A new study from Northeastern University and Consumer Reports found that connected vehicles and their companion apps routinely communicate with advertising, analytics and technology companies — sometimes sending identifiable information such as VINs, email addresses and precise location.
Modern cars are increasingly just computers on wheels. They connect to cellular networks, synchronize with phones, run apps, track location, receive software updates and offer services ranging from remote start to navigation and driver assistance.
That convenience also creates a substantial data ecosystem around the person behind the wheel.
New research from Northeastern University, conducted using Consumer Reports’ vehicles and testing facilities, provides one of the clearest pictures yet of what that ecosystem actually looks like. Instead of relying solely on manufacturers’ privacy policies, researchers measured network traffic leaving real vehicles and the mobile apps their owners use.
The results suggest that connected-car privacy is no longer simply a question of what information an automaker collects. Driver data can travel through a much larger network of manufacturers, software providers, analytics services and major technology companies.
The team examined 21 late-model vehicles and 30 manufacturer companion apps.
Of the 21 vehicles tested, 19 contacted at least one third-party company over Wi-Fi. The researchers found connections to organizations including Amazon, Google, Meta and Microsoft, alongside mapping, cloud, entertainment, advertising and analytics services.
The smartphone apps broadened that exposure considerably.
Twenty-eight of the 30 companion apps contacted at least one advertising or analytics company. Seven transmitted at least one piece of personally identifiable information to an outside company, including combinations of a vehicle identification number (VIN), owner information or precise geographic location.
The seven apps identified were myCadillac, myChevrolet, myBuick, myGMC, HondaLink, MyNissan and Lincoln. Consumer Reports reported that they shared VINs paired with either email information or location data.
That distinction matters. A VIN might not sound particularly sensitive: it is, after all, visible on the vehicle itself. But unlike a mobile advertising identifier, a VIN is a persistent identifier attached to one particular vehicle. Once it is linked with an email address, account identity or location, it can become a durable bridge between a physical vehicle and the person associated with it.
One of the most important parts of the study is how the researchers reached their conclusions.
Connected-car privacy research has often depended upon reviewing privacy notices and documenting what manufacturers say they collect or share. This team instead looked at what the technology itself was doing.
Researchers captured network traffic from vehicles and apps and, for part of the testing, used a vehicle-sized Faraday enclosure to block cellular communication, forcing observable traffic through infrastructure they could monitor. The study ran from October 2024 through August 2025 at Consumer Reports' Auto Test Center.
That doesn't mean the researchers could see everything. Embedded cellular connections, encryption, certificate pinning and subsequent server-to-server transfers can all make data flows difficult to observe.
If anything, that limitation is important. The study is evidence of data transmission the researchers could demonstrate, rather than a complete inventory of everything happening behind the scenes.
One of the clearest lessons from the research is that a connected vehicle cannot be assessed in isolation.
The actual environment may involve:
the driver → the vehicle → its sensors and software → the manufacturer's cloud services → a smartphone → the companion app → third-party services → advertising and analytics platforms
A consumer might reasonably think that installing an app to remotely start a car, check an EV battery or locate a parked vehicle creates a relationship primarily with the car manufacturer.
In reality, that application can introduce an entirely separate set of companies into the data chain.
This is why privacy risk can emerge even when no single piece of information appears especially dangerous on its own. Location, a VIN, an email address, a device identifier and driving behavior each tell part of a story. Joined together, they can create a much richer picture of a person's identity and activity.
There is already evidence that vehicle data can move beyond product analytics or personalized marketing.
In January 2026, the Federal Trade Commission finalized an order against General Motors and OnStar over allegations that they collected and sold drivers' precise geolocation and driving-behavior information without adequately notifying consumers or obtaining affirmative consent.
According to the FTC, data included behaviors such as hard braking, speeding and late-night driving. Consumer reporting agencies receiving the information could provide reports used by insurance companies to determine rates or eligibility. The FTC's order restricts GM's disclosure of covered data to consumer reporting agencies and requires additional consent, access, deletion and opt-out mechanisms.
That changes the way people should think about vehicle telemetry.
Data generated for one apparent purpose can acquire a very different meaning somewhere else in the ecosystem.
Driving feedback can become risk scoring.
Location can become pattern-of-life information.
A vehicle identifier can become a persistent identity link.
Convenience features can create additional tracking surfaces.
This is also a useful example of why cybersecurity and privacy cannot always be reduced to whether somebody made a mistake.
The normal sequence looks perfectly reasonable: Buy the car. Activate its features. Install the manufacturer's app. Pair your phone. Allow navigation to use your location. Use remote start. Drive.
You haven't clicked a suspicious link or ignored a security warning.
The risk emerges because ordinary human activity is taking place inside a complex data-producing environment that the human cannot easily see.
Even consent can become complicated. Automakers told Consumer Reports that many connected services are optional or opt-in, but researchers found that declining data collection can also mean losing useful functionality in some vehicles.
A checkbox may provide legal consent. It does not necessarily mean the person understands the architecture, the secondary uses of their information or the consequences of saying yes.
You probably cannot make a modern connected car completely data-free. But that does not mean there is nothing worth doing.
Start by treating your vehicle like another part of your digital life rather than purely as a mechanical appliance.
When buying or setting up a car, find out what connected services are enabled and whether they are necessary for the features you actually want. Review the privacy settings both inside the vehicle and in the manufacturer's app. Check phone permissions — particularly persistent location access — rather than accepting every permission automatically.
Secure the manufacturer's account with a unique password and multifactor authentication where available, and periodically review which people or devices have access to the vehicle.
Pay particular attention when circumstances change. A car should be digitally cleaned before it is sold or returned. Pairings should be removed from rental vehicles. Shared access deserves immediate review if there is a personal-safety or stalking concern.
And if a manufacturer offers access, deletion or opt-out rights, using them can help clarify what information exists and reduce unnecessary retention.
Connected-vehicle privacy may look like a consumer or "home and family" problem, but the boundaries are already beginning to blur.
A personal vehicle can travel to corporate offices, customer locations, critical infrastructure, government facilities or confidential meetings. An executive's repeated movement can expose patterns. A company phone may be paired with a privately owned vehicle. Fleet vehicles can generate detailed information about employees.
As our physical and digital environments become more connected, personal technology increasingly creates information with organizational significance.
Security teams do not necessarily need to start managing employees' cars. But they do need a broader understanding of where sensitive human activity now leaves digital traces.
Connected cars are useful precisely because they know more about their environment and their users.
The challenge is making sure people retain meaningful visibility and control over what happens to that information.
Northeastern's study matters because it moves the discussion beyond what a privacy notice says might happen and toward empirical evidence of what the system actually does.
For consumers, the immediate lesson is relatively simple: your car belongs on your personal cybersecurity and privacy checklist.
For manufacturers, regulators and security professionals, the question is harder.
As more everyday environments collect, connect and interpret human behavior, how much responsibility can reasonably be placed on the individual — and how much needs to be designed into the system itself?
That is becoming one of the central questions of human risk in a connected world.