Connected Vehicles' Data Sharing: A Privacy Concern for Owners
Modern automobiles, increasingly reliant on advanced connectivity, are routinely transmitting vast amounts of operational and personal data to various external entities, a practice often unbeknownst to their owners. A comprehensive investigation into 21 different connected vehicles and their associated mobile applications has unearthed extensive data sharing with a multitude of third-party advertising, tracking, and analytics companies. This phenomenon underscores a growing privacy challenge in the automotive industry, where the line between essential vehicle functions and pervasive data collection has become increasingly blurred.
Between October 2024 and August 2025, researchers from Northeastern University, in collaboration with Consumer Reports, conducted an in-depth analysis of these vehicles. Their methodology involved meticulous scanning of Wi-Fi and cellular data streams, probing infotainment systems, and even isolating cars in specialized Faraday tents to monitor their communications. The findings were revealing: 19 of the 21 tested vehicles were actively communicating with at least one external third-party service provider. More than half of these vehicles were found to be contacting domains classified as advertising, tracking, or analytics (ATA) providers, including major players such as Alphabet, Amazon, Mapbox, and Meta.
Leading the list of vehicles with the most extensive data sharing were Tesla's Model 3, which connected with 34 unique ATA domains, and the Cybertruck, linking to 23. Cadillac's Lyriq followed with 10 unique ATA domains, while Lucid and the Chevy Blazer registered 9 and 7, respectively. Interestingly, some models like the Nissan Ariya, Land Rover Range Rover, Mercedes EQS, and Buick Envista showed no contact with ATA domains. When confronted with these findings, 14 of the 18 automakers that responded to the researchers' inquiries largely attributed this data transfer to contractual agreements with their third-party service providers, claiming that these contracts restrict the use of personally identifiable information. Notably, Honda reportedly agreed to reclassify the Vehicle Identification Number (VIN) from a commercial item used for marketing after the study's intervention. Several manufacturers also shifted responsibility to the consumer, suggesting that it is the owner's duty to review the terms of service for embedded vehicle functions like Spotify or Google's operating system. Furthermore, some companies, such as Tesla and Rivian, have been criticized for implying that disabling telematics and data sharing might lead to reduced vehicle functionality.
This study reiterates a recurring theme in the era of interconnected vehicles: the significant privacy implications for modern car owners. As automotive manufacturers increasingly embrace software-defined vehicles, they are poised to generate substantial recurring revenue streams from collected data and subscription services. While there are undeniable benefits to connected car features, such as remote control via mobile apps and advanced telematics, the prevalent data sharing practices raise serious consumer protection concerns. When opting out of data sharing compromises essential vehicle functions, it becomes a critical issue for consumers. Individuals who desire an electric vehicle experience but prioritize digital privacy may need to carefully consider their choices, or await future developments in vehicle technology that offer greater transparency and control over their personal data.