What Did the Study Actually Find?
Researchers at Northeastern University, in partnership with Consumer Reports, conducted a large-scale analysis of modern vehicles to see how much they spy on their drivers. They tested 21 cars from 19 different brands and their companion smartphone apps.
The core finding was that most cars and nearly all their apps are not just communicating with the manufacturer; they are also sending information to a host of third-party companies, including data brokers, advertising firms, and analytics giants. The study found that 19 of the 21 vehicles tested sent data to at least one outside company. When the researchers included the smartphone apps that pair with these cars, the data sharing expanded significantly, often doubling the number of third parties receiving information.
What Kind of Data Is Being Shared?
The data being collected is far more personal than simple diagnostic information. The study found that companion apps for several major brands were sharing personally identifiable information. This includes unique identifiers like the Vehicle Identification Number (VIN), which is permanent, paired with the owner's email address or precise geographic location. This combination makes it easy for companies to link a specific car to a specific person and their driving habits. The data can include how you drive (hard braking, acceleration), where you go, and what time of day you travel. In essence, your vehicle and its app can create a detailed profile of your daily life and personal habits.
Who Is Receiving This Information?
The list of recipients is extensive and includes many familiar tech giants as well as lesser-known data brokers. The Northeastern study identified data flowing to companies like Google, Meta (Facebook), Microsoft, and Adobe. It also uncovered connections to major data brokers like Acxiom and analytics firms such as Amplitude. These are companies that specialize in collecting vast amounts of consumer data from various sources to build detailed profiles for targeted advertising and risk assessment. This information can then be sold to other businesses, including insurance companies, banks, and retailers, who might use it to determine everything from your insurance premium to the loan terms you're offered.
Why This Matters for Car Owners in India
While the Northeastern study focused on vehicles sold in the US, the findings have global relevance, including for the rapidly growing Indian car market. Connected car technology is becoming a standard feature in many new vehicles sold in India. Previous studies have shown that Indian consumers are already concerned about data privacy in connected vehicles. The fundamental technology and business models are the same worldwide: automakers see data as a new revenue stream. As India finalises its own Digital Personal Data Protection (DPDP) framework, how this vehicle data is handled will become a critical issue. The lack of transparency about what data is collected and who it's shared with is a universal problem that affects every driver of a modern, connected car.
Is It Possible to Opt Out?
Unfortunately, opting out is difficult and often comes at a cost. Many connected features, from in-car navigation and traffic updates to over-the-air software updates, are dependent on data collection. Trying to disable data sharing can sometimes lead to reduced functionality or even warnings of 'serious damage' from the manufacturer. Consent is often buried within lengthy and complicated privacy policies that most users accept without reading. Automakers often place the responsibility on the owner to read the terms for every single service, including for pre-installed software. This creates a situation where consumers unknowingly agree to widespread data sharing just by using their car as intended.
