Research reveals extensive tracking and data sharing practices embedded in modern connected vehicles

A Northeastern University and Consumer Reports study of 21 connected vehicles found that cars transmit data to numerous advertising, tracking, and analytics domains, with Tesla models sharing information with over 70 different domains. Testing revealed that vehicles contact first-party manufacturer domains universally, while some models like Buick and Mercedes-Benz limited external connections, and companion mobile apps significantly increased data exposure. Researchers used network traffic analysis in standard and controlled environments to map data flows, though packet-level inspection proved impossible due to encryption security measures.

Researchers employed network traffic analysis to study 21 vehicles, monitoring which external servers and services the cars contacted during various conditions—parked with the engine running, actively driven, and with infotainment systems engaged. The investigation revealed dramatic differences in manufacturer approach: some automakers implemented minimal external data sharing beyond their own servers, while others permitted vehicles to communicate with dozens of third-party companies involved in advertising, analytics, and content delivery.

The companion mobile applications associated with these vehicles presented an additional privacy concern. Testing of 30 different car apps demonstrated that using manufacturer-provided smartphone applications could introduce users to more than 20 additional tracking and advertising entities not encountered through vehicle-only usage. This finding suggests that the full scope of data collection extends beyond the vehicle itself to encompass the broader ecosystem of connected services.