Recent advancements in automotive technology, particularly the integration of connected systems like WiFi and GPS, have led vehicles to accumulate extensive data about their owners. A recent study from Northeastern University highlights that this information is not remaining confidential.
This issue is not a new revelation; numerous studies and legal actions have brought to light the extent of driving data collection and its sharing with external entities, including insurers. The current research underscores the enormity of the challenge and the difficulty consumers face in protecting their privacy without giving up the convenience of features like remote unlocking or starting.
In collaboration with Consumer Reports, researchers evaluated 21 modern vehicles from 17 manufacturers, such as GM’s Cadillac and Chevrolet, as well as brands like Ford, Tesla, Toyota, Lucid, and Rivian. They also analyzed 30 associated mobile applications to grasp the privacy risks linked to the connected vehicle landscape. The peer-reviewed findings are set for release this week.
The results pose serious concerns for consumers, whose personal information is being transferred to tech giants like Google, Meta, Microsoft, Yahoo, and others.
Out of the 21 vehicles assessed, 19 transmitted data to at least one third party, and seven of the 30 apps shared sensitive information, including vehicle identification numbers (VIN), email addresses, phone numbers, and precise locations with tracking and advertising firms.
The situation was exacerbated as multiple types of data were often sent to the same third party, enabling advertisers and data brokers to create detailed consumer profiles. These profiles can be particularly challenging for consumers to erase since they are sold to various entities, including banks and insurance companies.
When the researchers linked the mobile app to the vehicle, it nearly doubled the amount of data shared with advertising and tracking firms.
After sharing these findings with the respective manufacturers, all but Honda attributed the issue to external factors, frequently blaming consumers. Honda, in contrast, acted by enhancing its data collection policies and instructed its vendor, Amplitude, to delete all previously acquired geolocation data.
Several automobile companies informed Consumer Reports that certain links in their companion apps redirected users to external pages that might contain cookies for data collection. Regardless of the methods used, drivers were not adequately informed of this data gathering.
