Study Finds Connected Cars Send Data To Ad And Analytics Firms

Modern vehicles have turned into rolling sensor platforms, and a new investigation suggests many of them are quietly sharing information with companies that have nothing to do with selling cars. Researchers at Northeastern University, working alongside Consumer Reports, spent nearly a year examining 21 vehicles from 21 brands along with 30 automaker companion apps, scanning Wi-Fi and cellular traffic and even isolating cars inside Faraday enclosures to capture what they transmit.

Of the cars tested, 19 communicated with at least one outside party over the internet. More than half reached domains classified as advertising, tracking, or analytics—linked to firms including Alphabet, Amazon, Mapbox, and Meta. Tesla’s Model 3 stood out with 34 such domains, while the Cybertruck registered 23. Cadillac’s Lyriq followed with 10, Lucid with 9, and the Chevy Blazer with 7. On the other end of the scale, the Nissan Ariya, Land Rover Range Rover, Mercedes EQS, and Buick Envista reached none.

Seven of the companion apps sent sensitive identifiers such as VINs, email addresses, phone numbers, or precise location data to third parties tied to advertising and analytics. When researchers contacted 18 automakers, 14 responded. All said the activity matched their third-party service contracts, which they claim bar misuse of personal data. Five blamed embedded infotainment browsers, and seven argued that reading the terms of service for apps like Spotify or Google’s operating system is the owner’s job. Honda reportedly agreed to reclassify VINs after being contacted. Researchers also criticized Tesla and Rivian for warning that turning off data sharing could degrade vehicle features—an opt-out that effectively penalizes privacy-conscious buyers.