19 Out of 21 Late-Model Cars Tested Shared Data With 3rd Parties, Including Big Tech Companies: Study

Our car experts choose every product we feature. We may earn money from the links on this page.

a driverview of the 2024 silverado ev rst cockpit showing the driver information and infotainment screens

JIM FETS

As large infotainment screen and other high-tech, often connected features have become standard across the automotive industry over the last 10-plus years, vehicles have begun passing data out from the vehicles as well as taking it in. And it may be more prolific, and expansive, than you realize: a new study from Northeastern University claims nearly every automaker operating in the United States has cars that send your personal data to outside companies.

The study, created in partnership with Consumer Reports, tested 21 late-model vehicles and 30 companion mobile apps to understand the privacy implications of the connected vehicle ecosystem. Researchers collected Wi-Fi traffic from 21 vehicles using a Raspberry Pi Wi-Fi access point to see where the vehicles were sending data to. Of the 21 vehicles tested, 19 vehicles were found to be sending data to a third party.

tesla cybertruck

Tesla

“We found that vehicles, under a variety of real-world settings, contact not only a wide range of first parties (i.e., manufacturer domains) and car-specific support parties, but also third parties that are known to provide advertising and tracking services,” the study's conclusion reads. “When adding vehicle companion apps to the analysis, we found that vehicle owners are exposed to even more privacy-sensitive ATA communication—in some cases more than two dozen additional trackers.”

Researchers conducted stationary tests (idle and active), as well as driving tests at speed from 5 to 45 mph involving acceleration & hard braking. They also tested whether blocking a vehicle’s ability to communicate over cellular networks would force more Wi-Fi communication by covering 11 EVs in a Faraday tent with 93 dB of attenuation, blocking their cellular connection entirely. General Motors, Stellantis, Fisker, Ford, Honda, Land Rover, Toyota, Lucid, Mercedes-Benz, Nissan, Rivian, Tesla, and Volvo models were included in the test.

Seven of the 30 companion apps transmitted sensitive identifiers, such as VINs, emails, phone numbers, and precise locations, to third parties associated with advertising and tracking. These apps roughly doubled a vehicle's exposure to advertising and tracking companies, on average. Tesla and General Motors vehicles, such as the Cybertruck and Cadillac Lyriq, shared data with third parties at a much higher rate, according to the study; Alphabet, Amazon, Meta, Microsoft, Pinterest, and Reddit were the most common recipients of the data.

automatictransmission.khoury.northeastern.edu

The study’s introduction.

Researchers say 17 manufacturers were contacted about the findings, and most shifted blame to third-party service contracts. Of the 14 manufacturers that responded, all claimed the data flows were in line with these contracts; these are often quite broad, leaving the door open for data leakage, carmakers said. Seven of the manufacturers also shifted blame to consumers, according to the study, claiming consumers have a personal responsibility to review the terms of every third-party app or service on the vehicle. However, declining data-sharing agreements can disable features like navigation, driver-assist, or over-the-air updates.

“Assuming owners can find the particular agreements, if an owner decides they are uncomfortable with the data sharing described within them, they are faced with (arguably) unfair choices,” the study reads. “As one notable exception, Honda improved its data collection practices to prevent sending precise geolocation to a third party associated with user tracking.”

Ultimately, Northeastern researchers said they believe there is a “need for better transparency to ensure increased visibility into the entire ecosystem to identify and address corresponding harms.” The study points to a large gap between what vehicle manufacturers publicly disclose and how the vehicle data is shared over the internet. Concerns over this data sharing have good reason behind them: A CalMatters and Consumer Reports found that personal information can be used by banks, insurers, pharmaceutical companies, lenders, and retailers to create profiles of drivers, often without their knowledge.

Headshot of Emmet White

Emmet White

Associate Editor

A New York transplant hailing from the Pacific Northwest, Emmet White has a passion for anything that goes: cars, bicycles, planes, and motorcycles. After learning to ride at 17, Emmet worked in the motorcycle industry before joining Autoweek in 2022 and Road & Track in 2024. The woes of alternate side parking have kept his fleet moderate, with a 2014 Volkswagen Jetta GLI and a BMW 318i E30 street parked in his Queens community.