Connected vehicles are routinely communicating with advertising, tracking and analytics companies, according to research by Northeastern University and Consumer Reports.
The US study examined 21 vehicles from 19 manufacturers and 30 associated mobile apps. Researchers routed vehicle internet traffic through networks they controlled to identify the domains contacted.
All 21 vehicles contacted at least one third-party domain, while more than half reached domains linked to advertising, tracking or analytics services. Much of the traffic was encrypted, however, limiting the researchers’ ability to establish what information was being transmitted from the vehicles themselves.
Apps exposed more detailed data flows
The companion apps provided greater visibility. Seven apps — HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick and myGMC — were found to send personally identifiable information, including combinations of vehicle identification numbers (VINs), contact details and precise location data, to advertising or analytics services.
More than 70% of the apps tested contacted at least five advertising, tracking or analytics domains. Northeastern said Adobe Analytics, Acxiom and Contentsquare were among the third parties reached during testing.
The researchers highlighted the VIN as a persistent identifier that can be combined with information such as an email address or location. This could allow data about a vehicle and its use to be linked to profiles held by advertising or data companies.
Manufacturer and software differences
The research found that data flows varied between manufacturers and software platforms. Vehicles using more extensively connected infotainment systems, including Google’s Android Automotive OS with Google Automotive Services, generally contacted more third-party domains.
This suggested that the volume and destination of data can be influenced both by manufacturers and by the software and connected services integrated into vehicles.
Honda changed its practices after being shown the findings. The company asked analytics provider Amplitude to delete location information it had received and later updated the HondaLink app to stop transmitting geolocation data to the company.
Honda spokesperson Andrew Quillin confirmed the researchers’ account and said the VIN and location data shared with Amplitude had not been available for Honda’s independent use or sale because those activities were prohibited under its contractual agreement.
The study also noted that connected vehicles can generate information covering vehicle identifiers, location and driving behaviour. Ford’s US privacy notice says connected Ford and Lincoln vehicles can wirelessly transmit vehicle-originated information, while General Motors says its connected services can collect precise geolocation and data on speed, braking and acceleration.
The findings raise further questions about how vehicle-generated data is shared with third parties and how clearly drivers are informed about those arrangements.