A parked car is a sensor platform, and a new study has counted how loudly it talks. Researchers at Northeastern University, working with Consumer Reports, monitored 21 late-model vehicles from 19 brands sold in the United States, along with 30 companion phone apps.
Every car reached its manufacturer’s own servers. A few stopped there, among them the Buick Envista and the Mercedes-Benz EQS. Most kept going.
One car pulled ahead of the field. A Tesla Model 3 opened links to 37 domains tied to infotainment apps, and to 34 more used for advertising, tracking and analytics. Motion changed the picture for a pickup as well, with the Cybertruck reaching 26 extra third-party domains while driving compared with parked. Google’s ad properties showed up most often, doubleclick.net and googlesyndication.com among them – services built to sell attention rather than keep a vehicle running.
Eleven electric models spent time inside a Faraday tent. Cut off from cellular coverage, the Cadillac Lyriq, Chevrolet Blazer, Honda Prologue and Rivian R1S simply stopped using their connected subsystems. Others slid their traffic onto Wi-Fi, handing researchers a clearer view.
Encrypted payloads held up, so the team worked from domain names, TLS handshake fields and the timing and volume of transmissions instead of content.
Companion apps widened the exposure. Testing 30 of them, the researchers found some pushed users toward more than 20 additional advertising, tracking and analytics companies, with GM, Toyota and Nissan the worst offenders.
Project lead David Choffnes said the conclusion is that there is a lot to be worried about. Three years after Mozilla read automakers’ privacy policies and called cars the worst product category it had reviewed, live traffic points the same way.
