The Growing Privacy Risks in Modern Vehicles

While many consumers are already aware that their smartphones can track their movements and behavior, new research indicates that the modern automobile has become an equally potent tool for data collection. A recent study reveals that today's vehicles are actively transmitting driver information to external companies, including those heavily involved in advertising and behavioral tracking.


How the Study Was Conducted

In a joint investigation, a team from Northeastern University partnered with Consumer Reports to analyze twenty-one late-model vehicles available in the U.S. market. The test included major automotive brands such as Ford, GM, Honda, Mercedes-Benz, Nissan, Toyota, and Tesla. Researchers monitored the vehicles' network connections both while parked and while in motion, separating cellular and Wi-Fi data streams to pinpoint exactly when and how information was being transmitted.


Key Findings: Data Transmission and Third-Party Access

The results of the analysis were concerning:

  • 19 out of the 21 tested vehicles established contact with at least one third-party entity over Wi-Fi.
  • Companion apps provided by manufacturers significantly exacerbate the issue. Testing of thirty such apps showed that seven transmitted sensitive details—such as vehicle identification numbers (VINs), precise location data, email addresses, and phone numbers—to third-party advertisers.
  • Using an automaker’s companion app roughly doubled a driver's exposure to tracking entities, with some apps connecting to more than twenty different third parties.

According to the research, the combination of data points—such as linking a VIN with a personal email address or specific location history—allows these external firms to build comprehensive profiles on individual drivers.


Who Is Receiving the Data?

The report highlights that the data flows to some of the most prominent tech companies globally. Tech giants and platforms such as Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo were identified as recipients of data transmitted from the vehicles and their associated apps. This suggests that information gathered via a vehicle is being integrated into broader data-collection ecosystems that many drivers already use daily.


Automaker Responses

Following the disclosure of these findings, several manufacturers addressed the concerns:

«Honda stated that it had instructed Amplitude, a third-party advertising firm, to delete collected data and subsequently modified its HondaLink app to cease sending geolocation information. Both Honda and General Motors maintained that their existing contracts with third-party partners strictly limit how the shared information can be utilized or sold.»

The research underscores a significant shift in the automotive industry, where vehicles are increasingly functioning as connected devices, often at the expense of user privacy.