Inside giant faraday tents, researchers scanned the Wi-Fi and cellular streams of 21 late-model cars, looking at what left the vehicle once it connected. The Northeastern University and Consumer Reports team assembled the fleet from 13 major automakers, including General Motors, Ford, Tesla, Stellantis, Toyota and Rivian, then ran its tests between October 2024 and August 2025.
The results suggest that connected cars have become a broad distribution channel for driver data. Nineteen of the 21 vehicles contacted at least one outside domain over Wi-Fi, while 28 of 30 companion apps shared data with advertising or analytics firms. The study said 19 of 21 major auto manufacturers it examined collected and widely disseminated customers’ private data.
Those recipients included advertisers and analytics companies, alongside Alphabet, Amazon, Microsoft, Meta, Reddit and Pinterest. Companies including Adobe, LexisNexis and Amplitude collect vehicle or driving-behaviour information for sale to insurers or to target drivers with advertising.
The information at issue extended beyond a car’s location. The vehicles tracked where people drove, how quickly they accelerated, how sharply they braked and how aggressively they turned. Aggregated vehicle data is also bought and sold by banks, insurers, lenders and retailers to build detailed consumer profiles.
Seven of the 30 apps sent sensitive identifiers directly to advertising networks, including vehicle identification numbers, phone numbers, email addresses and precise GPS locations. The apps were linked to HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick and myGMC.
The four General Motors apps, along with the Honda, Nissan and Lincoln apps, shared vehicle identification numbers paired with either location information or email addresses.
Companion apps appear to add a substantial further layer of exposure. More than 70 percent of those tested contacted at least five distinct advertising, tracking or analytics domains, and connecting an app roughly doubled, on average, a vehicle’s exposure to such companies.
The Tesla Model 3 contacted 34 advertising, tracking and analytics domains, the highest number recorded for any vehicle in the test. Tesla, Cadillac and Lucid topped the study’s ranking of biggest offenders.
Car companies defended their practices by saying drivers must opt in to data sharing. Some manufacturers also warned customers that opting out could leave their vehicles inoperable.
Regulators have already acted against several manufacturers. The Federal Trade Commission penalised General Motors for illegally collecting and selling precise location and driving-behaviour data without informed consent. Ford and Honda faced minor fines for making it overly difficult for customers to opt out.
After the researchers presented their findings, Honda asked its analytics provider, Amplitude, to delete all location data it had collected. Honda also changed the HondaLink app so it would stop transmitting geolocation.
Comments (0)