Automatic Transmission – a data-privacy study of connected vehicles

Your car shares your location and personal data with advertisers and trackers, even when you try to opt out.

A study by Northeastern University researchers, in partnership with Consumer Reports, investigated the privacy implications of connected vehicles. They tested 21 late-model vehicles and 30 companion mobile apps, finding that the vast majority share data with third-party domains, including advertisers and trackers. Specifically, 19 out of 21 vehicles transmitted data to at least one third party over Wi-Fi, and 7 out of 30 companion apps sent sensitive identifiers such as VINs, emails, and phone numbers to third-party trackers. The researchers also noted that pairing a vehicle's companion app significantly increased its exposure to tracking companies. Manufacturers, when presented with these findings, largely attributed data sharing to consumer consent and the choice to use connected features, with Honda being a notable exception for improving its data collection practices.

The widespread data sharing observed in connected vehicles signals a significant privacy blind spot for consumers, as automotive manufacturers are treating vehicles as data-generating platforms akin to smartphones. The study reveals a complex ecosystem where data flows not only to the manufacturer but also extensively to third-party advertising and tracking networks, often without clear consumer control or understanding. This practice establishes a new frontier for targeted advertising and detailed consumer profiling, moving beyond online activities to include real-world mobility patterns.

This pervasive data leakage affects consumers by enabling granular profiling that can influence insurance rates, targeted marketing, and potentially other unforeseen uses of highly personal location and behavioral data. The findings challenge the notion of data ownership and control in the automotive sector, highlighting a critical need for regulatory oversight and greater transparency from manufacturers regarding their data-sharing practices and partnerships with third-party data brokers.