You know how your phone's flashlight app asks for access to your contacts, microphone, and location — and you tap 'Allow' because the alternative is no flashlight? Your car does the same thing, except the flashlight costs $50,000 and you can't uninstall the spyware. That's the core mechanism this paper measures: a captive consumer attached to a device that phones home constantly, with no realistic opt-out that doesn't degrade the product you already paid for. The committed claim: this is the first large-scale empirical measurement of the connected-vehicle data ecosystem, covering both the vehicles themselves and their companion mobile apps. Researchers at Northeastern University, partnering with Consumer Reports to access a $1.2M fleet of 21 late-model vehicles across 19 brands, intercepted Wi-Fi traffic from the cars and decrypted HTTPS traffic from 30 companion apps via mitmproxy. They found that 19 of 21 vehicles contacted at least one third-party domain associated with advertising or tracking during routine operation — idle, active use, and driving. Seven of 30 companion apps transmitted sensitive personally identifiable information (VINs, emails, phone numbers, precise GPS coordinates) directly to third-party trackers. Five of those seven sent VINs bundled with other PII, enabling cross-referencing that lets advertisers build granular profiles linking a specific vehicle to a specific human's movement patterns. The architecture is straightforward network measurement, not machine learning or novel algorithms. The team set up a Raspberry Pi as a custom Wi-Fi access point running tcpdump to log all packet destinations from vehicles. For apps, they used iPhones with custom root certificates connected to mitmproxy to decrypt HTTPS traffic. A Faraday tent providing ~93 dB attenuation blocked cellular signals on 11 EVs to test whether cars would reroute cellular traffic to Wi-Fi when cellular was unavailable. This is classic internet-measurement methodology — the kind used to study web trackers and mobile SDKs — applied for the first time at scale to vehicles. The controlled environment (Consumer Reports' test facility) and systematic protocol (idle baseline, active test, driving test at 5-45 mph with acceleration and hard braking) give the results more structure than a one-off teardown. The ladder here isn't about beating a prior benchmark — it's about establishing a baseline where none existed. Previous work on connected-vehicle privacy was limited to policy analysis, privacy-policy audits, or small ad-hoc tests. This is the first study that systematically intercepts actual network traffic from a fleet-scale sample and cross-references vehicle behavior with companion-app behavior. The finding that pairing a companion app roughly doubles a vehicle's exposure to advertising and tracking companies — and in some cases adds 20+ new trackers — is a genuinely new empirical fact. No prior study had this number. Integrity is solid for a measurement study, with important caveats the authors acknowledge. The sample is 21 vehicles from the U.S. market — broad but not exhaustive. Results are explicitly described as a snapshot in time. The Wi-Fi intercept captures destinations but not payload content (encrypted), so the researchers can confirm that cars talk to ad-tech domains but can't always prove what data is in the packets. The app-side analysis is stronger because mitmproxy decrypts the traffic, revealing exact PII being transmitted. The team went through a lengthy disclosure process with manufacturers; the responses — uniformly shifting blame to consumers — are documented. Honda stands out as the only manufacturer that actually changed its behavior, stopping the transmission of precise geolocation to a third-party tracker. The manufacturer responses reveal the structural trap. Consumers face three options: accept pervasive data sharing, disable connected features (losing remote start, the app, OTA updates), or stop using the vehicle entirely. This is not a market where informed consent operates meaningfully. The 'choice' is architecturally coerced. The paper is peer-reviewed and will appear at IMC '26 (Internet Measurement Conference), one of the top venues for this kind of empirical network research. What makes this study matter beyond its immediate findings is the demonstration that vehicles are now part of the same surveillance-advertising ecosystem as phones and browsers — but with even less consumer visibility and fewer tools for resistance. There is no AdBlock for your Cybertruck. The connected-vehicle ecosystem is where mobile advertising was circa 2012: opaque, unregulated, and growing fast, with 75% of vehicles sold globally now shipping with built-in connectivity.
