The broad safety mandate has inadvertently created a massive privacy loophole, allowing anyone with inexpensive radio equipment to track vehicle movement patterns.
Researchers at the IMDEA Networks Institute have discovered a major privacy flaw in modern cars. A recent 10-week study revealed that the tire pressure monitoring system, a mandatory safety feature in many areas since the late 2000s, broadcasts unencrypted signals that can be intercepted to track vehicle movements in real time. Because these sensors transmit a permanent, unique plaintext identifier to alert the car’s computer of low tire pressure, third parties can easily pick up these radio waves.
Unlike traditional camera-based surveillance that requires a direct line of sight, these automatic tire sensor signals pass through walls and other vehicles. This allows small, hidden radio receivers — which may cost as little as $100 each — to pick up data from moving cars at distances exceeding 50 meters (164 feet).
During field measurements, the research team collected more than six million messages from more than 20,000 vehicles. By matching signals from the four tires, a network of these low-cost receivers can systematically infer highly sensitive information, including the driver’s daily schedule, vehicle type, and even the weight of the goods being transported.
The findings – detailed in a paper accepted at the 2026 IEEE WONS conference – highlight a glaring gap in current vehicle cybersecurity regulations. Researchers say that because monitoring systems were originally designed exclusively for safety and not security, the lack of basic authentication leaves drivers vulnerable to widespread passive surveillance. As a result, researchers strongly urge policymakers and automakers to impose strict privacy-focused measures in future vehicle structures to prevent routine safety systems from being weaponized.
