19 of 21 Connected Cars Sent Data to Third Parties: Study

Much of what we know about car privacy comes from reading privacy policies. A team at Northeastern University did something harder. It parked 21 late model vehicles at Consumer Reports' Auto Test Center in Connecticut, put a Raspberry Pi between each car and the internet, and decrypted traffic from 30 automaker companion apps on test iPhones. The peer reviewed paper, titled Automatic Transmission, measures connected car data sharing on the wire instead of on paper.

Consumer Reports published the findings on September 29, 2026. The short version: 19 of the 21 cars talked to at least one outside company over Wi-Fi, and seven of the 30 apps handed identifiers such as VINs, email addresses and precise location to advertising and analytics firms.

Key Takeaways

• Northeastern University researchers tested 21 vehicles from 19 brands and 30 companion apps between October 2024 and August 2025, according to the paper.
• 19 of the 21 vehicles sent Wi-Fi traffic to at least one third party, and 11 contacted at least one advertising, tracking or analytics domain.
• Seven of the 30 apps transmitted a VIN, email address, phone number or precise location to advertising and analytics companies, and six paired the VIN with a second identifier.
• GM's four apps (myCadillac, myChevrolet, myBuick and myGMC) each sent VINs to ten companies: Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.
• Honda told the researchers it asked analytics vendor Amplitude to delete the location data it had received and updated the HondaLink app to stop sending it.

What Did the Researchers Test, and How?

They tested two things: the cars' own network traffic and the traffic of the phone apps that control them. Each vehicle joined a custom Wi-Fi access point on a Raspberry Pi that logged every packet with tcpdump. It was measured idle, then with testers working every control and infotainment menu, then driven at 5 to 45 mph with hard braking and swerving. Eleven electric vehicles also went into a car sized Faraday tent that blocked cellular signals, to see whether their traffic would fall back to Wi-Fi.

Almost all of the cars' traffic was encrypted, and every vehicle rejected the researchers' forged certificates. For vehicles, the paper shows who was contacted, not what was said.

The apps are different. The team installed each one on an iPhone with a custom root certificate, routed it through mitmproxy, and had a Consumer Reports employee log in with an account tied to a real car on the lot. They accepted every permission request, including tracking and location, then searched the decrypted traffic for that account's identifiers in plain form and as MD5, SHA1 and SHA256 hashes.

What Did the Cars Send on Their Own?

Nineteen of the 21 vehicles contacted at least one third party over Wi-Fi, the number the project page leads with. Only the Buick Envista and Mercedes EQS stuck to a single manufacturer domain. That figure needs care, because third parties here include navigation providers and content delivery networks. The sharper one in the paper is that 11 vehicles contacted at least one domain classified as advertising, tracking or analytics (ATA).

The Tesla Model 3 reached 34 ATA domains and the Cybertruck 23, followed by the Cadillac Lyriq at 10. Thirteen cars contacted Google ATA domains. Some of those, such as doubleclick.net and googlesyndication.com, were in the authors' words "not necessary for core services."

Two results cut against expectations. Given 2024 reporting on driving data reaching insurers, the team expected cars to phone out more when driven recklessly. They saw less third party traffic while driving than while someone used the infotainment screen, though several cars switch Wi-Fi off once in motion and cellular traffic stayed out of view. The Faraday tent mattered too: with cellular blocked, seven of the 11 EVs revealed more destinations, including 27 extra ATA domains for the Tesla Model 3.

Which Apps Sent Identifiers to Trackers?

Seven apps did: myCadillac, myChevrolet, myBuick, myGMC, HondaLink, MyNISSAN and Lincoln. Table 6 of the paper lists what each one sent and to whom.

Six of the seven paired the VIN with a second identifier sent to the same company, the combination the authors flag as a cross context tracking risk. Consumer Reports' summary groups Lincoln with them, but the paper's table shows the Lincoln app sending a VIN alone. The sources also differ on reach: Consumer Reports says 28 of 30 apps sent data to at least one outside advertising or analytics company, while the paper's appendix lists 29 apps with at least one ATA domain and only the Genesis app with none.

The apps are where most of the exposure comes from. As a car, the Buick Envista contacted no third parties at all. Its myBuick app contacted 47 ATA domains, tied for second highest among the 30 apps. For most vehicles, adding the companion app at least doubled the number of ad and tracking companies reached. The quietest car on the lot came with one of the noisiest apps.

Why Is a VIN Plus an Email Address So Durable?

A VIN cannot be reset, and an email address rarely is. Federal rule 49 CFR 565.13 requires every VIN to be 17 characters and bars any two vehicles built within a 60 year period from sharing one. The authors compare it to a phone's advertising ID, with one difference: phones let you reset that ID, "while VINs are subject to legal restrictions and cannot be changed." A VIN alone is semi public, readable through the windshield. Tied to an email address inside an ad platform, it lets a company link a specific car owner to behavioral data and purchase history from other websites and apps.

