The Digital Dashboard: Who is Tracking Your Connected Car?

"Your car is essentially a smartphone on wheels."

This sentiment drives Automatic Transmission, a comprehensive data-privacy investigation into the ecosystem of connected vehicles. This represents the first large-scale measurement study of its kind.

What is a "Connected Car"?

A connected vehicle is defined as any car equipped with integrated internet capabilities—including cellular data, Wi-Fi, and GPS—allowing for continuous communication between the vehicle, the manufacturer (OEM), and various external entities.

The Scale of the Issue:

• Over $\text{75\%}$ of vehicles sold worldwide now feature built-in connectivity.
• These systems track your precise location and driving habits.
• This data is often shared with private third-party entities, such as advertisers and insurance providers.

---

📊 Report Executive Summary

In collaboration with Consumer Reports, researchers analyzed 21 modern vehicles and 30 associated mobile applications to uncover the privacy risks inherent in the connected-vehicle landscape.

Key Discoveries

1. Third-Party Leakage: Both the hardware (cars) and software (apps) frequently communicate with third-party domains, specifically trackers and advertisers.
2. Widespread Transmission: $\text{19 out of 21}$ vehicles tested sent data to at least one third party.
3. Sensitive Data Exposure: $\text{7 out of 30}$ apps transmitted sensitive identifiers to third-party firms.

---

🎓 Academic Context & Team

This research was conducted by a specialized team of networking-systems, security, and privacy experts from Northeastern University.

• Peer Review: The findings have been peer-reviewed and are scheduled for publication at IMC '26.
• Resource Support: Consumer Reports provided a fleet of test vehicles, saving the team an estimated $1.2M in procurement costs.

---

🔍 The Research Framework

The Ecosystem Map

The following diagram illustrates how data migrates from the user's environment to external servers.

The Core Problem

Once data is transmitted to these servers, the consumer loses all agency. The receiving companies decide how to handle the information, which frequently involves selling or sharing it with undisclosed third parties.

The guiding research question was: What specific categories of personal consumer data are being transmitted by connected vehicles and their paired mobile applications?

---

🛠️ Methodology & Experimental Setup

The study was conducted between October 2024 and August 2025 using a controlled environment.

🚗 Vehicle Testing Phase

To monitor data egress, the team utilized a custom network configuration.

The Wi-Fi Setup: Researchers deployed a Raspberry Pi configured as a custom Access Point (AP). They utilized the following tool to log traffic:

tcpdump -i wlan0 -w vehicle_traffic.pcap

Note: While the destinations were visible, the actual content of the packets remained encrypted.

Test Categories:

• Stationary Idle: Vehicle powered on; no user interaction (Baseline).
• Stationary Active: Performing every possible function within the infotainment system.
• Driving Test: Operating the vehicle between $5\text{--}45\text{ mph}$, including hard braking and rapid acceleration.

Cellular Isolation: To determine if blocking cellular signals would force data to reroute through Wi-Fi, the team used a Faraday tent.

• Attenuation: $\approx 93\text{ dB}$
• Process: 11 EVs were placed inside the tent to repeat Idle and Active tests without cellular interference.

(Placeholder: Raspberry Pi Setup) (Placeholder: Testing Facility) (Placeholder: Faraday Tent)

📱 Companion App Testing Phase

The team analyzed 30 apps paired with the vehicles.

Hardware & Software Environment:

• Devices Used:
  • iPhone 8 (iOS 16.6)
  • iPhone X (iOS 16.7.11)
  • iPhone 13 (iOS 18.5)
• Traffic Decryption: The team used mitmproxy combined with custom root certificates to intercept and decrypt HTTPS traffic.

Testing Protocol:

• Delete all non-essential apps to eliminate background noise.
• Install one vehicle app at a time.
• Restart the device between different app tests.
• Use native iOS screen recording to document all interactions.
• Grant all requested permissions (Location, Bluetooth, Calendar, etc.).
• Log in using valid Consumer Reports employee credentials.