[CLSTR]
< Back to situation

[REVISION HISTORY]

Connected vehicle data privacy and access concerns

Updated 3 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-21 14:06 UTC → 2026-10-25 09:29 UTC · added removed

A joint study by Northeastern University and Consumer Reports previously identified significant privacy risks in connected vehicles, noting that 19 of 21 tested models communicated with third-party domains. These data flows often included sensitive identifiers like VINs, geolocation, and contact details, which were transmitted to advertising, tracking, and analytics firms. (ATA) firms such as Alphabet, Meta, Amazon, and Adobe. The Tesla Model 3 was identified as a high-frequency communicator, contacting 34 unique ATA domains. Companion mobile apps often exacerbate these risks; seven of 30 tested apps transmitted sensitive data to third parties, potentially allowing brokers to build consumer profiles for insurers and banks. Honda was noted as the only manufacturer to take active corrective measures by updating apps and requesting the removal of certain stored location data. Recent findings from a CARUSO study suggest that manufacturers continue to restrict access to connected vehicle data, potentially hindering competition in the automotive aftermarket despite the implementation of the European Data Act. An evaluation of 28 manufacturers revealed that 32% have not implemented Data Act provisions, 64% lack adequate pricing models for third-party access, and 68% lack sufficient API solutions for efficient communication. solutions. Further analysis of the ten best-selling brands in Brazil highlighted significant variations in data transparency and retention. Collected data includes GPS location, speed, battery status, and driving patterns. Retention retention, with periods vary widely, ranging from 20 days for GWM’s GPS data to five years in certain Renault cases. New research years. Cybersecurity threats are increasingly shifting toward external ecosystems. Research from the University of Gothenburg and Chalmers University of Technology indicates that cybersecurity threats are increasingly shifting toward external ecosystems. An examination of 413 vulnerabilities reported between 2022 and 2024 shows that weaknesses vulnerabilities involving connected apps, websites, and cloud services have nearly tripled compared to the previous decade. The study notes that in 2024, information related to approximately 800,000 vehicles from various Volkswagen Group brands was left accessible online. Additionally, researchers warn that if entertainment systems are not adequately isolated from driving controls, digital compromises could potentially affect critical functions like steering or braking. the integration of mobile applications has created risks for stalking and harassment, exemplified by a case where a BMW app was used to remotely track and manipulate a vehicle's functions.

Versions

  1. 2026-10-25 09:29 UTC Connected vehicle data privacy and access concerns
  2. 2026-10-21 14:06 UTC Connected vehicle data privacy and access concerns
  3. 2026-10-14 14:25 UTC Connected vehicle data privacy and access concerns
  4. 2026-10-01 18:29 UTC Connected vehicle data privacy concerns

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.