A New Digital Spy
It's no secret that our phones and smart home devices collect data, but your car has quietly become one of the most powerful surveillance tools in your life. Researchers at Northeastern University set out to understand exactly what information modern
'connected cars' are gathering and, more importantly, where they are sending it. They investigated 21 vehicles from 19 popular brands, including models from 2022 to 2025. The team employed clever methods, including creating special networks to intercept data and even using a car-sized Faraday cage to block cellular signals and see what traffic was forced over Wi-Fi. Their findings paint a concerning picture: the majority of cars are not just communicating with the manufacturer for diagnostics; they are actively sending data to a host of third parties, including major tech companies and data brokers.
More Than Just Location
The sheer breadth of data being collected is alarming. While GPS location is a given, the study found that companion mobile apps for these vehicles were sharing a treasure trove of personal information. This included Vehicle Identification Numbers (VINs), email addresses, and phone numbers. A VIN is a unique identifier for your car that, unlike an advertising ID on your phone, cannot be reset. When a VIN is paired with your email address or phone number, it allows data companies to connect your driving habits to your broader online identity and purchase history. Some manufacturers' privacy policies even admit to collecting data on your 'sex life', health diagnostics, and genetic information. This transforms your car from a mode of transport into a detailed data profile on wheels, capable of tracking not just where you go, but your behaviours, preferences, and personal characteristics.
The Privacy Scorecard
While the study revealed a systemic issue across the industry, some brands were more aggressive in their data sharing. Researchers found that apps from General Motors brands—myCadillac, myChevrolet, myBuick, and myGMC—were particularly problematic, sending VINs to as many as 10 different companies, including Microsoft and Adobe. The HondaLink and MyNISSAN apps were also identified as sharing VINs along with other identifiers like location data. In total, 19 of the 21 vehicles tested were found to be sending data to at least one third-party company. Interestingly, the study noted that a vehicle's data exposure could double just by using its companion smartphone app. For instance, while the Buick Envista and Nissan Ariya cars themselves contacted no ad-tracking domains, their apps exposed owners to 23 and 25 ad and tracking companies, respectively.
Where Does Your Data Go?
The recipients of this data are a mix of familiar household names and obscure data firms. The study found that data was being sent directly from cars and their apps to tech giants like Google (Alphabet), Meta (Facebook), Amazon, and Microsoft. But it also went to advertising networks, data brokers like Acxiom, and even companies like Pinterest and Snap. This information is incredibly valuable. Insurance companies can use it to adjust premiums based on driving habits like hard braking or speeding, sometimes without the driver's full awareness. Marketers can use it to build sophisticated consumer profiles for highly targeted advertising. When asked for an explanation, many automakers stated that the data sharing was in line with their service contracts and that it was the owner's responsibility to accept terms for third-party services embedded in the car.
Can You Take Back Control?
For the average car owner, opting out is incredibly difficult, if not impossible. The complex web of privacy policies and in-car settings makes it challenging to understand what you're agreeing to. Unlike a phone, where you can often turn off location services, there is frequently no simple 'off switch' for a car's telematics. This lack of control has raised significant concerns, with one 2024 study finding that 96% of people believe they should own and control the data their car generates. While there are basic steps you can take, such as using strong passwords for companion apps and being cautious about which third-party services you link, the fundamental data collection is often a condition of using the vehicle's modern features. The Northeastern study highlights that this is a systemic issue, one that may require stronger regulatory frameworks to truly give consumers control over their own data.
