Legal, ethical, and technological challenges in connected cars: An integrated threat assessment framework

Connected vehicles generate continuous behavioral and location data while exposing users to escalating cybersecurity and privacy risks. Existing frameworks address these challenges in isolation — either as security problems or privacy compliance issues — without integrating legal, ethical, and technical dimensions across the complete data lifecycle.This study develops and validates an integrated threat assessment framework combining the Data Lifecycle Threat Model with the LINDDUN Privacy Threat Model, applied systematically to connected vehicle ecosystems. Using semi-structured interviews with 45 industry stakeholders, a cross-jurisdictional consumer survey (n=320), and regulatory analysis across six jurisdictions, we identified 127 distinct threat vectors across 42 lifecycle–privacy intersection points. Framework validation achieved 89.3% coverage of expert-identified threats (95% CI: 86.1–92.5%), compared to 57–61% for single-domain approaches. High-transparency conditions increased consumer acceptance of connected services by 28.6 percentage points (F(2,317)=45.23, p<0.001). Regulatory analysis identified 23 significant governance gaps, with only 33% of jurisdictions maintaining specific cybersecurity requirements for connected vehicles. Pilot implementation across three organizations demonstrated a mean cost-benefit ratio of 3.2:1 within 8–12 months. These findings demonstrate that privacy-by-design approaches, rather than isolated technical fixes, are necessary for sustainable connected mobility deployment. • Integrated Data Lifecycle and LINDDUN models into a unified connected vehicle threat framework • Identified 127 threat vectors across 42 lifecycle–privacy intersection points • High-transparency conditions increased consumer service acceptance by 28.6 percentage points • Regulatory gap analysis across six jurisdictions revealed critical enforcement deficits • Framework achieved 89.3% threat coverage versus 57–61% for single-domain approaches