Tire Sensors Meant To Prevent Blowouts May Also Be Broadcasting Drivers’ Private Routines

Every morning, a worker pulls into the office parking lot at 8 a.m. sharp. Every afternoon, they leave at noon. On Day 12, they slipped out for a lunch break that lasted about an hour. They never show up on Fridays, probably working from home. On two evenings, they swung by a nearby university for a class, taking a route past the workplace on the way home.

Nobody told researchers any of this. The tires did, or at least, that’s what the signal data suggested.

To be clear, researchers never confirmed who these drivers were or verified their actual routines. What they captured were timing patterns in wireless signals, patterns consistent with the schedules described above. But that’s exactly the point.

A team of scientists from institutions across Europe recently showed that the tire pressure sensors built into nearly every modern car are quietly leaking enough information to let anyone piece together detailed movement patterns of individual drivers, from their work schedules to their lunch breaks to their evening errands. The equipment needed to pull this off costs about $100 per listening station, runs on free software available online, and can be hidden indoors with no direct view of the road.

The weak link is a piece of car technology almost no driver thinks about: the Tire Pressure Monitoring System, or TPMS. Required by law in countries around the world, these small battery-powered sensors sit inside each tire and wirelessly send pressure readings to the car’s onboard computer. Most of these sensors transmit their data with no encryption, in plain text, and each one carries a unique ID code that never changes for the life of the tire. That means anyone with cheap radio equipment can silently capture those signals, link them to a specific vehicle, and start building a profile of where that car goes and when.

How Tire Pressure Sensors Become Tracking Devices

To test just how much information these tire signals give away, the researchers set up five low-cost radio receivers around the perimeter of a workplace, positioning them indoors near windows. The receivers were built from inexpensive parts: a small radio dongle connected to a tiny, credit-card-sized computer. The entire covered area was roughly the size of a football field, about 100 by 50 meters.

Over 10 weeks, this modest setup captured more than 6 million tire pressure messages from what the researchers estimated to be at least 20,000 vehicles passing through the area. From that flood of data, the team focused their detailed analysis on 12 cars whose owners had volunteered to participate, allowing the researchers to verify which sensor codes belonged to which vehicle.

Before getting into the tracking analysis, the team first needed to confirm that their cheap equipment could actually pick up these faint tire signals reliably. They tested reception at seven outdoor positions stretching out to about 55 meters from a test car. At every position, they successfully received all messages with strong signal quality. When they moved a receiver inside a building with no nearby windows, completely hidden from view, they still captured and decoded tire messages from three out of four test locations. For moving vehicles traveling at speeds up to about 30 mph, the system successfully picked up transmissions on 9 out of 10 laps around a one-kilometer circuit, averaging about 3.5 messages per pass.

How Scattered Tire Signals Get Linked to One Car

One of the cleverest parts of the research involved figuring out which tire signals belong to the same car. Each vehicle has four tires, and each tire broadcasts independently with its own unique code. A single tire’s signal might only be captured about 40 percent of the time a car passes by, meaning that relying on just one sensor would miss most of a vehicle’s appearances. By linking all four tire codes together, the researchers could build a much fuller picture.

The team measured how often two signals appear in the same brief time window. If two tire codes consistently show up within about a minute of each other, they almost certainly belong to the same car. This approach correctly identified all 12 verified cars in their dataset, grouping the right four tire codes together for each vehicle. The researchers also noticed that tire codes from the same car often share several digits, providing an additional clue for matching.

This matching step transforms scattered, incomplete data points into a consistent tracking record. Without it, an eavesdropper would only catch fragments. With it, they get a remarkably detailed diary.

What the Tire Data Revealed About Drivers’ Lives

Once the tire codes were matched to specific vehicles, clear patterns emerged. Keep in mind that the researchers did not have confirmed identities or verified routines for any of these drivers: the profiles below are inferences drawn from signal timing, not documented facts about real individuals.

With that caveat in place, the patterns were telling. Researchers identified four distinct driver profiles simply by looking at when each car’s tire signals appeared and disappeared.

