Northeastern study highlights PII risk with vehicles that are ‘smartphones on wheels’

Based on a recent large-scale study of the connected vehicle ecosystem, Northeastern University researchers conclude that improved transparency is necessary to identify and address existing harm to passengers caused by the data that “smartphones on wheels” collect.

The university partnered with Consumer Reports to test 21 late-model vehicles and 30 companion mobile apps to understand the privacy implications of the connected vehicle ecosystem.

“Modern vehicles typically integrate a wide array of sensors, software systems, and always-on connectivity, effectively becoming ‘smartphones on wheels,'” states the research paper covering the study results. “Such vehicles are part of a broader ecosystem that includes companion mobile apps and third-party services, raising significant privacy risks due to the sensitivity of vehicular data. Despite documented harms, the community still lacks a good understanding of the privacy implications of the connected vehicle ecosystem.”

The paper adds that over 75% of vehicles sold globally have built-in internet access.

Researchers found:

• • Vehicles and companion apps contact numerous third-party domains, including advertisers and trackers.
  • Nineteen of 21 vehicles send traffic to at least one third party over Wi-Fi.
  • Seven of 30 apps transmit personally identifiable information (PII) to third-party companies, resulting in allowing advertisers to build in-depth consumer profiles.
  • Five out of 30 apps sent VINs and other PII to trackers.
  • Pairing a companion app roughly doubled a vehicle’s exposure to advertising/tracking companies, on average, and in some cases added 20-plus new ones.

Vehicles tested include Buick, Cadillac, Chevrolet, Dodge, Fiat, Ram, Fisker, Ford, Honda, Land Rover, Lexus, Toyota, Subaru, Lucid, Mercedes, Nissan, Rivian, Tesla, and Volvo models. Most were model years 2023 and 2024; two were from the 2022 model year (both electric vehicles), and one from 2025.

“Once the data gets sent to these servers, it is up to the companies that receive the consumer information to make decisions on what they do with it,” the paper states. “Unfortunately, in many cases, this includes sharing or selling consumer data to other undisclosed third parties. Consumers have no control over their data once it has left their device.”

Researchers found that vehicle-specific information is being tied to individual consumers. Companion apps expose VINs and a secondary type of PII, such as email addresses, to three companies.

“Such companies can use these stable identifiers and PII to implement cross-context tracking of users, i.e., allowing advertising companies to link a person who owns a vehicle with their behavioral data and purchase history from other websites and mobile apps,” the paper states. “Furthermore, we observe that some apps also expose detailed geolocation information to ATA companies. These transmissions expose consumers to a different level of harm than traditional mobile app tracking as they reveal an individual’s ownership status or interactions with a particular vehicle to companies that use this data for advertising, tracking, and analytics.”

The researchers shared their findings with the affected manufacturers and included aggregated responses in the paper. Three OEMs didn’t respond. Of those that did respond, 14 said they rely on third-party service contracts.

Seven OEMs said that handling software-defined vehicles is the consumer’s responsibility. The paper states these OEMs said, “it’s the owner’s job to read and individually accept the terms of every third-party app or service on the vehicle, even software that ships pre-installed.” The paper notes that declining a data-sharing agreement can disable features like navigation, driver-assist, or over-the-air updates per manufacturer policies.

Five said some in-app links open an embedded browser and attributed any third-party tracking to the browser rather than the app itself, according to the paper. Three said the pages prompt users to accept or reject tracking cookies, but researchers write that their own recordings didn’t always show the prompt appearing.

“The ongoing theme of all these responses was shifting the blame to the consumer,” the paper states. “The current system does not give owners the ability to choose. Assuming owners can find the particular agreements, if an owner decides they are uncomfortable with the data sharing described within them, they are faced with (arguably) unfair choices: accept the agreements regardless of their concerns; stop using their car’s connected-vehicle features, which include remote start, the app, and other very useful features; stop using the vehicle entirely.”

The researchers note that Honda improved its data collection practices to prevent sending precise geolocation to a third party associated with user tracking.

“Overall, our study revealed a large gap between what vehicle manufacturers publicly disclosed and how the connected vehicle ecosystem actually shares data over the internet, which has explicit privacy implications.”

New findings from research firm All About Cookies show that the average car privacy policy requires college freshman-level education to understand.

All About Cookies found that some of what manufacturers collect has nothing to do with driving, and it covers how OEMs collect data and who they share it with.

“While car companies send driver data to other branches of their parent company, such as dealerships and financing and insurance departments, they also send data to third-party companies and services,” the report states. “These typically include insurance companies, advertising and marketing networks, law enforcement, and data and analytics companies.”

The topic of private personal information (PPI), another term for PII, on vehicles was discussed in July at a Collision Industry Conference (CIC) meeting.

According to Andrea Amico, Privacy4Cars founder and CEO, 90% of vehicles go to a salvage auction with PII accessible.

Images

Featured image credit: gorodenkoff/iStock