As the automotive industry continues its rapid transition toward software-defined vehicles, the privacy of the average driver is becoming increasingly precarious. A comprehensive new study from researchers at Northeastern University has pulled back the curtain on the extensive data-collection practices of modern automakers, revealing a landscape where vehicles act as sophisticated surveillance hubs, often funneling personal information to third-party companies without the clear knowledge or meaningful consent of the people behind the wheel.
The investigation, which tested 21 different vehicles representing 19 major automotive brands, found that the vast majority of these machines are constantly communicating with outside entities. According to the findings, 19 of the 21 vehicles tested were caught transmitting data to third-party companies. This data flow was not limited to the mechanical health of the car; it extended to the companion smartphone apps that many drivers now consider essential for modern vehicle ownership.
Nicole Zagson, a doctoral candidate in cybersecurity at Northeastern and a co-author of the study, provided a stark assessment of the current state of automotive privacy. "Whether or not consumers are aware, big tech companies are all over the vehicles that we drive," Zagson noted. The research highlights a dual-layered approach to data harvesting, where information is gathered both through the vehicle’s onboard hardware and the digital footprint left by the owner’s mobile device.
Connected Vehicles Sent Data To Outside Firms
The methodology behind the study was rigorous and designed to replicate real-world usage patterns while maintaining strict technical oversight. Researchers conducted their testing at the organization’s specialized Auto Test Center in Connecticut over a nearly year-long period, spanning from October 2024 through August 2025. This extended window allowed the team to capture data across various software updates and environmental conditions.
During the testing phase, the researchers logged network traffic under three primary conditions: while the vehicle sat idle, during the activation of every available onboard feature, and while driving at speeds ranging from 5 to 45 mph. This approach ensured that the team could identify when data was being sent and what specific actions triggered those transmissions.
The results were nearly universal. Nineteen of the 21 vehicles contacted at least one third-party entity over Wi-Fi during the testing period. To further understand the persistence of these tracking systems, the researchers took 11 electric vehicles into a car-sized Faraday enclosure—a specialized structure designed to block all external electromagnetic signals, including cellular and GPS. By cutting off the cellular connection, the researchers could observe whether the vehicles would simply wait for a Wi-Fi connection to "phone home" and reroute the blocked data packets.
