Researchers from Northeastern University and Consumer Reports found that 21 tested vehicles and their companion apps transmit driver data to advertising and tracking companies.
Key facts
- •Researchers analyzed 21 vehicles from 19 brands and 30 companion mobile apps.
- •Every tested vehicle transmitted data to at least one third-party domain over Wi-Fi.
- •Seven companion apps transmitted VINs, phone numbers, and precise locations to advertising networks.
- •Over 70 percent of tested companion apps contacted at least five unique advertising, tracking, or analytics domains.
- •Honda updated its app and requested data deletion after being presented with the research findings.
A study by Northeastern University and Consumer Reports reveals that modern connected vehicles frequently transmit driver data to third-party domains. Researchers analyzed 21 late-model vehicles and 30 companion mobile apps, finding that every tested car shared data with at least one third-party entity. The findings highlight concerns regarding the lack of transparency and control owners have over information such as location, driving behavior, and personal identifiers.
By the numbers
Data Collection and Transmission Methods
To monitor data transmission, researchers used a Raspberry Pi to intercept Wi-Fi traffic from vehicles in motion. For cellular traffic, the team utilized a custom Faraday tent to isolate vehicles and force them to connect through a controlled Wi-Fi network. While the encrypted data payloads could not be decrypted, the team successfully identified the destination domains for the transmitted information.
Findings on Third-Party Tracking
The study found that over half of the tested vehicles contacted domains specializing in advertising, tracking, or analytics, including companies like Adobe, LexisNexis, and Amplitude. Vehicles using Google’s Android Automotive OS were found to contact the highest number of third-party domains. Additionally, seven companion apps—including those for Honda, Lincoln, Nissan, and several General Motors brands—were found to transmit sensitive information like VINs and precise locations to advertising networks.
Industry Response and Privacy Concerns
Automakers provided varied responses to the research. Some companies defended their practices as compliant with existing laws, while others implemented changes. Honda, for instance, updated its HondaLink app to stop transmitting geolocation data and requested that its analytics provider delete previously collected location information. Project lead David Choffnes emphasized that the findings underscore a lack of consumer control, noting that drivers often agree to complex privacy policies without fully understanding the extent of data collection.
Advertisement
This article was independently rewritten by ManyPress editorial AI from reporting originally published by The Verge.
