Automatic Transmission – a data-privacy study of connected vehicles
- ID
- 31188
- Status
- summarized
- Published
- 02 Oct 2026, 4:23 AM
- Fetched
- 02 Oct 2026, 11:50 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://automatictransmission.khoury.northeastern.edu/index.html
- Source URL
- https://hnrss.org/best
Summary
- Score
- 5.5
- Created
- 02 Oct 2026, 11:51 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Northeastern University researchers, working with Consumer Reports, ran what they describe as the first large-scale measurement study of the connected-vehicle ecosystem, testing 21 late-model vehicles across 19 brands plus 30 companion mobile apps. They found 19 of 21 vehicles contacted at least one third party over Wi-Fi, 7 of 30 apps transmitted PII to trackers, and 5 of 30 sent VIN plus other PII to trackers. Consumer Reports supplied the vehicle fleet, which the team says would have cost over $1.2M to assemble independently; the peer-reviewed paper lands at IMC '26, and the Hacker News thread drew 233 points and 195 comments.
Why it matters
The number to act on is 7 of 30: roughly a quarter of the tested companion apps leaked personal data to third-party trackers without it being an obvious product feature, and 5 leaked the VIN itself. If you ship a mobile app with analytics, attribution, or ad SDKs, this is a concrete reason to capture your app's outbound traffic and check what identifiers those SDKs attach — a VIN or device identifier leaving your app is a compliance problem you inherit, not one the SDK vendor absorbs. There is no Malaysia-specific finding in the text, so local relevance is indirect: anyone building insurtech, fleet, or vehicle-adjacent apps should treat third-party SDK data flows as part of their own privacy surface.
Discussion angle
Open your app's network inspector or a proxy and list every third-party domain it hits on launch — then argue over which of those SDKs are actually load-bearing versus which ones you could delete this week.