A study from Northeastern University and Consumer Reports examined 21 late-model vehicles and found that every single one transmitted data to a third-party domain over Wi-Fi. More than half contacted companies specializing in advertising, tracking, or analytics, such as Adobe, LexisNexis, and Amplitude. The researchers used a Raspberry Pi to intercept Wi-Fi traffic and a Faraday tent to force cellular traffic onto a controlled connection, revealing the scale of data sharing without decrypting payloads.
The study also looked at companion mobile apps, uncovering that seven apps—including HondaLink, Lincoln, and myChevrolet—sent vehicle identification numbers, phone numbers, and precise locations to advertising networks. Over 70 percent of the tested apps contacted at least five tracking domains. The combination of VINs with personal data is especially concerning, as it allows data brokers to build detailed profiles of individual drivers.
Automakers responded unevenly. Some defended their practices as legally compliant, while others acknowledged issues and issued fixes. Honda, for example, asked its analytics provider to delete collected location data and updated its app to stop transmitting geolocation. The findings come amid regulatory scrutiny, including a recent FTC penalty against General Motors for selling driving data without consent, and highlight how little control consumers have over information their vehicles collect and share.