Car Is a Smartphone on Wheels. Here's Who's Listening

Researchers performed the first large-scale measurement of the connected-vehicle ecosystem by instrumenting 21 late-model vehicles (19 brands) and 30 companion mobile apps provided via a Consumer Reports fleet. Tests used a custom Raspberry Pi Wi‑Fi access point and tcpdump to log vehicle Wi‑Fi destinations, a Faraday tent to isolate cellular traffic, and iPhones with custom root certificates and mitmproxy to decrypt app network flows. Researchers ran idle, active, and driving scenarios, accepted all app permissions during login, and exercised all in‑app features to capture real-world data flows.

Findings show pervasive data sharing with advertisers and trackers: 19 of 21 vehicles contacted at least one third party over Wi‑Fi, 7 of 30 companion apps transmitted sensitive identifiers (VINs, emails, phone numbers, precise location) to third parties, and 5 apps sent VIN plus other PII to trackers. Pairing an app roughly doubled a vehicle’s exposure to tracking and in some cases added 20+ new trackers. Manufacturer disclosures often underestimated these flows; responses typically shifted responsibility to consumers and offered few controls, though Honda stopped sending precise geolocation to a tracker. The work documents opaque, inconsistent network behavior across models and calls for stronger transparency and continued measurement to protect consumer privacy.