Study: Almost all US automakers share driver data with third parties

A new study from Northeastern University has found that nearly all U.S. automakers produce cars that share drivers' personal information with "third parties." The only exception was one brand that limited surveillance of car owners, writes Road & Track.

Together with Consumer Reports, the researchers tested 21 late-model vehicles and 30 associated mobile apps. Researchers collected Wi-Fi traffic data using a Raspberry Pi access point to understand where the machines were sending information. It turned out that 19 out of 21 cars transmit information to third parties.

The researchers noted that vehicles in the real world interact not only with manufacturers and service providers, but also with advertising and tracking companies. When installing additional applications, car owners are exposed to even greater risk: in some cases, more than two dozen additional trackers were recorded.

Tests were carried out both at idle and in motion. In addition, scientists tested whether Wi-Fi use would increase if cellular communications were blocked. To do this, 11 electric vehicles were placed in a Faraday tent with a sound-absorbing layer that attenuated the signal by 93 decibels. Models from General Motors, Stellantis, Fisker, Ford, Honda, Land Rover, Toyota, Lucid, Mercedes-Benz, Nissan, Rivian, Tesla and Volvo participated in the tests.

Seven of the 30 apps shared sensitive data such as vehicle identification numbers, email addresses, phone numbers and precise locations with third-party advertising and tracking companies. On average, such applications doubled the number of companies accessing data. The most common vehicles shared were Tesla and General Motors, such as the Cybertruck and Cadillac Lyriq. The main recipients of the data were Alphabet, Amazon, Meta, Microsoft, Pinterest and Reddit.

Scientists contacted 17 manufacturers. Most stated that data transfers are consistent with service agreements with third parties. Of the 14 companies that responded, all confirmed that the information flows do not violate the agreement. At the same time, the contracts themselves are often drafted vaguely, which creates opportunities for leaks. Seven manufacturers also said it is the responsibility of consumers to read the terms and conditions of third-party apps. However, refusal of such agreements may result in the disabling of navigation, driver assistance systems or over-the-air updates.

One exception is Honda, which has improved its data collection methods to avoid sharing precise location data with third-party trackers.