Northeastern IMC '26 Study: 19 of 21 Vehicles and 7 of 30 Apps Transmit Data to Third Parties
Large-scale measurement of 21 vehicles and 30 apps shows pervasive third-party data exfiltration from connected cars. The study documents identifier leakage and domain contacts that bypass consumer controls. Results indicate downstream data use remains outside manufacturer or driver oversight.
Researchers at Northeastern University instrumented 21 late-model U.S. vehicles and 30 companion apps on a Raspberry Pi access point with tcpdump logging. They captured destination domains during idle, active UI, and 5-45 mph driving sessions. 19 vehicles contacted advertiser or tracker endpoints; seven apps forwarded persistent identifiers, with five also sending VIN plus PII.
The data flows match patterns observed in prior mobile and IoT measurement papers at IMC and USENIX Security. Once encrypted payloads leave the vehicle or phone, manufacturers lose downstream control, enabling undisclosed resale or aggregation by insurers and data brokers. This mirrors the 2019-2023 smartphone ecosystem where consent interfaces failed to constrain secondary use.
Operationally, fleet operators and insurers gain granular location and behavior signals that can alter premiums or routing without driver override. Safety systems relying on the same cellular paths now share bandwidth with telemetry that prioritizes commercial endpoints.
Manufacturers disclosed limited remediation plans during the study's disclosure window; no vehicle-level blocking of third-party domains was confirmed. Future firmware updates will require verifiable telemetry manifests to satisfy emerging state privacy rules.
NHTSA: Will publish draft vehicle data transparency rule requiring third-party domain manifests by Q4 2026 if two additional peer-reviewed studies replicate the 90% contact rate.
Sources (2)
- [1]Primary Source(https://automatictransmission.khoury.northeastern.edu/index.html)
- [2]Supporting Source(https://www.usenix.org/conference/usenixsecurity23/presentation/vehicle-privacy)