Tests of 21 of the latest cars revealed that almost all of them were sending data to third-party domains, and more than half were sending messages to advertising companies.
Modern cars are so multi-functional and process vast amounts of data that they are sometimes called 'smartphones on wheels,' recording information such as where they drove, how fast they accelerated, how hard they braked, and how sharply they turned. While it has been a concern that
Automatic Transmission — a data-privacy study of connected vehicles
https://automatictransmission.khoury.northeastern.edu/index.html
Car Companies Are Sharing Location and Email Address Data
https://news.northeastern.edu/2026/09/29/connected-car-privacy-violation-research/
Your Car Is Sharing Data With Big Tech - Consumer Reports
https://www.consumerreports.org/electronics/personal-information/your-car-is-sharing-data-with-big-tech-companies-study-finds-a4474820962/
Your car's data privacy problems are worse than you think | The Verge
https://www.theverge.com/transportation/1001463/car-data-privacy-northeastern-study-honda-gm-ford
General Motors offers an optional feature called 'OnStar Smart Driver' within its connected service 'OnStar,' which records speeding, sudden acceleration, sudden braking, and night driving. It was reported in 2024 that General Motors was providing the collected driving data to data intermediaries for use in creating risk assessments for insurance companies. In January 2026, the U.S. Federal Trade Commission (FTC) found that General Motors had been collecting and selling location information and driving behavior data without adequately explaining it to users or obtaining explicit consent. The FTC prohibited General Motors from providing the data to third parties for five years and mandated that companies obtain explicit consent from users before collecting, using, or sharing data, and that they have mechanisms in place to allow users to request copies or deletions of their data.
In addition, in California, a settlement was announced in May 2026 in which General Motors would pay $12.75 million (approximately 2 billion yen) for selling location and driving behavior data of hundreds of thousands of residents to LexisNexis and Velisk, companies that provide risk analysis services to insurance companies, between 2020 and 2024.
GM pays 2 billion yen in fine for selling driving data without consent - GIGAZINE
It has also been revealed that Honda, Kia, Hyundai, and other companies share driving data with insurance companies and other organizations.
Automakers selling driving data to third parties has reportedly affected insurance premiums - GIGAZINE
Therefore, researchers at Northeastern University and Consumer Reports , a monthly magazine published by Consumers Union, a non-profit consumer organization, collaborated to conduct a detailed investigation into privacy practices in connected cars. Using 21 test vehicles provided by Consumer Reports, the research team explored questions such as: 'Which cars are transmitting data?', 'Who is receiving that data?', 'Does the data cross national borders?', and 'What kind of personal information is actually being leaked?'.
David Chofness, former director of the Cybersecurity and Privacy Institute at Northeastern University and project leader of this study, said in an interview, 'The goal of this project is to reveal the sheer scale of modern vehicle data tracking and highlight how little visibility and control owners actually have over it. In conclusion, we felt there is a lot to be concerned about.'
The researchers analyzed 21 of the latest car models from 19 brands sold in the United States, along with 30 different mobile apps linked to the vehicles in operation.
For traffic transmitted directly from the vehicles, the team identified destination domains, including various third-party tracking companies, but the encrypted payload data could not be decrypted without hacking the vehicles. On the other hand, intercepting Wi-Fi traffic was relatively easy, and the researchers were able to monitor Wi-Fi traffic transmitted even while the vehicles were in motion by installing Raspberry Pis in each vehicle and routing internet connections via mobile hotspots while connected to the vehicle's Wi-Fi.
Obtaining cellular network connectivity required some ingenuity. To avoid setting up unauthorized base stations that could interfere with public cellular networks, the team built a 'Faraday tent' large enough to completely enclose the car. This tent blocks radio waves, preventing communication between the car and external cellular base stations, allowing the car to connect to Wi-Fi provided by the team. Below is a photo of the Faraday tent in use, published by Consumer Reports.
The investigation revealed that 19 of the 21 vehicles surveyed were sending data to at least one third-party domain via Wi-Fi. Furthermore, it was found that more than half of the vehicles were connecting to domains specializing in advertising, tracking, and analytics.
Chofnes points out that vehicles running Google's Android Automotive OS and Google Automotive Services accessed the most third-party domains, and that the software platform chosen by automakers directly impacts the amount of data sent to third parties.
Regarding mobile apps, it was discovered that seven companion apps—HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC—were directly transmitting sensitive information such as vehicle identification numbers (VINs), phone numbers, and precise location data to advertising networks. More than 70% of the companion apps tested were found to be connected to at least five different domains. When a vehicle's VIN is linked to personally identifiable data, data brokers can create detailed personal information about individual drivers. While all manufacturers disclose in their app privacy policies that they may share personal information with third parties, researchers pointed out that they do not disclose which third parties they contact or for what purpose.
Among the third-party organizations to which personal information was transmitted, Adobe Analytics , the third-party data broker We put data to work - Acxiom , and the analytics company Contentsquare were the ones with the most communications. Major technology companies such as Amazon, Google, Meta, and Microsoft were also listed as primary recipients of driver data.
Automakers have responded in various ways to the investigation report. For example, Honda has modified its software in response to the findings, and reported that it has requested its analytics provider, Amplitude, to delete all collected location data, and has updated the HondaLink app to stop transmitting location information. A spokesperson for General Motors responded to inquiries from researchers by saying, 'We are committed to keeping our customers' data secure so that they can enjoy the benefits of in-car connectivity (such as improved navigation, communication, and safety). We also provide a clear and easy-to-understand privacy policy.'
Chofnes points out that a fundamental problem is that consumers don't understand what they're agreeing to when they buy a connected car or set up an app. 'Automakers should make an effort to regain trust. To do that, it's important to increase transparency and make it a clearer opt-in system rather than an opt-out system when consumers purchase an expensive product,' he said.
Related Posts:
