Summary
Northeastern researchers tested 21 vehicles from 19 brands and found personal information, including VINs, email addresses and location data, in data shared with third parties. The findings came from vehicle-app traffic that researchers could decrypt; encryption prevented them from inspecting data sent by the cars themselves.
Northeastern University researchers who tested 21 vehicles from 19 brands found that personal information—including vehicle identification numbers (VINs), email addresses and location data—was being sent to third-party companies. The findings came from examining vehicle-connected services and their mobile apps in research conducted with the nonprofit media group Consumer Reports.
The researchers identified the information in app data they could decrypt. Encryption prevented them from reading the data payloads transmitted by the vehicles themselves, an important distinction when interpreting what the tests reveal about connected cars.
What the researchers could observe
The team redirected internet traffic sent by the vehicles to networks under its control. Although encryption obscured the cars’ transmitted data, researchers could decrypt traffic from the accompanying apps on phones they owned for testing. They identified personal information in that app data, including VINs, email addresses and location information.
Among the third parties most often contacted with personal information were Adobe Analytics, data broker Axiom and analytics company ContentSquare. The report does not describe these services as necessary to a car’s operation; the researchers said some companies receiving information had no connection to vehicle functionality.
The manufacturers’ app privacy policies disclosed that personal information might be shared with third parties. However, the researchers found that the policies did not specify which third parties would receive data or the stated purpose of sharing it.
Why vehicle data can matter beyond the car
A VIN identifies a vehicle, while an email address can identify or help distinguish an account holder. The researchers warned that stable identifiers combined with personal information can enable cross-context tracking: companies may link a vehicle owner with behavioural data and purchase history from other websites and apps.
The results offer a view of data visible through the tested apps, rather than a complete inventory of information transmitted by the cars. For connected-car owners, the findings highlight that information associated with a vehicle can reach analytics firms and data brokers as well as services involved in vehicle functions.