A safety feature found in most modern cars could also be quietly exposing drivers to tracking, according to new research from the IMDEA Networks Institute and European partners.
The study shows that tire pressure sensors—designed to prevent accidents—may unintentionally allow vehicles to be identified and followed over time.
Most cars today include a Tire Pressure Monitoring System (TPMS), which alerts drivers when a tire is low on air.
These systems use small sensors inside each wheel that wirelessly send pressure readings to the car’s computer.
TPMS has saved lives by helping drivers avoid dangerous blowouts and poor fuel efficiency.
But the researchers discovered that these sensors also transmit a unique identification number, and they do so using unencrypted radio signals.
Because the signals are not protected, anyone nearby with a simple radio receiver could capture them. Unlike cameras, which need a clear view of a license plate, radio signals can pass through walls, vehicles, and other obstacles.
This means hidden receivers placed near roads or parking areas could detect a car’s tire sensors even when the vehicle is out of sight.
To understand how serious the risk might be, the research team set up a network of low-cost receivers over a ten-week period. Each receiver cost about $100. Together, they collected more than six million messages from over 20,000 vehicles. By analyzing the unique IDs sent by the sensors, the team could recognize the same cars when they passed by again and map their movement patterns.
The researchers also developed techniques to link signals coming from all four tires on a vehicle, which improved their ability to identify specific cars. In many cases, they could detect signals from more than 50 meters away, including from cars inside buildings or behind obstacles. The data could reveal daily routines, such as when someone leaves home, arrives at work, or visits certain locations.
The signals also contain tire pressure information, which might hint at the type of vehicle or whether it is carrying heavy loads. This could allow even more detailed surveillance.
The scientists warn that current vehicle cybersecurity rules do not specifically address this issue. TPMS was built with safety in mind, not privacy or security. Without encryption or authentication, the sensors remain vulnerable to misuse.
As cars become more connected and filled with wireless technology, the researchers say manufacturers and regulators need to act. Safety features should not become tools for tracking people without their knowledge.
Strengthening security in future vehicle systems could help ensure that technologies designed to protect drivers do not also compromise their privacy.
