Study: 19 of 21 Connected Cars Share Data with Third Parties
Original: Automatic Transmission – a data-privacy study of connected vehicles
Why This Matters
With 75%+ of new vehicles connected by default, this is the first systematic evidence of how broadly car data reaches ad-tech firms.
Northeastern University researchers, partnering with Consumer Reports, tested 21 vehicles and 30 companion apps between October 2024 and August 2025. They found 19 of 21 cars contacted third-party domains over Wi-Fi, and 7 of 30 apps transmitted sensitive identifiers — including VINs — to trackers.
A Northeastern University team conducted what they describe as the first large-scale measurement study of the connected-vehicle data ecosystem, working with Consumer Reports, which provided a test fleet valued at over $1.2M. The study covered 21 late-model vehicles across 19 brands and 30 manufacturer companion apps, tested in controlled conditions from October 2024 to August 2025.
Key findings: 19 of 21 vehicles sent traffic to at least one third-party domain — including advertisers and trackers — over Wi-Fi. Among the apps, 7 of 30 transmitted personally identifiable information (PII) to third-party trackers, and 5 of 30 sent VIN numbers bundled with additional PII. The researchers note that once data leaves the vehicle or app, consumers have no meaningful control over how it is used or resold.
The team also documented manufacturer responses through a formal disclosure process, providing insight into how automakers view their own data-sharing practices. The paper is peer-reviewed and accepted for publication at IMC '26. Over 75% of vehicles sold globally now ship with built-in cellular, Wi-Fi, and GPS connectivity, making the scope of this data collection industry-wide rather than limited to any single brand.
Source
automatictransmission.khoury.northeastern.edu — Read original →