Connected vehicles share sensitive data with third-party tech firms

A study conducted by researchers at Northeastern University in collaboration with Consumer Reports has revealed significant data privacy concerns regarding connected vehicles. By analyzing network traffic from 21 vehicle models across 19 brands and 30 companion mobile applications, researchers found that 19 of the 21 cars communicated with third-party domains.

More than half of the tested vehicles contacted domains associated with advertising, tracking, or analytics (ATA), including companies such as Alphabet, Meta, Amazon, and Adobe. The Tesla Model 3 was identified as a high-frequency communicator, contacting 34 unique ATA domains. Other notable findings included the Cadillac Lyriq and Lucid models also exhibiting high levels of third-party connectivity.

The study highlighted that companion mobile apps often exacerbate privacy risks. Seven of the 30 apps tested were found to transmit sensitive identifiers—including vehicle identification numbers (VIN), email addresses, phone numbers, and precise location data—to third-party advertising and tracking entities. This data sharing can allow brokers to build detailed consumer profiles for use by insurers and banks.

While many manufacturers attributed this traffic to user-accepted terms of service or integrated browsers, researchers noted that consumers have limited visibility or control over these data flows. Honda was noted as the only manufacturer to take active corrective measures following the study by updating its apps and requesting the removal of certain stored location data.