Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem

Abstract

Modern vehicles typically integrate a wide array of sensors, software systems, and always-on connectivity, effectively becoming "smartphones on wheels." Such vehicles are part of a broader ecosystem that includes companion mobile apps and third-party services, raising significant privacy risks due to the sensitivity of vehicular data. Despite documented harms, the community still lacks a good understanding of the privacy implications of the connected vehicle ecosystem. In this paper, we present the first large-scale empirical study of data privacy in the connected vehicle ecosystem. In collaboration with a consumer vehicle testing organization, we use two perspectives to better understand the data that is being collected and shared. First, we test 21 late model vehicles using a combination of Wi-Fi interception and controlled cellular capture under a range of conditions to observe the vehicles' network traffic patterns. Second, we instrument 30 vehicle companion apps paired with on-site vehicles to build a more complete picture of the data flows to third-party services. We find that both vehicles and companion apps contact numerous third-party domains, including advertisers and trackers. For example, all but two of the vehicles tested send traffic to at least one third party, and seven of 30 apps transmit sensitive identifiers to third-party companies, with wide variation across brands and models. Our findings underscore the need for continued measurement and scrutiny of the connected vehicle ecosystem.