Sarah Elizabeth Gillespie, a co-author of the study, emphasized that under the current market conditions, privacy-conscious consumers have very few options. "It does not appear that a customer can buy a new car that does not track you," Gillespie stated. The researchers also pointed out a significant hurdle in consumer protection: the "illusion of consent." Most drivers never read the dense, legalistic terms and conditions they are required to accept when setting up a vehicle or its companion app. While automakers may technically have the user’s permission to share data, that "consent" is rarely informed or transparent.
Big Tech Companies Turned Up As Data Recipients
The investigation also sought to answer the critical question of where this data goes once it leaves the vehicle or the smartphone. The list of recipients identified in the study reads like a "who’s who" of the global advertising and technology sectors. Major platforms including Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo were all identified as recipients of driver data across the various vehicles and apps tested.
These companies operate the world’s largest advertising networks, and the integration of automotive data allows them to bridge the gap between a consumer’s digital life and their physical movements. Knowing where a person drives, how long they spend at certain locations, and what features they use in their car provides a level of granular insight that is highly valuable for targeted marketing.
When questioned about these practices, some automakers informed the researchers that they have strict contractual agreements in place that prohibit third parties from reselling or independently reusing the data they receive. However, the Northeastern team expressed skepticism regarding these claims. The researchers noted that these contractual limits are nearly impossible for an outsider to verify, and they found little to no evidence of active enforcement by the automakers to ensure that these "data partners" are actually following the rules.
Despite the pervasive nature of this data collection, the researchers noted that not every connected feature in a modern car is a cause for privacy alarm. Many onboard sensors, such as those used for emergency braking, lane-keep assist, and other Advanced Driver Assistance Systems (ADAS), are designed to function locally and exist purely for safety. The concern is not necessarily the existence of the sensors themselves, but rather the secondary path the data takes once it is uploaded to the cloud and integrated with third-party advertising ecosystems.
The study concludes by framing its findings as a snapshot of the current market. Because the 21 vehicles and 30 apps tested were already on the road and in use by millions of people well before the study measured them, the researchers suggest that the scale of the issue likely extends far beyond the specific models included in their tests. As cars become more like mobile computers, the automotive industry appears to be following the same data-harvesting playbook as the smartphone and social media industries, leaving drivers to navigate a world where their every mile is tracked, analyzed, and monetized.
