Researchers from Northeastern University, working with Consumer Reports’ Auto Test Center in Connecticut, examined 21 vehicles from model years 2022 through 2025 and 30 companion mobile apps between October 2024 and August 2025. To see where the cars were sending data, they created a custom Wi‑Fi access point on a Raspberry Pi and used tcpdump to log all packets, revealing the destinations but not the encrypted content. To isolate wireless signals, they placed vehicles inside a Faraday tent that blocked cellular transmissions with about 93 dB of attenuation, forcing any remaining traffic onto Wi‑Fi. For the companion apps, they installed custom root certificates on iPhones and routed traffic through mitmproxy, allowing them to decrypt and record the actual information transmitted while exercising every function such as remote trunk opening, geolocation checks, and service‑history reviews.
This image depicts a modern connected automobile similar to those tested for transmitting personal data to advertising and tracking companies.
The investigation found that 19 of the 21 vehicles contacted at least one third‑party domain over Wi‑Fi, including domains known for advertising and tracking. Seven of the 30 apps transmitted sensitive identifiers—vehicle identification numbers (VINs), email addresses, phone numbers, and precise geographic locations—to third parties associated with advertising and tracking. Pairing a companion app with a vehicle roughly doubled the average number of advertising/tracking companies contacted, and in some cases added more than two dozen new trackers to the vehicle’s data‑sharing profile. The top recipients of driver data named in the study include Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo, and nearly every automaker sent data to outside companies.
This image shows the experimental setup used to prevent cellular interference, allowing researchers to capture only Wi‑Fi traffic from the vehicles.
After being notified of the results, Honda stood out by instructing its vendor Amplitude to delete all previously received location data and to stop sending precise geolocation to a third‑party tracker, while other manufacturers tended to shift responsibility onto consumers, noting that data sharing is described in the terms and conditions that users accept when setting up connected‑vehicle features. Some companies warned that declining those agreements could lead to reduced functionality, serious damage, or even inoperability, as illustrated by Tesla’s warning that opting out may result in reduced vehicle functionality. The study highlights a substantial gap between what manufacturers publicly disclose about data collection and what actually occurs in the field, suggesting a need for greater transparency and clearer consumer controls to address the privacy risks inherent in the modern connected‑vehicle ecosystem.