Automatic Transmission – a data-privacy study of connected vehicles - https://news.ycombinator.com/item?id=49926628 - Oct 2026 (230 comments)
(Normally we'd merge the threads but after 2 days it would mess up the comment rankings.)
They played around with the infotainment of the car for 30 minutes, when it has for example a YouTube app, they opened it. When the car talked to YouTube over Wifi they counted it as one ATA (Advertising, Tracking, and Analytics).
When you have less apps in the car, or all data is tunneled trough the car manufacturer it results in less ATA and therefore a better score.
The paper says this:
> 2. Stationary Active: The vehicle was parked and powered on for 30 minutes while we interacted with as many sensors and features as possible. This included opening and closing doors and the trunk, pressing dashboard and seat controls, activating stalks (lights, wipers), and exploring all infotainment menus and apps. https://automatictransmission.khoury.northeastern.edu/paper....
Their repository has the classification of vendors here: https://github.com/nicolegerzon813/Automatic-Transmission-An...
It would be nice to have know which domains were accessed by which car. Even better would be to know which action in the car correlated with which connection.
1. I should not have to authenticate or have connectivity to a manufacturer unless I want to once I've paid for a physical good(cars being physical goods).
2. I don't want my personal data to be sold off to anyone - I've been in the tech industry for long enough to know that "I don't want my data to be shared with third parties" is worth as much as the power used to light up the pixels on the screen.
3. I don't trust anyone to have done everything carefully and by the books to prevent any potential leaks.
Much of my 80s model pickup can be disassembled with a basic set of screwdrivers and wrenches. If my Chevy Volt bricks because the battery has an aging cell, it has to be towed to Chevy to pay $200 for them to turn of a software alert and allow it to charge.
I do like electric vehicles but its insane how absolutely terrible they are when it comes time to work on them.
In a first gen Chevy Volt that's not possible, the computer and screens are so integrated with OnStar that physically disconnecting it leaves the car effectively useless.
If you'd asked in 2010, well yeah, just pull the fuse for the modem and done. since all it does is a little bit of connectivity and there's nothing else useful from the, from that, I wouldn't care. But now connectivity has useful parts, that I don't want to lose.
Yours does this via data? Most cars do this with a camera.
For example, my car's vision based system always shows the limit on a school zone speed limit sign, even when it is not in effect. It also fails to read speed limits which are posted on signs it wasn't trained on, like digital signage.
And map based systems e.g. smartphone maps are often wrong in work zones, and areas with variable speed limits.
I would love new open source cars by the way, that would be really cool
You generally have to completely remove the power from the DCU - which can have as many as three different power sources (including a backup battery with days of power in some cases!), and often disables features in your car like the hands free microphone, built in gps, etc.
1790695765 | Car's data privacy problems are worse than you think | https://www.theverge.com/transportation/1001463/car-data-pri... | https://news.ycombinator.com/item?id=49895015 | 1 comment
1790707497 | Car Is Sharing Data with Big Tech | https://www.consumerreports.org/electronics/personal-informa... | https://news.ycombinator.com/item?id=49898395 | 1 comment
1790886207 | Automatic Transmission a data-privacy study of connected vehicles | https://automatictransmission.khoury.northeastern.edu/index.... | https://news.ycombinator.com/item?id=49926628 | 219 comments
1790886283 | 19 Out of 21 Late-Model Cars Tested Shared Data with 3rd Parties | https://www.roadandtrack.com/news/a73941763/personal-data-ve... | https://news.ycombinator.com/item?id=49926641 | 1 comment
1790928399 | Cars Are Sharing Data with Big Tech Companies, Study Finds | https://www.consumerreports.org/electronics/personal-informa... | https://news.ycombinator.com/item?id=49931034 | 0 comments o
The best thing you can do is avoid products with trackers while they haven't taken over their entire market, learn to disable GPS, wireless, and cellular antennae once they do, and pray manufacturers take a while to insert dead-man switches as well.
strong disagree, this is complicit and defeatist nonsense given +100 years of active and successful consumer rights protection in lawful markets in the West.
You must agree to monitoring, otherwise they won't give you insurance.
One thing i don’t understand is how pro-surveillance advocates don’t understand that the moment they are not behind the terminal, they are the target.
Pro-surveillance people were not born one fine day. They were conditioned for a decade making them believe sharing everything about their life is normal.
"What's on your mind?"
Except for those in power, of course.
Despite this I do have hope for the current gen who seems more aware.
https://www.nbcchicago.com/news/local/police-say-license-pla...
https://www.alxnow.com/2026/10/02/license-plate-reader-helpe...
https://www.bakersfield.com/news/bpd-credits-automated-licen...
https://www.kcrg.com/2026/09/17/how-license-plate-readers-he...
https://turnto10.com/news/local/license-plate-cameras-help-s...
https://www.krqe.com/news/albuquerque-metro/albuquerque-poli...
I remember being shocked, about 10 years ago, when I mentioned social network spying and my sister in law remarked she thought there should be more of it to keep people inline.
I've also met people who think all internet access should be through government sanctioned id and monitoring, which I also find shocking.
I haven't been able to pin this down to a single political view point, these people come from across the spectrum.
If you live surrounded by people who will hurt you, steal your stuff, or act in reckless ways if they think no one is watching; then pro-surveillance sounds more appealing.
If instead you feel that the people around you will behave even if no one is watching them; then privacy concerns take precedence.
I also don't want surveillance to protect me though. Its my job to protect myself, and ideally to be part of a community that looks out for each other. It isn't the governments responsibility to protect me if said protection comes at the expense of my own freedoms.
I don't want to be a rat in a cage just so I can feel safe.
