This study looks at how and with whom connected cars share your data

这项研究揭示了联网汽车如何以及与谁共享您的数据

In news that should surprise very few, connected cars remain a complete privacy nightmare. But now we have a better idea of what data those cars are giving away, and to whom, thanks to a study conducted by a team of researchers at Northeastern University and Consumer Reports. 不出所料，联网汽车依然是一场彻头彻尾的隐私噩梦。但多亏了东北大学和《消费者报告》研究团队的一项研究，我们现在更清楚这些汽车究竟泄露了什么数据，以及泄露给了谁。

Testing 21 cars from 19 different brands revealed patterns of traffic to advertisers and trackers, as well as data shared with Big Tech firms like Microsoft and Adobe. And using a car’s companion app can multiply the problem, their testing found. 通过对来自 19 个不同品牌的 21 款车型进行测试，研究人员揭示了车辆向广告商和追踪器发送流量的模式，以及与微软 (Microsoft) 和 Adobe 等大型科技公司共享数据的情况。测试还发现，使用汽车的配套应用程序会加剧这一问题。

In 2023, the Mozilla Foundation published a widely covered report looking at the privacy policies of more than two dozen automakers. They were appalled, writing that “cars are the worst product category we have ever reviewed for privacy.” But that analysis was conducted by sitting down and reading all the various privacy policies of each brand; today’s study involved measuring traffic from actual cars under a number of scenarios, including idling and being driven. 2023 年，Mozilla 基金会发布了一份广受关注的报告，审视了二十多家汽车制造商的隐私政策。他们感到震惊，并写道：“汽车是我们评估过的隐私保护最差的产品类别。”但那份分析是通过阅读各品牌的隐私政策得出的；而今天这项研究则是通过测量实际车辆在怠速和行驶等多种场景下的网络流量得出的。

The researchers even parked 11 cars—just the electric ones—in a Faraday tent to see if the loss of a cellular signal would push that traffic to the car’s Wi-Fi connection instead. Attempts to actually see what was in the data packets using modified certificates failed in every case. But “the network traces still yielded valuable information, including the domains contacted via DNS traffic, Server Name Indication (SNI) in TLS handshakes, the volume and timing of transmissions, and differences in behavior across experimental scenarios,” they found. 研究人员甚至将 11 辆电动汽车停放在法拉第笼中，以观察在失去蜂窝信号的情况下，流量是否会转移到汽车的 Wi-Fi 连接上。尽管尝试使用修改后的证书查看数据包内容的努力均告失败，但他们发现：“网络追踪记录仍提供了有价值的信息，包括通过 DNS 流量联系的域名、TLS 握手中的服务器名称指示 (SNI)、传输的流量大小和时间，以及不同实验场景下的行为差异。”

All of the cars contacted a first-party domain (i.e., the OEM)—after all, all the cars tested were connected cars and that means connecting to something. And a few left it there—the Buick Envista and Mercedes-Benz EQS didn’t appear to reach out to anywhere else, for example. Others were far more promiscuous, with Tesla topping the chart: The Model 3 contacted 34 advertising, tracking, and analytic domains, as well as 37 domains from apps integrated into the infotainment system. 所有车辆都联系了第一方域名（即原始设备制造商 OEM）——毕竟，所有测试车辆都是联网汽车，这意味着它们必须连接到某些东西。有些车仅限于此，例如别克 Envista 和梅赛德斯-奔驰 EQS 似乎没有联系其他地方。而其他车辆则要“开放”得多，其中特斯拉位居榜首：Model 3 联系了 34 个广告、追踪和分析域名，以及 37 个集成在信息娱乐系统中的应用程序域名。

