Researchers found 21 vehicles transmitted data to third-party domains, with over half contacting advertising companies. Your car is collecting more than you think.
By Adam Makins·
Your car knows where you go, how fast you drive, and how hard you brake. And it’s telling strangers about it.
A new study from Northeastern University and Consumer Reports just proved what privacy advocates have suspected for years: modern connected vehicles are harvesting your personal data and selling it to the highest bidder. Every single one of the 21 late-model cars tested transmitted data to third-party domains. Over half were pinging advertising companies.
The researchers analyzed vehicles from 19 different brands currently sold in the US, along with 30 companion mobile apps. What they found was damning. Companies like Adobe, LexisNexis, and Amplitude were receiving detailed information about your vehicle and driving behavior. These data brokers then package that information and sell it to insurance companies or use it to target you with ads.
The team’s methodology was thorough. They placed a Raspberry Pi inside each car to monitor Wi-Fi traffic while driving. For cellular data, they built a car-sized Faraday tent to block external signals and force vehicles onto their controlled network. This creative approach revealed just how much information these cars transmit without your knowledge.
David Choffnes, the project lead, put it bluntly: “I think the conclusion is that there’s a lot to be worried about.”
But the real nightmare is in the companion mobile apps. Seven apps tested - HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC - were transmitting sensitive data like vehicle identification numbers (VINs), phone numbers, and precise location data directly to advertising networks. Over 70 percent of the apps contacted at least five unique tracking domains.
This is where things get genuinely creepy. When your VIN gets paired with identifiable personal information, data brokers can build complete dossiers on you. They’re not just tracking your online behavior anymore. They’re tracking which car you own, where you drive it, and how you drive it. Most of these companies? You’ve never heard of them. You have no relationship with them. Yet they have detailed files on your driving habits.
Vehicles with Google’s Android Automotive OS contacted the most third-party domains. Google’s platform includes built-in routines to communicate with Google’s services and external entities. The choice of software platform directly impacts how much data leaks to third parties.
Automakers gave predictable responses. Some claimed their practices were legally compliant. Others acknowledged the vulnerabilities and promised software fixes. Honda even asked its analytics provider Amplitude to delete collected location data after seeing the research.
But here’s the uncomfortable truth: most car buyers have no idea what they’re agreeing to. Nobody reads the dense privacy policy displayed on a tiny dashboard screen before taking the keys. The terms are deliberately obscured, and the opt-out process is intentionally difficult.
Choffnes argues that automakers need to flip the script entirely. Instead of opt-out by default, privacy controls should require explicit opt-in. Transparency needs to be the baseline, not an afterthought. When you’re buying a car - one of the largest purchases you’ll ever make - you should have real control over what gets collected and where it goes.
The automotive industry has been treating connected cars like smartphones, but they’ve ignored the tech industry’s fundamental failures in user privacy. They’re repeating the same mistakes that let tech companies build surveillance empires.
Until automakers commit to genuine transparency and meaningful consumer control, your car will continue reporting on your movements to companies you’ve never met and regulations you never agreed to. The question isn’t whether your car is tracking you anymore. The question is what you’re going to do about it.
Source: The Verge
