Your car and its mobile app are probably handing over all kinds of data to tech companies
Researchers at Northeastern University, working with Consumer Reports, found that modern connected vehicles and their companion mobile apps frequently send detailed user data to major tech firms. In tests of 21 recent vehicles and 30 companion apps, most vehicles transmitted traffic to third parties and several apps shared sensitive identifiers and precise location data with advertising and tracking companies.
Why It Matters
The findings show how routine vehicle connectivity features can expose personal data to advertisers and data brokers, enabling detailed consumer profiles that can be sold to insurers, banks, and other buyers. Because many of these data flows occur without clear notice, consumers have limited ways to prevent their driving and identity data from being collected and redistributed.
Key Facts
- Study authors: Researchers at Northeastern University in partnership with Consumer Reports
- Vehicles tested: 21 late-model vehicles from 17 automakers
- Companion apps examined: 30 mobile apps
- Vehicles sending third-party traffic: 19 of 21 vehicles
- Apps sharing sensitive data: 7 of 30 apps shared VIN, emails, phone numbers, or precise location with third parties
A peer-reviewed study by Northeastern University researchers, conducted with Consumer Reports and scheduled for publication this week, analyzed data flows from 21 recent vehicles and 30 companion mobile apps to map how connected-car ecosystems share user information. The vehicles tested represented 17 automakers, including brands such as Cadillac, Chevrolet, Ford, Lucid, Rivian, Tesla, and Toyota. The researchers found that 19 of the 21 vehicles transmitted traffic to at least one third party.
The companion apps often amplified exposure: linking an app to its vehicle roughly doubled the number of advertising and tracking companies that received data. Seven of the 30 apps transferred sensitive identifiers — including vehicle identification numbers (VINs), email addresses, phone numbers, and precise geolocation — to third-party firms associated with tracking and advertising.
The study highlights that multiple types of information were frequently sent to the same third parties, enabling those firms to combine data streams and build richer consumer profiles. The researchers warned this aggregation makes it difficult for consumers to prevent their driving and identity data from being tied together and sold to various buyers, such as insurers and banks.
When the findings were shared with automakers, all but one — Honda — largely deflected responsibility, the researchers reported. Honda did respond by changing its data collection practices and instructing its vendor Amplitude to delete geolocation data it had received. Consumer Reports also noted automakers told them some app links opened external webpages that could drop trackers or cookies, but drivers were not being informed about these data collection mechanisms.
Keep Reading
OpenAI launches GPT-6.1 Sol, says it nearly matches GPT-6 Astra and costs less
OpenAI gives Codex reusable cloud environments that work across devices
OpenAI launches Dots, its bubbly agentic avatar
