Researchers analyzed data traffic from various connected cars, including tests in a Faraday tent to observe behavior when cellular signals are lost. While encrypted data packets could not be decrypted, the study identified domains contacted via DNS and TLS handshakes, noting significant differences in transmission volume and timing across scenarios.
Tesla vehicles showed the highest activity, with the Model 3 connecting to 34 advertising and tracking domains, plus 37 domains from integrated infotainment apps. Alphabet domains were frequently contacted, often for non-essential advertising purposes like doubleclick.net. Other brands like Buick and Mercedes-Benz showed more restricted connectivity.
The study also evaluated 30 connected car applications, finding that some expose users to over 20 additional third-party advertising and analytics firms. General Motors, Toyota, and Nissan were identified as the most active in this regard. Infotainment usage generally triggered the highest volume of domain contacts across the tested fleet.
Researchers contacted 17 automakers and received responses from 14. While companies claimed that third-party data sharing is restricted by contracts, these agreements remain tied to existing privacy policies. However, Honda confirmed it has updated its practices to stop sharing precise location data with at least one tracking firm.
