Your car and its mobile app probably transmit all kinds of data to tech companies

Modern vehicles built with connected car technology like WiFi and GPS collect mountains of data about their owners. And this data won’t remain private, according to a new study by researchers at Northeastern University.

This conclusion is not new: There have been numerous investigations and lawsuits revealing how driving data is collected and shared with third parties, including insurance companies. What the study reveals is how large the problem is and how difficult it is for consumers to avoid it unless they use the vehicle or its convenient features like remote start and unlocking.

Researchers in collaboration with Consumer Reports tested 21 late-model vehicles from 17 automakers, including GM’s Cadillac and Chevrolet brands, as well as Ford, Lucid, Rivian, Tesla, Toyota and others. They also examined 30 companion mobile apps to “understand the privacy implications of the connected vehicle ecosystem.” The peer-reviewed study will be published this week.

The implications aren’t great for consumers, whose data is shared with tech companies including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo.

Nineteen of the 21 vehicles tested sent traffic to at least one third party, and seven of the 30 apps provided sensitive data such as vehicle identification number (VIN), emails, phone numbers and precise location to third-party companies associated with tracking and advertising.

According to the findings, this approach often went further, sending multiple forms of information to the same third party, a scheme that allows advertisers and data brokers to create in-depth consumer profiles. These profiles can be especially difficult for consumers to shake because they are sold to a variety of companies, including insurers and banks.

When researchers paired the companion app with the vehicle, exposure to advertising and tracking companies nearly doubled.

The findings were shared with different manufacturers, and all except Honda shifted the blame elsewhere and often to consumers, the researchers said. (Honda responded by improving its data collection practices after learning of the findings and ordered its supplier Amplitude to delete all geolocation data it had received.)

Several automakers told Consumer Reports that some links in their companion apps were opening outside of web pages, which may include cookies that collect customer data. Regardless of how this data was collected, drivers were not informed.