Your car is a smartphone on wheels. Here's who's listening.

Methods

We investigated 21 vehicles from the U.S. market in a controlled environment along with 30 companion mobile apps instrumented with on-site vehicles between October 2024 and August 2025. Below is a description of the experiments we ran and our setup.

Vehicle Testing

Photo is not loading images/rpi.png

Wi-Fi Testing Setup

To collect Wi-Fi traffic from vehicles, we configured a custom access point (AP) on a Raspberry Pi and used tcpdump to log all packets that were sent or received via this AP.
This allowed us to see all the destinations the vehicles were sending data to but not the information within the packets as it was encrypted.

Photo is not loading images/test-facility.jpg

Stationary Tests

Idle Baseline
vehicle on — no activity

Active Test
perform all possible actions

Driving Test

drive 5–45 mph with acceleration & hard braking

Isolating Cellular Traffic

Photo is not loading images/faraday-tent.jpg

One hypothesis we tested was whether blocking a vehicle’s ability to communicate over its cellular network would force more Wi-Fi communication. To block external cellular signals, we drove 11 EVs in the sample into a car-sized Faraday tent providing ≈93 dB of attenuation, blocking their cellular connection entirely. Stationary Idle and Active tests were repeated inside the tent to see whether traffic that normally goes out over cellular rerouted to Wi-Fi instead.

App Testing

In total, we experimented with 30 connected vehicle companion apps that were paired with the vehicles at Consumer Reports’s testing facility.

Findings

• 19 of 21 vehicles contacted at least one third party over Wi-Fi, including known advertising and tracking domains
• 7 of 30 companion apps transmitted sensitive identifiers (VINs, emails, phone numbers, precise location) to third parties associated with advertising and tracking.
  Transmiting multiple forms of PII to the same third party allows advertisers to build in-depth profiles on consumers

• Pairing a companion app roughly doubled a vehicle's exposure to advertising/tracking companies on average, and in some cases added 20+ new ones.

Conclusion

• We found that vehicles, under a variety of real-world settings, contact not only a wide range of first parties (i.e., manufacturer domains) and car-specific support parties, but also third parties that are known to provide advertising and tracking services.
• Vehicles from the same manufacturer exhibit different network behaviors - this makes it very difficult and expensive to study these vehicles.
• When adding vehicle companion apps to the analysis, we found that vehicle owners are exposed to even more privacy-sensitive ATA communication—in some cases more than two dozen additional trackers.
• Our study revealed a large gap between what vehicle manufacturers publicly disclosed and how the connected vehicle ecosystem actually shares data over the Internet
• Based on the opaque nature of vehicular systems, we argue that there is a need for better transparency to ensure increased visibility into the entire ecosystem to identify and address corresponding harms.