New cars beam data to dozens of ad-tech and tracking domains, and even researchers can’t peek at what goes out over built-in eSIMs. Over WiFi alone, Tesla’s Model 3 contacted 34 ad, tracking, and analytics domains and additional 43 third-party domains, the most out of 21 vehicles tested.

“It does not appear that a customer can buy a new car that does not track you,” said Sarah Elizabeth Gillespie, one of the co-authors in the study of data privacy in the connected vehicle ecosystem.

Researchers at Northwestern University tested 21 vehicles from 2023 and later, and found that 19 of them contacted at least one third-party, including advertising and tracking domains – all over WiFi alone, and no companion app added.

The vehicles contacted large technology companies, including Alphabet (Google), Amazon, Microsoft, and Meta, as well as other trackers.

More than half of the cars (13) contacted Google, 12 called to Amazon, 8 – to Spotify. Three vehicles communicated with Meta Platforms. Many domains were not required for core services, like doubleclick.net or googlesyndication.com, used for advertising purposes, or other trackers.

Tesla Model 3, Cybertruck, Cadillac Lyriq, Lucid Air and Chevrolet Blazer were highlighted as vehicles that sent data to the largest number of outside advertising and analytics companies. Only the Mercedes EQS and Buick Envista stuck to the manufacturer's domains.

“Vehicles, when active, tended to contact more domains overall and more ATA domains in particular, especially when infotainment functions were in use,” the paper reads.

No visibility into eSIM traffic

A serious study limitation – the researchers had nearly no visibility into cellular connections. All of the cars, with one exception, had embedded eSIMs provisioned by the manufacturers.

“The communication patterns we observe should be considered a lower bound on the set of third parties with whom information is shared,” the researchers acknowledged.

Theoretically, it is possible to load a custom eSIM on some cars and attempt to intercept the traffic, but this procedure might be destructive, with no reliable way to restore the factory configuration.

Tesla’s Model 3 was unique, as it had a physical SIM card slot, which allowed the researchers to use their own SIM and intercept the traffic as a proof of concept. In one test, they found one additional tracking domain contacted over cellular that previously hadn’t appeared on WiFi.

The researchers even put electric vehicles (EVs) into a Faraday cage to see if they would communicate over WiFI more, when cellular connection is absent – it was the case for most of them.

“Some connected vehicles will direct traffic to Wi-Fi when cellular is blocked, which reveals flows to trackers previously unobservable outside the tent,” the study reads.

None of this also tells of what’s being sent – WiFi capture only allowed researchers to see the destination, but not to decrypt the traffic.

Your car may be spying on you – and transmitting what it learns to some of the world’s biggest tech companies,

said Consumer Reports, an American nonprofit that partnered with the researchers and provided vehicles for the study.

Adding an app doubles the exposure

Researchers also looked into companion apps that owners install on their smartphones. Twenty-eight of 30 connected mobile apps sent data to at least one third-party advertising or analytics company.

“Pairing a companion app roughly doubled a vehicle's exposure to advertising/tracking companies on average, and in some cases added 20+ new ones,” the researchers said.

Using the man-in-the-middle (MitM) technique, the researchers decrypted some of the traffic – seven apps also transmitted sensitive identifiers.

“Four GM companion apps – myCadillac, myChevrolet, myBuick, and myGMC – as well as the HondaLink, MyNissan, and Lincoln apps, were found to be sharing VINs paired with either email addresses or location data,” Consumer Reports said.

The myCadillac app contacted the most – 51 – domains associated with ads, tracking, and analytics (ATA), followed by Buick, My BMW, and Toyota apps contacting 47 domains each.

“We suspect that VINs are being used as stable, unique identifiers for vehicles, much like how IMEI or IDFA are used for the same purpose on smartphones,” the study said.

Researchers were not surprised to find that apps contact prominent ATA domains, including Google’s DoubleClick and Analytics, Facebook, and Adobe.

“Our findings underscore the need for more empirical research into data selling and sharing by vehicle makers, and for increased scrutiny of modern vehicles as the sum of their interconnected systems rather than standalone consumer products.”

Manufacturers deflect the blame

Fourteen out of 17 contacted manufacturers responded to the disclosures.

Several automakers told Consumer Reports that their apps have links to webpages where third parties can embed pixels and cookies that collect customer data.

“General Motors, Honda, Nissan, and Stellantis (which owns 14 auto brands, including Chrysler, Dodge, Fiat, and Jeep), said some recipients of driver data were prohibited from independently using or selling any data they are provided,” Consumer Reports summarized.

But the Northeastern researchers found those restrictions aren’t necessarily effective – in one example, Honda, after the disclosure, requested its vendor to delete all received location data.

They argue that contracts and policies are often overly broad and expansive, and the current system does not give owners the ability to choose.

Seven manufacturers said it’s the owner’s job to read and individually accept the terms of every third-party app or service on the vehicle, even when software is pre-installed.

“Declining a data-sharing agreement can disable features like navigation, driver-assist, or over-the-air updates per the manufacturers’ policies,” the researchers said.

The study calls for greater transparency and visibility across the entire ecosystem to more effectively address corresponding privacy and security concerns.