The 21st century, along with every money-hungry company on the planet, is here for your data. Automated license plate readers are collecting a driver’s every move and that shiny new car in the driveway is in on the fun. And a new study just illuminated how much data is coming from your car, and who’s on the receiving end. If you’re one of those people who likes to opt out of data collection on your phone, apps, and computers, you’re not going to enjoy this.
Northeastern University researchers collaborated with Consumer Reports to take a look at the data “connected” vehicles are collecting and tracking who it’s shared with. The study used 21 vehicles borrowed from Consumer Reports’ fleet, covering 19 brands sold in the U.S., along with companion applications for smartphones such as HondaLink, MyNissan, and myCadillac. Vehicle model years were 2022 to 2025.
Collecting the data wasn’t without its complications. Northeastern researchers had to find and build clever ways to reroute Wi-Fi and cellular signals from the cars to their data collectors — same with the applications. For EVs, Northeastern used a Faraday Cage tent that could block cellular signals and see if that forced the data to be rerouted to Wi-Fi.
‘Privacy and the connected vehicle ecosystem’
What the researchers found is that privacy is relative, if not nonexistent when drivers own and drive a connected vehicle. Between the cars and their apps, data was sent to several large companies: Alphabet (which owns Google), Amazon, Spotify, Microsoft, and Meta (which owns Facebook). Another gem in the top 10 was Liberty Media Corporation, which owns both Formula 1 and MotoGP.
Tracing where the data went gets more strange as you look further into what the vehicles and apps are sending. Vehicles were sending data to third parties like Yahoo, Comscore, Comcast, X, Disney, Nielsen Holdings, and the friendly neighborhood owners of Nextdoor. As for the apps’ data, strange names to come up on the list included Pinterest, Reddit, Docusign, Dun & Bradstreet, and a software company called Press Ganey Forsta. If you’ve ever been to a doctor’s office or hospital, chances are you’ve received surveys asking how your visit went from Press Ganey.
A handful of the brands tested were found to be sharing vehicle identification numbers (VINs) with third-party sites, along with an identifier such as your location, e-mail address, and phone number. What that means for the driver is that vehicle is tied to information that shows who owns it, which can then be tied to specific behavior data and purchase history from other apps they let collect that data. The offenders were Honda, Nissan, Lincoln, and the GM suite of Cadillac, Chevrolet, Buick, and GMC.
Opt-in to drive, opt-out with problems
Researchers later told manufacturers what they’d found. After the interaction, Honda asked its third-party app to delete all received location data, and updated its app to no longer collect and send that data. Other manufacturers, though, were less concerned.
Northeastern asked every brand in the study — aside from Fisker, which had folded before its conclusion — to explain why this data was being shared with third-party companies. Many said the sharing was in line with third-party service contracts. They also sorta shrugged and said it was part of the embedded browser that the vehicle’s application relies on. Three manufacturers said their apps would prompt users to accept or reject cookies, but researchers didn’t always find that to be so.
Manufacturers’ other explanation for data sharing was that sharing was on the consumer. Some vehicles do offer you a “choice” to opt out of data, but you risk bricking of the vehicle. Northeastern notes that Tesla’s opt-out warned, “This may result in your vehicle suffering from reduced functionality, serious damage and inoperability.” Rivian’s warning was similar: “It will limit or disable certain functionality in the vehicle (e.g., navigation, lane keeping assistance, and over-the-air updates, which provide new features, better performance, safety enhancements, and bug fixes).” The choice is truly yours: drive the vehicle and let it collect data, or never drive it again.
For a society that’s been vehemently against the collection of data via cameras and AI, the data coming from cars seems almost as problematic. Especially for those in GM-branded vehicles, Nissans, and Lincolns. It sure makes U.S. Transportation Secretary Sean Duffy’s “Freedom Cars” look more and more like a good idea.
