Study – When Electric Cars Share Our Data with Tech Giants
Our cars are becoming increasingly connected, but all these advancements come with a troublesome downside: data collection. Researchers from Northeastern University, working alongside Consumer Reports, analyzed 21 cars and 30 automotive apps. The verdict? Nearly all of the apps studied communicate with companies specializing in advertising or data analysis.
The modern car is no longer “just” a means of transportation. It is also a complete technological device. GPS, remote controls, Wi-Fi, cellular connectivity, cameras, apps… All these new technologies generate and exchange large amounts of information constantly. A new study helps us better understand where some of this data might end up.
21 cars were scanned
To carry out their research, scientists from Northeastern University worked alongside experts from Consumer Reports. They separately examined the Internet connections of 21 cars from 19 brands and those of 30 mobile apps associated with these vehicles. In other words, the data observed could come directly from the car or from apps downloaded or active in the vehicle (Waze, Google Maps, Spotify, YouTube, WhatsApp, etc.).
This distinction is important: for cars, the researchers were able to identify the servers contacted, but only that. However, with mobile apps, they could analyze the transmitted data more precisely and found, in some cases, that the vehicle’s VIN, email address, or driver’s location was being sent.
The method used is interesting. The researchers placed the vehicles inside a kind of large Faraday cage (a enclosure used to block electromagnetic fields) in order to prevent their cellular communications. The traffic could then be redirected to a Wi-Fi network controlled by the team.
Tests were also conducted while driving, with accelerations, braking, or changes in direction.
Also read
For Ford’s CEO, it is already “too late” to compete with Chinese automakers in Europe
28 out of 30 apps share our data
The analysis of mobile apps provides more details in contrast. Of the 30 apps tested, 28 communicated with at least one company specializing in advertising or data analysis. Even more concerning, seven apps transmitted at least one piece of information that could potentially identify their user: name, email address, vehicle VIN number, or precise location.
Apps from General Motors, Honda, Nissan, and Lincoln are affected. Some linked the VIN number to an email address or location. This might seem trivial. After all, this identification number is directly visible on many cars. But when combined with an email address, name, or geographical location, it can be used to precisely associate a car with its owner.
Researchers believe this type of information can then be cross-referenced with other digital profiles created by companies specializing in advertising or data brokerage. And that’s where problems start to arise...
Among the identified recipients are several major players in the digital industry. Consumer Reports specifically mentions Alphabet (Google’s parent company), Amazon, Meta, Microsoft, Pinterest, and Reddit. This doesn’t mean all these companies systematically obtain a driver’s exact location or driving habits. Some simply provide tools, cloud services, advertising platforms, or software used by automakers.
That’s the whole difficulty of this issue... A car’s digital ecosystem has become extremely complex. The same technology group can provide an automaker with computing infrastructure while also offering tools for measuring audience size or advertising performance. Brands surveyed by Consumer Reports note that some data exchanges may originate from web pages opened through apps, using cookies or tracking tools integrated by third-party companies.
The behavior of the Tesla Model 3 is questionable
When it comes to the cars themselves, the differences are striking. The Tesla Model 3 far exceeds all other tested models. And for once, this first place isn’t a compliment... Researchers identified 34 domains related to advertising, tracking, or data analysis, in addition to 45 other third-party domains.
Behind them is the Tesla Cybertruck with 23 domains related to advertising or tracking, followed by the Cadillac Lyriq with 10 and the Lucid Air with 9. Once again, these figures should be interpreted with caution. A high number of connections does not necessarily mean that one vehicle “collects” more personal data than another. It simply indicates that it communicates with more domains classified by researchers as advertising, tracking, or analytics.
What about French drivers?
The tests were conducted in the United States. Therefore, the results cannot be applied directly to vehicles sold in France. The connected services, applications, or servers used may vary by region. Most importantly, manufacturers in Europe must comply with GDPR, which regulates the collection and use of personal data.
Several of the cars tested are indeed available here. These include the Tesla Model 3, Cadillac Lyriq, Fiat 500e, Subaru Solterra, Nissan Ariya, and Mercedes EQS. The Volvo C40, now renamed EC40, is also part of the lineup. Cadillac officially sells the Lyriq in France today, while Lucid is preparing to bring its Air model to our market.
This study at least has the merit of reminding us of one thing: with the widespread adoption of connected services, privacy issues are no longer limited to our computers or smartphones. They have also entered our cars. Here is the ranking of the electric vehicles studied that are relevant to the French market:
