Study: 21 Cars All Sent Data to Third Parties
Northeastern and Consumer Reports tested 21 vehicles and 30 apps. All cars transmitted data to third-party domains; seven apps shared VINs and locations with ad networks.
Researchers from Northeastern University and Consumer Reports tested 21 late-model vehicles from 19 brands sold in the US, along with 30 companion mobile apps. Every one of the 21 vehicles transmitted data to at least one third-party domain over Wi-Fi, according to the study.
More than half of the tested vehicles contacted advertising, tracking, or analytics domains. Vehicles with advanced infotainment systems, especially those running Google's Android Automotive OS with Google Automotive Services, contacted the highest number of third-party domains.
Seven companion apps — HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC — sent VINs, phone numbers, and precise locations to advertising networks. Over 70 percent of the tested apps contacted at least five unique advertising, tracking, or analytics domains.
The findings follow regulatory action. The FTC penalized General Motors last year for collecting and selling precise location and driving behavior data without informed consent. Ford and Honda faced minor fines for making it difficult for customers to opt out.
Researchers used a Raspberry Pi and a Faraday tent to capture Wi-Fi and cellular traffic from the vehicles. David Choffnes, the project lead and former director of Northeastern's Cybersecurity and Privacy Institute, oversaw the work, which was reported by theverge.com.
Quick answers
How many vehicles were tested?
21 late-model vehicles from 19 brands sold in the US, plus 30 companion mobile apps.
Which apps shared VINs and locations with ad networks?
HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC.
What did the FTC do about connected car data?
The FTC penalized General Motors last year for collecting and selling precise location and driving behavior data without informed consent. Ford and Honda faced minor fines for making it difficult for customers to opt out.