One car belonged to what appeared to be a full-time worker, arriving consistently at 8 a.m. during the week and always leaving at 5 p.m. On one particular day, the car briefly vanished around lunchtime and reappeared about an hour later, suggesting the driver went out to eat. This car was never seen on Fridays, suggesting the owner works remotely that day. From tire signals alone, the researchers could piece together patterns consistent with both in-person and remote work schedules.

A part-time worker’s car showed a different rhythm: arriving at 8 a.m. but leaving at noon. On two separate evenings, including one when the workplace was closed for a holiday, the system picked up the car passing on a nearby road, consistent with the driver attending evening university classes. These signals were captured from a road next to the setup, not just from the parking lot, showing how even a small network of receivers can monitor broader movement.

A third profile matched an outside collaborator who visited the workplace on an irregular schedule. The car appeared on some days but vanished for stretches at a time, consistent with someone who works at multiple locations or travels frequently. In the final week of the study, the car disappeared entirely, matching a longer trip. A fourth car belonged to another outside part-time worker with a shorter, less predictable schedule.

Beyond schedules, the researchers could also pull information from the pressure readings themselves. Tire pressure can hint at the general size and type of vehicle, since larger SUVs and trucks tend to run at higher pressures. For one car, the team observed a noticeable pressure drop in the front tires, followed by a sudden increase on Day 13, indicating the driver had noticed the problem and inflated them. In theory, pressure data from trucks could even reveal changes in cargo weight, information that could be useful to criminals planning a theft.

The researchers also noted differences among car brands. Sensors used by Toyota tended to transmit continuously, even when parked. Ford and Nissan sensors transmitted less regularly. Renault sensors only transmitted when the wheels were actually moving. These differences meant some cars were easier to track than others, but all were trackable to some degree.

A Regulatory Blind Spot for Tire Pressure Monitoring

What makes this research particularly urgent is the gap it exposes in current vehicle cybersecurity rules. In 2022, 54 countries, including all European Union nations, approved new rules requiring cars to carry a cybersecurity certificate before they can be sold. These regulations address threats to vehicle data like identity and location information. Yet tire pressure monitoring systems are not covered in this certification process, despite broadcasting unique IDs in the open over public airwaves.

The researchers outline a troubling scenario: a bad actor or data-mining company could deploy a network of hidden receivers and silently catalog the movements of thousands of cars. The study itself was conducted in a single small area roughly the size of a football field, but the authors argue the approach could theoretically be scaled across larger areas, though that broader deployment was not tested. Unlike camera-based surveillance, this approach requires no direct line of sight, and the equipment can be tucked away inside buildings. Burglars could monitor a neighborhood’s cars to learn when households are empty. More sophisticated attackers could combine passive tracking with active signal tricks, like faking a flat tire alert to force a truck to stop, then stealing its cargo.

Some researchers have proposed adding encryption to tire pressure sensors or redesigning them entirely, but the study’s authors could not find evidence that any manufacturer has actually adopted these fixes. A newer system using Bluetooth technology has been proposed by major tire and electronics companies, but it is aimed at high-end and racing vehicles and is unlikely to reach everyday cars anytime soon.

A safety feature present in virtually every car on the road today is functioning as an unintentional tracking beacon, one that drivers cannot turn off, cannot control, and almost certainly do not know about. At $100 per receiver and with free software available to anyone, the barrier to exploiting this weakness is disturbingly low. The researchers’ message to lawmakers, regulators, and car manufacturers is blunt: the tire pressure monitoring system needs to be redesigned with privacy in mind, and it needs to happen before someone with worse intentions builds the same setup for far less noble purposes.

---

Disclaimer: This article is based on findings from an academic research study. The behavioral patterns described were inferred from wireless signal timing data and were not verified against confirmed driver identities or actual routines. The study’s detailed tracking analysis involved 12 volunteer participants at a single location and may not reflect outcomes across all vehicle types, sensor brands, or geographic settings.

---