March 3, 2026 A study from Spain’s IMDEA Networks Institute has found that tire-pressure monitoring systems (TPMS) in modern vehicles broadcast unique identifiers that can be used to track cars without reading licence plates. Researchers demonstrated that inexpensive radio receivers can capture these signals from more than 160 feet away.
TPMS have been mandatory on new vehicles in the United States since the 2008 model year and are designed to improve safety by alerting drivers to low tire pressure. According to IMDEA, the sensors continuously emit wireless signals containing a unique ID. “Our results show that these tire sensor signals can be used to follow vehicles and learn their movement patterns,” said Domenico Giustiniano, research professor at IMDEA Networks Institute. “This means a network of inexpensive wireless receivers could quietly monitor the patterns of cars in real-world environments.”
To test the risk, researchers deployed a network of radio receivers costing about US$100 each. Over 10 weeks, they collected roughly six million signals from approximately 20,000 vehicles. The team found that signals could be captured even when receivers were placed inside buildings.
Beyond tracking, researchers said they were able to match signals to individual tires on a vehicle, improving identification accuracy. They also intercepted tire-pressure readings, which could indicate the type of vehicle or whether it is carrying a heavy load.
The underlying issue, according to the researchers, is that current regulations governing TPMS do not require cybersecurity protections such as encryption or authentication. The systems were “designed for safety, not security,” the institute noted, meaning identifiers are broadcast in clear text and can be captured by nearby devices.
The findings highlight a broader challenge in automotive technology: components introduced to improve safety may also expand the attack surface if security requirements lag behind connectivity features. As vehicles become increasingly digitized, even low-bandwidth sensor systems can introduce tracking and data exposure risks.
