A joint study by Northeastern University and Consumer Reports has quantified how connected cars transmit data to advertisers and technology firms. The researchers tested 21 vehicles from 19 different brands to measure actual network traffic, finding that using a car's companion app significantly increases data sharing.
The investigation moves beyond previous analyses that relied on reading privacy policies. While the Mozilla Foundation published a report in 2023 stating that "cars are the worst product category we have ever reviewed for privacy," that work was based on document review. The new study involved measuring traffic from actual cars under various scenarios, including idling and being driven.
The testing revealed patterns of traffic directed toward advertisers, trackers, and major technology companies such as Microsoft and Adobe. To determine if vehicles switch communication methods when cellular signals are lost, the researchers parked 11 electric cars in a Faraday tent. This setup blocks cellular signals to see if data transmission shifts to the car's Wi-Fi connection.
Although the team could not decrypt the specific content within the data packets due to modified certificates, the network traces provided valuable insights. The researchers identified the domains contacted via DNS traffic and observed Server Name Indication (SNI) details in TLS handshakes. They also recorded the volume and timing of transmissions, noting differences in behavior across the various experimental scenarios.