Connected cars and apps are quietly sharing personal data with third parties, study finds

New research reveals that most connected vehicles and their companion apps are transmitting personal data and contacting third-party domains linked to advertising and tracking companies, raising significant privacy concerns.

Research by Northeastern University, carried out with Consumer Reports, suggests that connected cars are quietly feeding data to the wider ad-tech and analytics economy. In a study of 21 vehicles from 19 brands and 30 companion apps, the researchers found repeated contacts with third-party domains, including companies associated with advertising, tracking and analytics. They say the results expose a gap between what carmakers disclose and how data is actually handled across the connected-vehicle ecosystem.

To map the traffic, the team connected each vehicle to a Raspberry Pi-based access point and logged network activity while the cars sat idle, while they were operated in parked mode and while they were driven on private roads at Consumer Reports’ test facility. They also tried to inspect encrypted traffic by injecting modified certificates, but every vehicle rejected them, which the authors interpreted as evidence that manufacturers were enforcing certificate validation. Because much of the data also moved over the cars’ own cellular links, the researchers said their findings should be treated as a lower bound.

The results were broad. Nineteen of the 21 vehicles contacted at least one third party over Wi-Fi, and 11 reached at least one domain linked to advertising, tracking or analytics. Google-owned domains appeared in traffic from 13 vehicles. The Tesla Model 3 stood out, contacting 34 unique advertising, tracking or analytics domains, while the Tesla Cybertruck contacted 23 and the Cadillac Lyriq 10. At the other end of the spectrum, 10 vehicles, including the Buick Envista, Mercedes EQS and Land Rover Range Rover, did not contact such domains over Wi-Fi.

When the researchers cut off cellular connectivity by placing 11 electric vehicles in a Faraday tent, more destinations appeared for seven of them. The Tesla Model 3 reached 27 additional tracking-related domains in the shielded enclosure than it had outside it, while the Cybertruck hit 14 more. One analytics and tracking service, conviva.com, was seen on the Model 3’s cellular connection and then shifted to Wi-Fi once mobile signal was blocked. The pattern suggests that limiting one connection path may simply push some traffic elsewhere rather than eliminate it.

The companion apps were even more revealing. Seventy per cent of the apps contacted more than five unique advertising, tracking or analytics domains, compared with 29 per cent of the vehicles themselves. The researchers said that, for most of the dataset, the app at least doubled cumulative exposure to advertising, tracking and analytics companies. They also found personal data leaving apps in several cases: seven of the 30 apps sent items such as VINs, email addresses, phone numbers and location data to outside firms. General Motors’ myCadillac, myChevrolet, myBuick and myGMC apps sent VINs to companies including Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo, while HondaLink sent both VIN and precise location to Amplitude.

The privacy implications are significant because a VIN is permanent, unlike a phone’s advertising identifier, which can be reset. The researchers argued that when a VIN is combined with other personal data, companies can link a driver to behaviour across websites and mobile apps, building more detailed profiles than many owners would expect. Privacy policies, they said, did mention third-party sharing in general terms, but did not name the recipients or explain the purpose of the transfers. In responses to the researchers, manufacturers largely said the behaviour matched their contracts with suppliers; Honda was the exception, asking Amplitude to delete location data already received and stopping further geolocation sharing from HondaLink.