Consumer Reports adds the structural point. Recipients include Alphabet, Amazon, Meta, Microsoft, Pinterest and Reddit, and "Many of these companies play two roles in the driver data ecosystem, as both providers of software (such as the Android Automotive operating system) and as operators of advertising 'auction' platforms that marketers use to target specific types of customers. As such, the companies that collect driver data are often the first node in a vast personal data ecosystem." On the web, that auction layer publishes its own roster, which is what DecryptAds reads to map who tracks you. Those files say nothing about analytics code inside a mobile app.

What This Means for Your Inbox

The email address you typed into a car app is the piece of this that travels furthest. Five of the seven apps sent it to at least one outside company: Adobe, ContentSquare or Alchemer. The researchers searched for it in plain form and hashed, and a hashed address still works as a match key, because the same address always produces the same hash.

You reuse that address everywhere: shopping accounts, loyalty programs, newsletters. The privacy policies behind those seven apps did say personal information might go to third parties. They did not say which ones or why. Washington's attorney general listed limited visibility into data broker practices among four recurring problems in the state's first Data Privacy Report.

How Did Automakers Respond?

Mostly by pointing at contracts, browsers and customers. The researchers disclosed their findings to 17 of the 18 manufacturers in the study (Fisker had gone out of business), and 14 replied. All 14 said the flows matched their contracts with service providers. Five blamed web pages opened in an embedded browser; three of them said those pages show a cookie prompt, which the team's recordings did not always find. Seven said it is the owner's job to read and accept each third party's terms, even for software that ships with the car.

Opting out has a price. The paper quotes Tesla's warning to owners who decline its data sharing agreement: "This may result in your vehicle suffering from reduced functionality, serious damage, or inoperability." General Motors, Honda, Nissan and Stellantis told Consumer Reports that some recipients are prohibited from independently using or selling the data.

Honda was the one company that changed something. It asked Amplitude to delete the location data and updated HondaLink to stop sending it. The Record reported on September 30 that none of the automakers it named had immediately responded to its request for comment.

Where Do Regulators Stand?

Regulators have gone after one pipeline, and this study documents a different one. In May 2024 FTC staff warned automakers that geolocation data is sensitive, adding: "Surreptitious disclosure of sensitive information can be an unfair practice." In January 2026 the Commission finalized an order that puts a five year ban on GM disclosing geolocation and driver behavior data to consumer reporting agencies.

California followed on May 8, 2026 with a $12.75 million settlement, subject to court approval, that bars GM from selling driving data to consumer reporting agencies, including data brokers such as LexisNexis and Verisk, for five years. We covered the terms in our piece on GM's record CCPA fine.

Both remedies target driving data sold to consumer reporting agencies. The Northeastern team measured something else: identifiers moving through analytics and advertising code inside apps, to companies such as Adobe, Google and Meta. The paper does not claim these flows breach either order, and neither do we.

What Can Drivers Do Right Now?

You cannot audit an app's traffic yourself, but you can cut down what it has to share. The study tested none of these steps; the researchers accepted every prompt on purpose.

• Decline tracking on your phone. On iPhone, open Settings, then Privacy & Security, then Tracking. Apple says an app told not to track cannot access the advertising identifier and "is also not permitted to track your activity using other information that identifies you or your device, like your email address."
• Tighten location access. In Location Services, set the car app to While Using the App and turn Precise Location off if the features you need still work.
• File the three requests. Consumer Reports lists them: opt out of sale or sharing, limit use of sensitive personal information, and delete. Automakers usually take them through an online privacy form or the app's settings. Expect tradeoffs such as losing remote door locking or crash detection.
• Use your state's law. California residents have those rights under the CCPA, and businesses must respond to a deletion request within 45 calendar days. The state's free DROP platform sends one deletion request to more than 600 registered data brokers.
• Give the app its own email address. Where an app supports Sign in with Apple, Hide My Email generates a unique, random address that forwards to your inbox. It will not stop sharing, but it denies recipients an address that matches your other accounts.

What the Study Could Not See

The authors call their results a lower bound. They could not decrypt vehicle traffic, watch cellular traffic outside a single Tesla Model 3, intercept pinned first party domains inside apps, or see data passed server to server once it reaches an automaker. App testing ran on iPhones only. The fleet was whatever Consumer Reports had on its lot, a sample the team estimates would have cost over $1.2 million to buy.

Coauthor Sarah Elizabeth Gillespie gave Consumer Reports the blunt version: "It does not appear that a customer can buy a new car that does not track you." The paper goes to IMC '26 in Karlsruhe, October 12 to 16. The open question is whether regulators will treat a VIN sent to an ad platform the way they treated driving data sold to data brokers.