Your Car’s Data Privacy Issues Are More Serious Than You Realize

You’ve probably heard the saying: modern cars are like smartphones on wheels. Just like your pocket device, your car is busy gathering a ton of data — tracking your driving habits, speed, braking intensity, turning angles, and more.

The legality of this data collection is a hot topic. Recently, a major automaker faced penalties for collecting and selling detailed location and driving behavior data without proper consent. Other brands have also been fined for making it tough for customers to opt out of data sharing. While it was long suspected that many manufacturers were engaging in similar practices, a thorough investigation has finally taken place.

This week, researchers from a university, in partnership with a consumer advocacy group, released a comprehensive study on the privacy practices of connected vehicles. They examined nearly two dozen cars from a test fleet to answer key questions: Which vehicles are sending data? Who’s receiving it? Is it crossing borders? And what personal information is being exposed?

The project lead emphasized the need to showcase the extensive nature of vehicle data tracking and how little control owners have over it. “There’s a lot to be worried about,” he stated.

To get a full understanding, the team analyzed 21 late-model vehicles from 19 different brands available in the US, along with 30 related mobile apps. They identified the destination domains for data sent directly from the cars, including various third-party tracking companies, although they couldn’t decrypt the encrypted data without hacking.

Monitoring Wi-Fi traffic was relatively easy. The researchers set up a Raspberry Pi in each car, connecting it to the vehicle’s Wi-Fi and routing the internet through a mobile hotspot, allowing them to track outgoing Wi-Fi data while the car was in motion.

Capturing cellular traffic required a more inventive method. To avoid interfering with public networks, they constructed a car-sized Faraday tent that blocked all signals between the vehicle and cell towers, forcing the car to rely on the controlled Wi-Fi connection.

The findings were striking: every vehicle transmitted data to at least one third-party domain over Wi-Fi, with more than half contacting companies focused on advertising, tracking, or analytics. These firms collect information about your vehicle and driving habits to sell to insurers or target you with ads.

Cars with advanced infotainment systems, especially those using Google’s Android Automotive OS, contacted the most third-party domains. The project lead noted that the choice of software platform by automakers significantly affects how much data is shared with third parties. Google’s platform, for example, has built-in routines for communicating with both its services and external entities.

“A lot of the tracking we also see through the apps that are built into the car,” he explained. “So now, cars are essentially turning into global smartphones.”

Mobile apps are another weak link. The team found that several companion apps transmitted sensitive information like vehicle identification numbers (VINs), phone numbers, and precise locations directly to advertising networks. Over 70% of the tested apps contacted at least five unique tracking domains.

Researchers were particularly concerned about the combination of a vehicle’s VIN with identifiable personal data, enabling data brokers to create detailed profiles on individual drivers. “We often think that online companies track our behavior, but we’re now seeing that they can track what car you have too,” he noted. “And this data is going to companies that most consumers don’t even know about.”

Automakers had mixed responses to the findings. Some defended their practices as compliant with the law, while others recognized the vulnerabilities and made software updates. For instance, one company asked its analytics provider to delete all collected location data and updated its app to stop transmitting geolocation after being informed of the study’s results.

The project lead believes the bigger issue is that consumers often don’t fully understand what they’re agreeing to when purchasing a connected car or setting up its app. Most drivers aren’t going to sit in a dealership parking lot reading through dense privacy policies on a small screen before agreeing to the terms.

“I don’t think there’s a lot of trust as a result of this,” he said. “Automakers should work to rebuild that trust, and one way to do that is through better transparency and ensuring consumers have more explicit opt-in options rather than just opt-out after making such a significant purchase.”