Connected Cars Share Data With Advertisers and Big Tech, Study Finds

Connected cars remain a serious privacy concern, and new research offers a clearer picture of what data they share—and who receives it. A study conducted by researchers at Northeastern University and Consumer Reports examined 21 cars from 19 brands.

The researchers identified traffic to advertising, tracking, and analytics domains, along with data connections to major technology companies such as Microsoft and Adobe. They also found that using a car’s companion app can double the number of connections involved.

Researchers measured real-world connected-car traffic

In 2023, the Mozilla Foundation published an extensive review of the privacy policies of more than 20 automakers. The organization described automotive as “the worst product category we’ve ever considered in terms of privacy” in its report.

That earlier analysis focused on automakers’ written privacy policies. The new study instead measured actual network traffic under different conditions, including when cars were idling and driving. Researchers also placed 11 cars—all electric models—in a Faraday tent to determine whether their traffic would shift to the vehicle’s Wi-Fi connection when cellular service was unavailable.

Network traffic revealed domains and connection patterns

The researchers attempted to inspect the contents of the data packets using modified certificates, but those efforts failed in both cases. Even so, the network traces revealed useful information, including the domains contacted through DNS traffic, the server name indication (SNI) used during TLS handshakes, the volume and timing of transmissions, and behavioral differences between experimental scenarios.

Every vehicle connected to a first-party domain operated by its automaker. That was expected: all of the tested vehicles were connected cars. Some vehicles appeared to stop there. The Buick Envista and Mercedes-Benz EQS, for example, did not appear to connect to other domains.

Tesla Model 3 contacted the most third-party domains

Other vehicles made substantially more connections. The Tesla Model 3 topped the study’s list, communicating with 34 advertising, tracking, and analytics domains, along with 37 domains associated with apps integrated into its infotainment system.

Alphabet was the most frequently accessed domain. That is consistent with the growing presence of the company’s Android Automotive operating system in connected vehicles. However, the researchers noted that many of the second-level domains they identified were not necessary for core services. These included doubleclick.net and googlesyndication.com, which are used for advertising.

Media-streaming services, including Spotify and SiriusXM, were also commonly represented in the traffic. Mapping providers such as HERE, TomTom, and Mapbox appeared as well.