Study Finds Connected-Car Apps Share Vehicle and Personal Data with Tracking Firms
Summary
Researchers tested 21 vehicles and 30 apps, finding that some shared VINs, contact details, or location data with advertising, tracking, and analytics firms. They say disclosures often fail to explain those data flows.
Key points
- Researchers tested 21 vehicles from 19 brands and 30 companion apps, logging Wi-Fi traffic and examining decrypted app traffic.
- Nineteen vehicles contacted at least one third party over Wi-Fi; 11 contacted an advertising, tracking, or analytics domain.
- Seven apps sent personal data to those companies. GM apps shared VINs and email addresses with multiple third parties, and some also sent location or phone data.
- The researchers said companion apps at least doubled cumulative advertising, tracking, and analytics exposure for most vehicles in the dataset.
- The study could not inspect most cellular traffic or decrypt vehicle traffic, so its authors described the findings as a lower bound.
- Honda asked Amplitude to delete location data and updated HondaLink to stop sending geolocation after the researchers disclosed their findings.
Article Details
- Publisher
- Help Net Security
- Scope
- Privacy and data sharing by connected vehicles and companion apps tested over Wi-Fi, with additional cellular-signal tests on electric vehicles.
- Sample Size
- 21 vehicles from 19 brands and 30 carmaker apps
- Key Statistics
- 19 of 21 vehicles contacted at least one third party over Wi-Fi.
- 11 of 21 vehicles contacted at least one advertising, tracking, or analytics domain.
- 13 of 21 vehicles contacted Google-owned domains.
- 7 of 30 apps sent personal data to advertising, tracking, or analytics companies.
- Researchers contacted 17 manufacturers, received 14 responses, and received no reply from three.
- Recommendations
- Researchers argued for better transparency to increase visibility into the connected-vehicle ecosystem and help identify and address harms.
Vendors
AcxiomGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.AdobeGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.AlchemerHondaLink sent the VIN and precise location to Amplitude, MyNISSAN sent the VIN and email address to Alchemer, and the Lincoln app sent the VIN to ContentSquare.AmplitudeHondaLink sent the VIN and precise location to Amplitude, MyNISSAN sent the VIN and email address to Alchemer, and the Lincoln app sent the VIN to ContentSquare.ContentSquareGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.FullStoryGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.General MotorsBeyond reported cases such as the FTC enforcement action against General Motors, “relatively little is known about the privacy implications of the connected vehicle ecosystem,” the researchers wrote.Google13 of the 21 vehicles contacted Google-owned domains.Honda#TeslaLincoln#TeslaMetaGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.MicrosoftGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.Nissan#TeslaPinterestGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.SnapGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.TeslaFor the Tesla Model 3, which has a user-accessible SIM slot, they used a custom SIM card and ran their own LTE/5G network inside the tent.YahooGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.
Products
HondaLinkHondaLink sent the VIN and precise location to Amplitude, MyNISSAN sent the VIN and email address to Alchemer, and the Lincoln app sent the VIN to ContentSquare.myBuickGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.myCadillacGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.myChevroletGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.myGMCGM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.MyNISSANHondaLink sent the VIN and precise location to Amplitude, MyNISSAN sent the VIN and email address to Alchemer, and the Lincoln app sent the VIN to ContentSquare.Tesla CybertruckThe Tesla Model 3 contacted 34 unique advertising, tracking or analytics domains, the Tesla Cybertruck 23 and the Cadillac Lyriq 10.Tesla Model 3For the Tesla Model 3, which has a user-accessible SIM slot, they used a custom SIM card and ran their own LTE/5G network inside the tent.