Study Reveals Data Transmission from Connected Vehicles

An investigation by Northeastern University in Boston has found that many modern connected vehicles transmit extensive data to companies such as Google, Meta, and Amazon. The study, which will be published this week, analyzed 21 vehicles from model years 2022 to 2025, as well as 30 associated manufacturer apps. According to Consumer Reports, 28 of the 30 tested apps transmitted data to at least one external company in the advertising or analytics sectors. The researchers documented for the first time in detail what information is exchanged between vehicles, manufacturer apps, and third-party companies. Recipients of the data include not only the major tech companies but also Microsoft, Pinterest, Snap, Yahoo, and Reddit.

The investigation once again raises questions about data privacy and confirms concerns that cars are functioning as data collectors. Particularly alarming is the fact that some apps and vehicles have shared personal information. This includes vehicle identification numbers (VINs), email addresses, names of vehicle owners, and precise location data. Four apps from General Motors for Cadillac, Chevrolet, Buick, and GMC, as well as apps from Honda, Nissan, and Lincoln, reportedly transmitted VINs in combination with other sensitive information. The combination of vehicle identification numbers with other personal characteristics allows for a connection to be made between a vehicle and existing consumer profiles.

Such profiles are sold by data brokers to banks, insurers, lenders, and dealers. These profiles may contain information about online behavior and the use of services. However, the investigation does not show that every recipient uses all of this data for commercial purposes. Several manufacturers told Consumer Reports that certain third-party providers are not allowed to use or sell data independently. These statements raise questions about transparency and the actual use of the collected data.

The researchers captured the data traffic from 21 cars and documented connections to advertising, tracking, and analytics companies. The differences between the vehicles were significant, indicating different approaches by manufacturers in handling user data. Tesla, Cadillac, and Chevrolet showed particularly high numbers of connections to external data recipients. The complete investigation will be published this week and could have far-reaching implications for the discussion on data privacy and security in the automotive sector. The findings could also lead to regulatory measures as concerns about data privacy in the automotive industry grow. The Northeastern University study is expected to be published on October 1, 2026, and could set new standards for handling user data in connected vehicles.