communicate both with Google’s own services and external entities.

“A lot of the tracking we also see through the apps that are built into the car,” Choffnes said. “So now, cars are essentially turning into the global smartphones.”

Mobile apps present an equally insecure vector. The team discovered that seven companion apps — HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC — transmitted sensitive details like vehicle identification numbers (VINs), phone numbers, and precise locations directly to advertising networks. Over 70 percent of the tested companion apps contacted at least five unique ATA domains.

Researchers were particularly alarmed by the pairing of a vehicle’s VIN with identifiable personal data, which allows data brokers to build detailed dossiers on individual drivers.

“We sort of think, ‘Oh, well, if your online companies can track what you’re doing online, but you’re in your car, are they tracking what car you have?’” Choffnes said. “And so we’re seeing they actually can. And these are going to companies that probably most consumers don’t have a relationship with or have never heard of.”

Automakers offered mixed reactions to the findings. Some defended their practices as legally compliant, while others acknowledged the vulnerabilities and issued software fixes. Honda, for example, requested that its analytics provider Amplitude delete all collected location data and updated the HondaLink app to cease transmitting geolocation after being presented with the Northeastern team’s findings.

Choffnes believes the deeper issue is that consumers rarely understand what they agree to when buying a connected car or setting up its app. Most drivers will not sit in a dealership parking lot reading dense privacy policies on a tiny dashboard screen before agreeing to the terms.

“I don’t think there’s a lot of trust as a result of this,” Choffnes said. “I think automakers would do well to earn that trust back. And one way to do that is through better transparency and helping consumers to not have data collected about them after they’ve made a really expensive purchase without having more explicit opt-in as opposed to opt-out.”