The Hidden Tracking Risk Inside Your Tires

The tire pressure monitoring system (TPMS) was introduced as a safety feature, alerting drivers to low pressure. Recent research from Spain’s IMDEA institute revealed a hidden privacy flaw: the sensors broadcast unencrypted radio packets that uniquely identify each vehicle. Over a ten‑week study the team collected roughly six million wireless signals from more than 20,000 cars, with a detection range of about 50 meters. The data includes tire pressure, vehicle model, weight, and even driving patterns. Because a $100‑range receiver can capture these packets, anyone with modest equipment can monitor a car’s movements.

This capability turns a mundane safety component into a covert tracking tool. Unlike a visible license plate, the TPMS identifier is constantly emitted, making it comparable to automatic number‑plate recognition but without the need for cameras. The lack of a universal encryption protocol—each manufacturer uses its own proprietary format—means the static IDs can be correlated across time and location, exposing drivers to profiling by advertisers, criminals, or nation‑state actors. The researchers argue that the privacy risk is amplified in areas lacking CCTV coverage, where tire‑sensor sniffers become the primary source of location data.

Addressing the flaw requires a shift toward security‑by‑design in automotive standards. Experts suggest rotating identifiers or lightweight cryptographic handshakes that change each transmission, solutions that modern low‑cost microcontrollers can support without significantly raising sensor price. Regulatory bodies could mandate encrypted TPMS protocols, similar to recent mandates for vehicle‑to‑infrastructure communication. For consumers, short‑term mitigations include disabling the system—though this triggers dashboard warnings—or adding false‑signal devices, both of which are inconvenient. Ultimately, industry‑wide threat modeling and cost‑benefit analysis will determine whether manufacturers invest in secure TPMS chips, protecting privacy without compromising safety.