The Safety Sensor in Your Tires Can Track Your Movements for $100 in Equipment

Tire pressure monitoring systems were mandated in Europe and the United States primarily to reduce accidents caused by underinflated tires. They have been standard equipment in new vehicles since the late 2000s. They are also, researchers have now demonstrated, an inexpensive surveillance tool available to anyone with a radio receiver and time to listen.

Researchers at IMDEA Networks Institute, working with European partners, spent ten weeks collecting signals from tire pressure sensors near roads and parking areas. Using a network of low-cost receivers - roughly $100 per unit - they gathered more than six million tire sensor messages from over 20,000 vehicles. The paper has been accepted for publication at IEEE WONS 2026.

The system as designed, and the problem it creates

A tire pressure monitoring system (TPMS) works by placing a small wireless sensor in each wheel. The sensor measures pressure and temperature, then broadcasts that data to the car's onboard computer via a radio signal. When pressure drops below a threshold, the driver sees a warning on the dashboard.

The design that makes this work is also what creates the privacy problem. Each sensor broadcasts a unique ID number as part of every transmission - a fixed identifier that does not change and is sent in clear, unencrypted radio signals. Anyone with a radio receiver tuned to the appropriate frequency can capture those broadcasts. Because the ID is fixed, the same vehicle can be recognized across multiple detection points without ever reading a license plate.

"Our results show that these tire sensor signals can be used to follow vehicles and learn their movement patterns," said Domenico Giustiniano, Research Professor at IMDEA Networks Institute. "This means a network of inexpensive wireless receivers could quietly monitor the patterns of cars in real-world environments. Such information could reveal daily routines, such as work arrival times or travel habits."

What makes this different from camera tracking

Most vehicle tracking in existing surveillance infrastructure relies on cameras. Cameras require line of sight, reasonable lighting, and sufficient image resolution to capture a license plate. They are visible, require infrastructure, and are subject to legal regulation in most jurisdictions.

TPMS-based tracking differs in each of these respects. Tire sensors transmit radio signals that pass through walls and vehicles, meaning receivers do not need direct line of sight to the target. Signals were successfully captured from distances greater than 50 meters, including from positions inside buildings or other concealed locations. The equipment cost per detection point is around $100 - orders of magnitude cheaper than a camera system capable of license plate recognition.

The researchers also developed methods to match signals from all four tires of a single vehicle, allowing more confident recognition even in environments with heavy traffic. TPMS signals carry pressure readings, which may also reveal vehicle type or loading state.

A safety system with no security

"TPMS was designed for safety, not security," said Dr. Yago Lizarribar, who worked on the study at IMDEA Networks and is now a researcher at Armasuisse in Switzerland. "Our findings show the need for manufacturers and regulators to improve protection in future vehicle sensor systems."

Current vehicle cybersecurity regulations do not specifically address TPMS security. The absence of encryption or authentication in tire sensor transmissions leaves a persistent and easily exploitable exposure in place. Technically, solutions exist - rotating IDs that change periodically, encryption of sensor broadcasts, or authentication requirements - but existing sensor hardware has limited processing power and battery life.

"As vehicles become increasingly connected, even safety-oriented sensors like TPMS should be designed with security in mind, since data that appears passive and harmless can become a powerful identifier when collected at scale," added Alessio Scalingi, now an Assistant Professor at Carlos III University in Madrid.