Authoritarianism as a second axis is interesting, though I don't know what the opposite would be. Communism, the actual idea with effectively no one in charge? If so, in practice those extremes seem to end up in the same place, one or a few people in charge of everyone else with a very tight grip on power.
Well that's for sure. In the US I don't see the Democratic as liberal, nor the Republican party as conservative based on policies they promote.
they may not be asking for it.. but once you make it a yes/no question and the public has to decide, they will support it blindly
People can choose whatever they want, my goal isn't to make people want more privacy. I rarely talk about privacy issues with someone and hear them agree or be concerned enough to think twice, they tend to just laugh it off when they talk about something and then immediately see ads for it.
I do want police to be able to investigate potential crimes that our society collectively agreed we don't want to happen. I don't want to give up my rights to privacy, protections against search and seizure, etc.
The two former terms are political in nature because they don't accurately describe what they are supporting and instead attempt to put lipstick on a pig, as it were. Sure you could argue that "pro surveillance" is political, and technically any term can be made political, but it does describe the actions being promoted.
Larry Ellison? Alex Karp?
Ad Googlers: Who was the guy sitting next to Trump and Musk lately? The title AI Zar goes to whom exactly?
As soon as you'll put out a concrete proposal, you'll get massacred for being "anti business".
You can find a ton of urbanites/suburbanites who want surveillance to ticket speeders, reckless driving, loud exhausts, etc. And they're out buying Ring cameras and alarm systems because they're worried about house/car break-ins and theft.
And if you take a radical online urbanite leftist and start talking about right-wingers sending rape and death threats to women/minorities, and the kind of online communities that breed those kinds of people, you will likely find sudden enthusiasm for surveillance.
I think it's three things; (a) They're just being paid not to care, (b) short-termism, and (c) are naively hoping they get to stay in the club on the other end of the surveillance. Hard to convince nearly anyone to give up short term profit for long term societal benefits.
Cynically I worry we are seeing the decline of democracy and our new overlords are seeing that too (many accelerating it). Surveillance is necessary for control. The AI, mass surveillance, and drone combination is getting pretty scary TBH.
It would be like creating an always present omnipotent God.
The issue with privacy violations isn't how it is being used today, its how it may be used later and the precedent it sets for future invasions of privacy.
that would create hell on earth.
The people whose job to do this are the police, and it should not be delegated in this dystopian way, let alone by your own possessions.
Fast forward to today: getting access to the canbus (e.g. via headlights) allow you to steal the car: https://www.theregister.com/security/2023/04/06/how-thieves-...
Given the integration of these modules, is it that weird that you could send signals the other way?
No, but there are simple solutions to this: a firewall, which is how this has been fixed on some cars.
Why would it be shocking?
It would be shocking if it weren't possible. Being a car does not confer any sort of magical protection against hacking because "it's just a car" or something.
Their point is that relying on consumer privacy groups to foot the bill for data collection is hard and we (at citizens) are owed transparency from auto manufacturers
Our three family vehicles are 2016, 2016, and 2007. Somehow we live without built-in nav, CarPlay, and hundreds of square inches of screen space. At the rate things are going, I’ll probably live out my life without getting anywhere close to a new vehicle.
Think about it please, everyone. Do you need this stuff? Really need it?
I think I squeezed a few more years out of my girls Camry by adding a backup camera for her. Not too expensive, $150 bucks maybe…
May you beat your beater for many miles!
I'm still clarifying the purpose of this before making a complaint to the data authority.
I don't want a lit-up screen in the car.
I was pleased to that you can use the navigation with a data collection opt-out. I was less pleased to see that they sneaked a "safety and maintenance" clause into the terms. The information they gather for that gets shared with insurance companies, social networks and data brokers.
There's no hiding in modern car it seems. I was hoping for better from a French company operating under GDPR but no.
You can't win, with all the car companies pulling this crap it's like fighting a surveillance cartel.
The only thing to do is keep my old car for as long as possible.
Of course to enforce it you would need to complain to regulator in your country who then likely just tells them to stop it and that decision becomes effective years later after appeals. Many countries don't even fines for ePD violations.
Do you hear yourself?
99.99999904% of roads don't change that much.
People used to navigate with decade-old paper maps stuffed in their glove boxes and nobody died because of it.
The few times when I found myself driving on I-11, which my car didn't know about, it was a novelty, not a crisis. I didn't drive off the road because the screen told me the road didn't exist. I used common sense and followed the signs.
They just want to be able to connect their phone and have their music/video available and think that because they are “not doing anything wrong” they don’t “have anything to fear”
I’m glad this site exists so I can just send it to people directly
>Cybersecurity experts hack and take remote control of SUV (2015)
You really need to look up the car and a lot of people sell replacement harnesses to terminate the built-in modems with resistors.
Sometimes if you hit the sweet spot, the car has a built in modem but its on 3G or EDGE networks that have been dismantled. There are several Subaru's like this. They no longer can connect to a network or transmit data.
Personally, I'd like to see someone salvage one of these modems and try to reverse engineer it for free Internet. It will probably be low speed and they might be locked to certain hosts, but I bet you could find some way to tunnel traffic on them.
With diesel the price it is, driving a 4.6 litre V8 that runs on propane is like driving a diesel that gets over 45mpg.
Unless your Navigator doesn't have tires, they're still spying on you.
The only way to mitigate that is to not use credit cards in the same place you drive. Especially malls, strip malls, and drive-through restaurants.
It's remarkable to me how many brilliant people here refuse to acknowledge this, believing that a zillion hacks and work-arounds can keep them off the surveillance grid. That ship sailed a long, long time ago.
Implying that payment will stop the tracking is a red herring.