Northeastern study: 19 of 21 connected cars share driver data with Google, Meta and others

What the study tested

Researchers at Northeastern University, working with Consumer Reports, tested 21 late-model vehicles from 17 automakers — among them GM's Cadillac and Chevrolet brands, plus Ford, Lucid, Rivian, Tesla and Toyota — and 30 companion mobile apps. Their aim was to measure what networked cars and their software actually transmit. According to TechCrunch, the peer-reviewed study was set to be published in the week of the report.

The headline number: 19 of the 21 vehicles sent traffic to at least one third party, and the recipients named include Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo.

Apps carry the most sensitive data

Seven of the 30 apps transmitted sensitive details — vehicle identification numbers, email addresses, phone numbers and precise location — to companies tied to tracking and advertising. Often, the researchers found, a single third party received multiple types of information about the same driver. That combination is what lets advertisers and data brokers assemble detailed consumer profiles, the study concludes — profiles that are then sold to a range of buyers, including insurers and banks, making them hard to escape.

The companion app also acts as a multiplier. When researchers paired an app with its vehicle, exposure to advertising and tracking firms roughly doubled.

Automakers deflect, with one exception

The findings were shared with the manufacturers, and all of them except Honda deflected responsibility — frequently onto consumers themselves, the researchers said. Honda responded differently: it improved its data collection practices after seeing the results and ordered its vendor Amplitude to delete all geolocation data it had received.

Several automakers told Consumer Reports that some links inside their apps open outside web pages, which may carry cookies that gather customer information. Whatever route the data took, drivers were never informed, the researchers note.

Why it matters

It is not news that cars collect driving data — earlier investigations and lawsuits, including cases involving data reaching insurance companies, established as much. What this study contributes is scale and specificity: nearly every vehicle tested communicated with outside companies, and the very apps that provide remote start, remote unlock and similar conveniences make the situation measurably worse. A driver who wants the features the car was sold with has no practical way to opt out short of not using them. And because the profiles built from this data flow to insurers and banks, the consequences go beyond targeted advertising into areas like pricing that consumers cannot easily see or contest. For regulators weighing connected-car privacy rules, and for buyers weighing convenience against surveillance, the study offers some of the clearest quantified evidence yet.