Alphabet’s domains were the most frequently contacted—again not enormously surprising given the penetration of its Android Automotive OS into the sector. “But many of the [second-level domains] we observed were not necessary for core services (e.g., doubleclick.net and googlesyndication.com, which are used for advertising purposes),” the authors wrote. Media streaming—Spotify, Sirius XM, and so on—is well represented, as are mapping companies like HERE, TomTom, and Mapbox. Alphabet（谷歌母公司）的域名是被联系最频繁的——考虑到其 Android Automotive 操作系统在汽车行业的渗透率，这并不令人意外。作者写道：“但我们观察到的许多（二级域名）对于核心服务来说并非必要（例如用于广告目的的 doubleclick.net 和 googlesyndication.com）。”媒体流媒体服务（如 Spotify、Sirius XM 等）以及 HERE、TomTom 和 Mapbox 等地图公司也大量出现在联系名单中。

Using a car’s infotainment system resulted in it contacting the most domains, versus just sitting idle or driving for all the cars tested—apart from the Tesla Cybertruck, that is, which instead contacts 26 more third-party domains while driving than stationary. Because of exhaust fumes, it was only safe to test electric vehicles in the Faraday tent. Cut off from a cellular signal, some of the EVs—including the Cadillac Lyriq, Chevrolet Blazer, Honda Prologue, and Rivian R1S—simply stop using those connected subsystems. But some of the cars tested redirected their traffic to Wi-Fi, allowing the researchers to see traffic flows that were previously unobservable. 对于所有测试车辆而言，使用信息娱乐系统会导致其联系最多的域名，这比车辆怠速或行驶时的情况要多——特斯拉 Cybertruck 除外，它在行驶时联系的第三方域名比静止时多出 26 个。由于废气排放问题，在法拉第笼中测试仅限于电动汽车。在切断蜂窝信号后，一些电动汽车（包括凯迪拉克 Lyriq、雪佛兰 Blazer、本田 Prologue 和 Rivian R1S）直接停止使用这些联网子系统。但一些测试车辆将流量重定向到了 Wi-Fi，使研究人员能够观察到此前无法监测到的流量流向。

Next, they tested 30 different connected car apps, which in some cases exposed users to more than 20 new advertising, tracking, and analytics companies—General Motors, Toyota, and Nissan were the worst offenders. The authors reached out to 17 of the automakers (Fisker had already gone under) and heard back from 14. The replies are not entirely encouraging. 接下来，他们测试了 30 款不同的联网汽车应用程序，在某些情况下，这些应用将用户暴露给了 20 多家新的广告、追踪和分析公司——通用汽车、丰田和日产的表现最差。作者联系了 17 家汽车制造商（Fisker 已倒闭），并收到了 14 家的回应。这些回复并不令人乐观。

All the OEMs told the researchers that the data-sharing with third parties was covered by contracts prohibiting the use of PII outside the scope of their privacy agreements—the same privacy agreements that horrified the Mozilla Foundation in 2023. Some of the automakers also deflected blame onto the embedded browser running inside the infotainment system and said it was up to users to select the right prompt when asked to accept or reject a cookie. 所有 OEM 都告诉研究人员，与第三方的共享数据受到合同约束，禁止在隐私协议范围之外使用个人身份信息 (PII)——而正是这些隐私协议在 2023 年让 Mozilla 基金会感到震惊。一些汽车制造商还将责任推卸给信息娱乐系统内运行的嵌入式浏览器，并表示当被要求接受或拒绝 Cookie 时，用户有责任选择正确的提示。

And seven said that it’s the consumer’s responsibility to read and accept all of the terms and conditions for all the connected services, even though in many cases the software is already installed on the car. And as the authors note, declining a data-sharing agreement can result in a loss of services and functionality—not a great solution if it means losing useful features you expected to work when you bought the car. However, there was at least one positive outcome: after being contacted, Honda changed its data practices and no longer shares precise location data with at least one tracking company. 有七家厂商表示，消费者有责任阅读并接受所有联网服务的所有条款和条件，尽管在许多情况下，这些软件在车辆出厂时就已经安装好了。正如作者所指出的，拒绝数据共享协议可能会导致服务和功能丧失——如果这意味着失去您在购车时期望使用的有用功能，这并不是一个好的解决方案。不过，至少有一个积极的结果：在被联系后，本田改变了其数据处理方式，不再与至少一家追踪公司共享精确的地理位置数据。