What Makes a Car 'Connected'?
A connected car is essentially a smartphone on wheels. It's equipped with an array of sensors, cameras, microphones, and its own internet connection, usually via a built-in cellular modem. This technology enables popular features like remote start, live
navigation, and over-the-air software updates. But it also means the vehicle is constantly generating and transmitting data — as much as 25 gigabytes per hour, according to some estimates. This data ranges from your location and speed to more granular details like braking habits and even in-cabin information. Carmakers built this data pipeline to power these convenient features, but once the infrastructure exists, there's a huge incentive to use it for much more.
The Landmark 'Automatic Transmission' Study
This is where the collaboration between Northeastern University and Consumer Reports becomes crucial. The study, titled 'Automatic Transmission', represents a powerful combination of academic rigor and consumer advocacy. Researchers at Northeastern's Cybersecurity and Privacy Institute tested 21 late-model vehicles from 19 different brands, along with 30 of their companion smartphone apps. The goal was to map where a car's data actually goes. By rerouting the vehicles' internet traffic through their own controlled networks, the team could observe which outside companies the cars and apps were contacting. Consumer Reports, a non-profit known for its independent product testing, provided its fleet of vehicles for the investigation, ensuring the study was grounded in real-world consumer products. This partnership gives the findings a unique weight, combining technical evidence with a clear focus on consumer protection.
Key Findings: A Web of Data Sharing
The results were revealing. Researchers found that 19 of the 21 vehicles tested sent data to at least one third-party company over Wi-Fi. More alarmingly, many of the companion smartphone apps were found to be sharing sensitive, personally identifiable information. Seven of the 30 apps transmitted details like phone numbers, email addresses, precise locations, and—most importantly—the Vehicle Identification Number (VIN). The VIN is a critical piece of data because, unlike an email address or phone number, it is permanent to the vehicle and can act as a stable anchor to tie a driver's identity to their movements and online activities. Among the recipients of this data were major tech and advertising companies, including Google, Meta, Microsoft, and Acxiom, a data broker.
The App is the Weakest Link
A surprising conclusion from the study is that using a car's companion app significantly increases a driver's data exposure. The researchers found that pairing a smartphone app to a vehicle roughly doubled the owner's exposure to advertising and tracking companies. For example, the Buick Envista and Nissan Ariya cars themselves contacted zero ad or tracking domains during testing. However, once their companion apps were paired, owners were exposed to 23 and 25 such companies, respectively. This happens because apps often contain pre-built pieces of code from third parties, known as SDKs, designed for tracking usage and showing ads. When you use the app to remote start your car, it's not just talking to the vehicle; it's often broadcasting your information to a host of other entities.
Automakers' Response and What It Means
When confronted with the findings, many automakers stated that the data flows were in line with their vendor contracts and privacy policies. Some argued their contracts prohibit third parties from reusing or selling the data for their own purposes, though the study's authors noted these limits are hard to verify. Others shifted the responsibility to the consumer, stating it is the owner's job to read and accept the terms for every third-party service, even for pre-installed software. This highlights a major disconnect: while car companies see data collection as a necessary part of business and innovation, consumers are often left in the dark, clicking 'agree' on lengthy privacy policies without fully understanding the implications. This can lead to tangible consequences, such as data being sold to insurance companies, potentially affecting premiums without the driver's explicit and informed consent.
