Between the cars and their companion apps, you\u2019re exposed to a lot of trackers.<\/h5>\n\n\n\n
By Jonathan M. Gitlin<\/p>\n\n\n\n In news that should surprise very few, connected cars<\/a> remain a complete privacy nightmare. But now we have a better idea of what data those cars are giving away, and to whom, thanks to a study<\/a> conducted by a team of researchers at Northeastern University<\/a> and Consumer Reports<\/a>. Testing 21 cars from 19 different brands revealed patterns of traffic to advertisers and trackers, as well as data shared with Big Tech firms like Microsoft and Adobe. And using a car\u2019s companion app can multiply the problem, their testing found.<\/p>\n\n\n\n In 2023, the Mozilla Foundation published a widely covered report<\/a> looking at the privacy policies of more than two dozen automakers. They were appalled, writing that<\/a> \u201ccars are the worst product category we have ever reviewed for privacy.\u201d But that analysis was conducted by sitting down and reading all the various privacy policies of each brand; today\u2019s study involved measuring traffic from actual cars under a number of scenarios, including idling and being driven. The researchers even parked 11 cars\u2014just the electric ones\u2014in a Faraday tent to see if the loss of a cellular signal would push that traffic to the car\u2019s Wi-Fi connection instead.<\/p>\n\n\n\n Attempts to actually see what was in the data packets using modified certificates failed in every case. But \u201cthe network traces still yielded valuable information, including the domains contacted via DNS traffic, Server Name Indication (SNI) in TLS handshakes, the volume and timing of transmissions, and differences in behavior across experimental scenarios,\u201d they found.<\/p>\n\n\n\n All of the cars contacted a first-party domain (i.e., the OEM)\u2014after all, all the cars tested were connected cars and that means connecting to something. And a few left it there\u2014the Buick Envista and Mercedes-Benz EQS didn\u2019t appear to reach out to anywhere else, for example. Others were far more promiscuous, with Tesla topping the chart: The Model 3 contacted 34 advertising, tracking, and analytic domains, as well as 37 domains from apps integrated into the infotainment system.<\/p>\n\n\n\n Alphabet\u2019s domains were the most frequently contacted\u2014again not enormously surprising given the penetration of its Android Automotive OS into the sector. \u201cBut many of the [second-level domains] we observed were not necessary for core services (e.g., doubleclick.net and googlesyndication.com, which are used for advertising purposes),\u201d the authors wrote. Media streaming\u2014Spotify, Sirius XM, and so on\u2014is well represented, as are mapping companies like HERE, TomTom, and Mapbox.<\/p>\n\n\n\n Using a car\u2019s infotainment system resulted in it contacting the most domains, versus just sitting idle or driving for all the cars tested\u2014apart from the Tesla Cybertruck, that is, which instead contacts 26 more third-party domains while driving than stationary.<\/p>\n\n\n\n Because of exhaust fumes, it was only safe to test electric vehicles in the Faraday tent. Cut off from a cellular signal, some of the EVs\u2014including the Cadillac Lyriq, Chevrolet Blazer, Honda Prologue, and Rivian R1S\u2014simply stop using those connected subsystems. But some of the cars tested redirected their traffic to Wi-Fi, allowing the researchers to see traffic flows that were previously unobservable.<\/p>\n\n\n\n Next, they tested 30 different connected car apps, which in some cases exposed users to more than 20 new advertising, tracking, and analytics companies\u2014General Motors, Toyota, and Nissan were the worst offenders.<\/p>\n\n\n\n The authors reached out to 17 of the automakers (Fisker had already gone under<\/a>) and heard back from 14. The replies are not entirely encouraging. All the OEMs told the researchers that the data-sharing with third parties was covered by contracts prohibiting the use of PII outside the scope of their privacy agreements\u2014the same privacy agreements that horrified the Mozilla Foundation<\/a> in 2023.<\/p>\n\n\n\n Some of the automakers also deflected blame onto the embedded browser running inside the infotainment system and said it was up to users to select the right prompt when asked to accept or reject a cookie. And seven said that it\u2019s the consumer\u2019s responsibility to read and accept all of the terms and conditions for all the connected services, even though in many cases the software is already installed on the car. And as the authors note, declining a data-sharing agreement can result in a loss of services and functionality\u2014not a great solution if it means losing useful features you expected to work when you bought the car.<\/p>\n\n\n\n However, there was at least one positive outcome: after being contacted, Honda changed its data practices and no longer shares precise location data with at least one tracking company.<\/p>\n","protected":false},"excerpt":{"rendered":" There is just no reason to have a connected car be this promiscuous with big tech data companies. There was someone working on hardware to allow you to disable and enable the data connections by grounding the antenna, or you could just install a switch so you could turn power off and on as it […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-18962","post","type-post","status-publish","format-standard","hentry","category-tech","category-world"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=18962"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18962\/revisions"}],"predecessor-version":[{"id":18963,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18962\/revisions\/18963"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=18962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=18962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=18962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Cropped](\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2026\/09\/GettyImages-2212041468-1-1152x648.jpg\")