Connected vehicle data privacy concerns

A joint study by Northeastern University and Consumer Reports has identified widespread privacy concerns regarding data transmission in modern connected vehicles and their mobile applications.

Initial research monitoring 21 vehicles and 30 applications found that 19 of the tested vehicles transmitted data to third parties, with more than half contacting domains related to advertising, tracking, or analytics. While the encrypted nature of the traffic initially prevented researchers from seeing specific content, the destinations were clearly identified.

Subsequent detailed analysis revealed that the shared information includes geographic locations, email addresses, and unique vehicle identification numbers (VIN). Researchers warned that because a VIN cannot be reset, it allows data brokers and advertisers to link drivers to activities across various services. Major technology firms, including Google, Meta, and Microsoft, were identified as potential recipients.

Specific manufacturer applications, such as those from Honda, Lincoln, Nissan, and General Motors, were noted for transferring personal information. In response to the study, 14 of the 17 manufacturers contacted stated their data flows comply with existing contracts. Some manufacturers argued that the responsibility lies with owners to read terms of use, while others attributed the tracking to third-party websites accessed within the apps.