As the automotive industry continues its rapid transition toward software-defined vehicles, the privacy of the average driver is becoming increasingly precarious. A comprehensive new study from researchers at Northeastern University has pulled back the curtain on the extensive data-collection practices of modern automakers, revealing a landscape where vehicles act as sophisticated surveillance hubs, often funneling personal information to third-party companies without the clear knowledge or meaningful consent of the people behind the wheel.
The investigation, which tested 21 different vehicles representing 19 major automotive brands, found that the vast majority of these machines are constantly communicating with outside entities. According to the findings, 19 of the 21 vehicles tested were caught transmitting data to third-party companies. This data flow was not limited to the mechanical health of the car; it extended to the companion smartphone apps that many drivers now consider essential for modern vehicle ownership.
Nicole Zagson, a doctoral candidate in cybersecurity at Northeastern and a co-author of the study, provided a stark assessment of the current state of automotive privacy. "Whether or not consumers are aware, big tech companies are all over the vehicles that we drive," Zagson noted. The research highlights a dual-layered approach to data harvesting, where information is gathered both through the vehicle’s onboard hardware and the digital footprint left by the owner’s mobile device.
Connected Vehicles Sent Data To Outside Firms
The methodology behind the study was rigorous and designed to replicate real-world usage patterns while maintaining strict technical oversight. Researchers conducted their testing at the organization’s specialized Auto Test Center in Connecticut over a nearly year-long period, spanning from October 2024 through August 2025. This extended window allowed the team to capture data across various software updates and environmental conditions.
During the testing phase, the researchers logged network traffic under three primary conditions: while the vehicle sat idle, during the activation of every available onboard feature, and while driving at speeds ranging from 5 to 45 mph. This approach ensured that the team could identify when data was being sent and what specific actions triggered those transmissions.
The results were nearly universal. Nineteen of the 21 vehicles contacted at least one third-party entity over Wi-Fi during the testing period. To further understand the persistence of these tracking systems, the researchers took 11 electric vehicles into a car-sized Faraday enclosure—a specialized structure designed to block all external electromagnetic signals, including cellular and GPS. By cutting off the cellular connection, the researchers could observe whether the vehicles would simply wait for a Wi-Fi connection to "phone home" and reroute the blocked data packets.
The study identified several high-profile models as being particularly active in their data-sharing habits. Vehicles found to be sending information to the widest range of outside advertising and analytics firms included the Cadillac Lyriq, the Chevrolet Blazer, the Lucid Air, and both the Tesla Model 3 and the Tesla Cybertruck. The presence of both "old-guard" manufacturers like General Motors and "tech-first" EV startups like Tesla and Lucid suggests that data harvesting is not a quirk of a specific business model, but rather a standardized industry practice. Whether a company builds its brand on traditional luxury or futuristic technology, the monetization of driver data appears to be a core component of the modern automotive ecosystem.
The researchers made a clear distinction between vehicle telemetry—the stream of data a car generates about its internal systems, sensors, and immediate surroundings—and the more personal data collected through smartphone integration. While telemetry is often framed by manufacturers as a tool for engineering improvements and safety diagnostics, the study suggests that the lines between technical data and marketable consumer insights are becoming increasingly blurred.
Companion Apps Exposed Names, VINs And Locations
While the vehicles themselves are active data transmitters, the study’s most alarming findings emerged from the analysis of companion mobile apps. These apps, which allow users to remotely start their engines, check battery levels, or locate their vehicles in a crowded parking lot, have become a primary vector for the collection of personally identifiable information (PII).
The researchers tested 30 different companion mobile apps and discovered that 28 of them sent data to at least one outside advertising or analytics company. Unlike the often-anonymized engineering data sent by the car’s hardware, the data harvested by these apps was frequently tied directly to the individual user.
Roughly a quarter of the apps tested were found to be transmitting sensitive PII, including the owners’ names, precise GPS locations, and Vehicle Identification Numbers (VINs). The combination of a VIN and a name is particularly powerful for data brokers; a VIN is a permanent, unique identifier for a vehicle, and when paired with a name and a residential address, it allows for the creation of a highly specific profile that can track a driver’s daily movements, habits, and lifestyle choices over the course of years.
The study singled out four General Motors apps—myCadillac, myChevrolet, myBuick, and myGMC—for pairing VINs with either an email address or precise location data. This discovery comes at a time of heightened scrutiny for GM and other automakers regarding how they handle driver information. Earlier reports had already highlighted Ford’s telematics practices, specifically how the automaker began sharing driving behavior data with insurance companies—a move that can directly impact a consumer’s premiums without them fully understanding why.
Sarah Elizabeth Gillespie, a co-author of the study, emphasized that under the current market conditions, privacy-conscious consumers have very few options. "It does not appear that a customer can buy a new car that does not track you," Gillespie stated. The researchers also pointed out a significant hurdle in consumer protection: the "illusion of consent." Most drivers never read the dense, legalistic terms and conditions they are required to accept when setting up a vehicle or its companion app. While automakers may technically have the user’s permission to share data, that "consent" is rarely informed or transparent.
Big Tech Companies Turned Up As Data Recipients
The investigation also sought to answer the critical question of where this data goes once it leaves the vehicle or the smartphone. The list of recipients identified in the study reads like a "who’s who" of the global advertising and technology sectors. Major platforms including Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo were all identified as recipients of driver data across the various vehicles and apps tested.
These companies operate the world’s largest advertising networks, and the integration of automotive data allows them to bridge the gap between a consumer’s digital life and their physical movements. Knowing where a person drives, how long they spend at certain locations, and what features they use in their car provides a level of granular insight that is highly valuable for targeted marketing.
When questioned about these practices, some automakers informed the researchers that they have strict contractual agreements in place that prohibit third parties from reselling or independently reusing the data they receive. However, the Northeastern team expressed skepticism regarding these claims. The researchers noted that these contractual limits are nearly impossible for an outsider to verify, and they found little to no evidence of active enforcement by the automakers to ensure that these "data partners" are actually following the rules.
Despite the pervasive nature of this data collection, the researchers noted that not every connected feature in a modern car is a cause for privacy alarm. Many onboard sensors, such as those used for emergency braking, lane-keep assist, and other Advanced Driver Assistance Systems (ADAS), are designed to function locally and exist purely for safety. The concern is not necessarily the existence of the sensors themselves, but rather the secondary path the data takes once it is uploaded to the cloud and integrated with third-party advertising ecosystems.
The study concludes by framing its findings as a snapshot of the current market. Because the 21 vehicles and 30 apps tested were already on the road and in use by millions of people well before the study measured them, the researchers suggest that the scale of the issue likely extends far beyond the specific models included in their tests. As cars become more like mobile computers, the automotive industry appears to be following the same data-harvesting playbook as the smartphone and social media industries, leaving drivers to navigate a world where their every mile is tracked, analyzed, and monetized.
