The Car Is Just the Beginning
Modern vehicles are often described as 'smartphones on wheels', packed with sensors, software, and always-on internet connectivity. This transformation offers convenience, like remote start and real-time navigation, but it comes at a cost to your privacy.
Sparked by reports of automakers selling driver data to insurance companies, researchers at Northeastern University, in partnership with Consumer Reports, decided to investigate. They conducted the first large-scale study to map the entire data ecosystem, testing 21 cars from 19 different brands and their 30 companion mobile apps to see what data is collected and where it flows. The goal was to understand the gap between what carmakers disclose and what actually happens with user data.
A Shocking Trail of Digital Breadcrumbs
The study's findings paint a concerning picture. Researchers discovered that 19 of the 21 vehicles tested sent data to at least one third party, and more than half contacted advertising or analytics companies directly. The companion apps on your phone were found to be even more revealing. Pairing a phone app to a car could double its exposure to advertising and tracking companies, in some cases adding over 20 new ones. Seven of the 30 apps tested were found to be transmitting personally identifiable information (PII), including phone numbers, precise locations, and—most significantly—the Vehicle Identification Number (VIN). Some apps from major brands like GM, Honda, and Nissan were caught sending VINs paired with email addresses or location data to third parties.
Who Is Watching You Drive?
So, where does all this data go? The study found that information from both the cars and their apps was being sent to a host of familiar Big Tech companies, including Google's parent company Alphabet, Amazon, Microsoft, and Facebook's parent company Meta. Beyond these giants, data was also sent to data brokers and analytics firms. The problem is that a VIN is a permanent identifier for your car; unlike a phone's advertising ID, it cannot be reset. When a VIN is combined with an email address or other personal details, it allows companies to build a detailed, long-term profile of a car's owner, linking their driving habits with their online browsing and purchasing history. This creates a rich dataset that is highly valuable for targeted advertising and consumer profiling.
The Real-World Risks for Drivers
This constant data collection isn't just a theoretical privacy issue; it has tangible consequences. In the past, data shared by automakers has allegedly been used by insurance companies to create a 'driver score' that can influence premiums, sometimes without the driver's full awareness. While the Northeastern study focused on identifying data flows rather than their end use, the potential for misuse is clear. The collection of precise location, driving habits like acceleration and braking, and even the time of day you drive can be used to make judgments about you. Furthermore, many automaker privacy policies are intentionally vague, using complex legal language to gain consent without clearly stating which third parties receive data or why. Several manufacturers told the researchers that it is the owner's responsibility to read and accept the terms for every service in the car.
Can You Take Back Control?
Completely opting out of this data collection ecosystem is difficult. Many connected features, including safety functions like crash detection or conveniences like remote unlocking, are tied to data transmission. Declining to share data can mean losing access to features you paid for. However, consumers are not entirely powerless. You can start by being more selective about using companion apps, as the study showed they significantly increase data exposure. Reviewing your phone's app permissions and the privacy settings within the car's infotainment system can offer some level of control. Some automakers also provide online portals where owners can submit requests to limit data sharing or delete their information. While these steps are a start, the study highlights a critical need for greater transparency from automakers and stronger data privacy laws to protect consumers in an increasingly connected world.
