CAREER: Understanding, Measuring, and Mitigating Privacy Risks in the Automotive Ecosystem

Modern vehicles are increasingly becoming networked computers on wheels that collect detailed information about where people go, how they drive, and how they use in-car services. These practices create a major privacy challenge because drivers often cannot tell what data is being collected, who receives it, or how to limit sharing. This project addresses that problem by developing a human-centered approach to automotive privacy that helps people understand and control how their data is used. The project’s novelties are the integration of user-centered behavioral research with large-scale technical measurement of vehicle data practices, and the design of practical tools that make privacy more transparent and actionable. The project's broader significance and importance are advancing trust in connected vehicle technologies, informing consumer protection efforts, and supporting the development of policies and systems that better safeguard personal data. The work also strengthens the cybersecurity workforce by creating privacy-focused learning modules for South Carolina high school students, expanding hands-on research opportunities for undergraduate students, and sharing findings, tools, and educational materials with researchers, industry, and the public. The project studies privacy risks in vehicles that use Android Automotive OS and related third-party applications. It combines interviews, think-aloud studies, and controlled comparison studies to characterize drivers' privacy attitudes, identify manipulative interface designs that steer users toward data sharing, and evaluate privacy-enhancing alternatives. In parallel, the project develops an automated analysis framework that maps what vehicle data applications access, analyzes outgoing encrypted traffic to infer what information is transmitted, and compares observed behavior with privacy policy disclosures to detect inconsistencies. These results inform the design and evaluation of an in-vehicle privacy dashboard that presents data practices in a clear, actionable form for drivers. The project also adapts the analysis framework into a scalable vetting tool for third-party automotive applications. Together, these activities produce methods, datasets, design guidance, and open tools for improving privacy in complex cyber-physical systems. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria. NSF Award ID: 2541570 | Program: 01003031DB NSF RESEARCH & RELATED ACTIVIT,01002930DB NSF RESEARCH & RELATED ACTIVIT,01002627DB NSF RESEARCH & RELATED ACTIVIT | Principal Investigator: Mert Pesé | Institution: Clemson University, CLEMSON, SC | Award Amount: $347,286 View on NSF Award Search: https://www.nsf.gov/awardsearch/show-award/?AWD_ID=2541570 View on Research.gov: https://www.research.gov/awardapi-service/v1/awards/2541570.html