Study: All Tested Cars Share Data With Advertisers

Overview

A comprehensive new study has revealed that every modern vehicle tested transmits personal driving data to third-party advertisers and analytics firms, often without the owner’s knowledge or explicit consent. Researchers from Northeastern University, collaborating with Consumer Reports, examined 21 late-model vehicles from 19 different brands currently available in the United States. The findings indicate that connected cars are effectively functioning as smartphones on wheels, collecting granular details about driving habits, location, and vehicle performance.

Over half of the tested vehicles communicated directly with domains specializing in advertising, tracking, and analytics. These entities, which include major data brokers like Adobe, LexisNexis, and Amplitude, aggregate vehicle and driver information to sell to insurance companies or target consumers with personalized advertisements. The study highlights a significant gap between consumer expectations of privacy and the reality of data harvesting in the modern automotive landscape.

Methodology and Scope

The research team sought to answer critical questions regarding the scope of vehicle data transmission, including who receives the data, whether it crosses international borders, and what personally identifiable information is exposed. To achieve this, they analyzed 21 vehicles and 30 companion mobile applications linked to active cars. The goal was to map the digital footprint left by each vehicle as it operated on public roads.

Capturing traffic sent directly from the cars’ internal systems required sophisticated technical approaches. Researchers placed a Raspberry Pi device inside each vehicle, connecting it to the car’s Wi-Fi network while routing the internet connection through a controlled mobile hotspot. This setup allowed them to monitor outgoing Wi-Fi traffic in real-time while the car was in motion.

"I think the conclusion is that there’s a lot to be worried about." — David Choffnes, Project Lead and former director of Northeastern’s Cybersecurity and Privacy Institute

Cellular traffic presented a greater challenge due to regulatory concerns. To avoid deploying an unauthorized cellular base station that could interfere with public networks, the team constructed a car-sized Faraday tent. This shielded environment blocked all signals between the vehicle and external cell towers, forcing the car to fall back on the controlled Wi-Fi connection. This method ensured that researchers could isolate and capture cellular data transmissions without violating communications laws.

Key Findings: Systemic Data Sharing

The results were stark and consistent across the entire sample set. Every single one of the 21 vehicles transmitted data to at least one third-party domain over Wi-Fi. More concerning, more than half of these vehicles pinged domains specializing in advertising, tracking, or analytics. These third-party services gather detailed information about your vehicle’s identity and driving behavior, creating comprehensive profiles that are frequently sold or shared within the data economy.

Vehicles equipped with advanced infotainment systems showed the highest volume of data leakage. In particular, cars running Google’s Android Automotive OS with Google Automotive Services contacted the largest number of third-party domains. David Choffnes noted that an automaker’s choice of software platform significantly impacts the extent of data exposure, as some platforms include built-in routines designed to communicate with both the manufacturer’s services and external entities.

A separate analysis of companion mobile apps revealed equally troubling patterns. Seven apps—HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC—were found to transmit sensitive details such as vehicle identification numbers, phone numbers, and precise geographic locations directly to advertising networks. Over 70 percent of the tested companion applications contacted at least five unique advertising technology domains.

Researchers expressed particular alarm at the pairing of a vehicle’s VIN with identifiable personal data. This combination allows data brokers to build detailed dossiers on individual drivers, linking their physical movements and vehicle ownership to their digital identities. Many of these data exchanges occur with companies that most consumers have never heard of and do not have a direct relationship with.

Industry Response and Legal Context

The legality of this data harvesting remains a subject of intense debate and regulatory scrutiny. Last year, the Federal Trade Commission penalized General Motors for allegedly illegally collecting and selling precise location and driving behavior data without obtaining informed consent. Other major automakers, such as Ford and Honda, have faced minor fines for creating opt-out processes that were overly difficult for customers to navigate.

While industry observers had long suspected that widespread data sharing was occurring, this practice had not been systematically investigated until now. Automakers offered mixed reactions to the new findings. Some defended their practices as legally compliant, arguing that they provide sufficient transparency through privacy policies. Others acknowledged the vulnerabilities identified in the study and have already issued software fixes.

For example, Honda requested that its analytics provider, Amplitude, delete all collected location data and updated the HondaLink app to cease transmitting geolocation information after the study’s preliminary results were shared. Despite these adjustments, the study underscores a broader industry trend where privacy controls are often secondary to connectivity features.

Implications for Consumer Privacy

The study serves as a reminder that modern vehicles are essentially global smartphones in terms of their data collection capabilities. As cars become increasingly connected, the amount of personal information they generate grows exponentially. This includes not only location history but also driving style metrics, such as acceleration patterns, braking intensity, and cornering force.

Consumers may assume that their privacy ends when they leave their home, but the data trail from their vehicle can reveal far more than they realize. From insurance risk assessments to targeted advertising campaigns, the potential for misuse of this data is significant. The lack of visibility into which companies receive this information leaves drivers with little meaningful control over their personal data.

As regulatory bodies continue to grapple with these issues, the automotive industry faces increasing pressure to adopt more transparent data practices. Until then, the average driver may find that their car is doing far more talking—and selling—than they might ever have imagined.