Browse
Log in / Register
Share
April 18, 2025 — Connected cars are raising urgent privacy questions because of how much personal information they collect. A new study from Northeastern University shows that automakers are handing drivers’ VINs, location coordinates and email addresses to third-party analytics companies and data brokers. The research involved 21 vehicles from 19 brands and was carried out with Consumer Reports, the non-profit media and consumer testing organization.
The investigation came shortly after a widely discussed New York Times report revealed that General Motors had shared driving data with insurance firms in ways that caused auto-insurance rates to rise for some customers. Northeastern’s team wanted to determine if that kind of sharing was widespread.
Modern cars, the study notes, are connected to the internet through multiple channels. They can use Wi-Fi hotspots, cellular modems, Bluetooth, cameras, microphones and GPS receivers. These connections deliver useful services but also create a continuous flow of sensor and usage data back to the manufacturer. According to the researchers, many drivers may not understand how much information leaves their vehicle, or what happens to it after it does.
To investigate that data flow, the professors and graduate students built a controlled test environment. They drove the vehicles while intercepting internet traffic at network points they controlled. Vehicle-to-cloud messages were encrypted, so the team could not read them easily. But the connected mobile applications on their own phones gave them a clearer view: because they controlled the handsets and their app-permission settings, they were able to capture app traffic to remote servers and decode what was being sent.
The decoded traffic showed that personal data was regularly transmitted to at least three outside companies: Adobe Analytics, a web analytics giant; Axiom, a data broker; and ContentSquare, a user behavior analytics vendor. VINs and email addresses were routinely sent, and in several cases the data also included geolocation.
Researchers describe VINs as “stable identifiers” that are unique and rarely change. They can serve as a digital anchor that connects a person’s car to their online behavior. If an advertising company sees the same VIN in automotive app data and in other tracked web or mobile traffic, it may be able to infer that a particular person visited a shopping site, watched a video channel, or used a financial app.
“These companies can use stable identifiers and personal information to implement cross-context tracking of users,” the authors wrote. In plain terms, that means the car you drive could become part of an advertising profile that follows you across the internet.
The research team also said that while car companies mention data sharing in general language in their privacy policies, they rarely list the exact companies receiving the information or the purposes of the data transfers. The team argued that vague consent forms do not help consumers make informed decisions.
“Most people would not expect their car to tell an advertising platform about their location,” said David Choffnes, a Northeastern cybersecurity professor and a co-author of the study.
Honda stands out in the study as an example of a company that acted quickly when presented with evidence of unnecessary data flows. Honda asked Amplitude, a product analytics firm, to delete the VIN and location data it had received from the Acura/Honda app. It also updated the app to stop sending geolocation to Amplitude. Honda’s spokesperson, Andrew Quillin, confirmed the move, adding that the data was never allowed for independent use or sale and that app usage is voluntary.
General Motors, which owns Cadillac, Chevrolet and Buick, told Northeastern Global News that it discloses data only to service providers helping deliver its services, and that those providers are contractually prohibited from selling or using the data for their own purposes. The company says it is committed to transparency and security.
However, Choffnes said contractual limits are not visible to consumers and offer little assurance about future data use. He argues that regulators need to create enforceable rules about what carmakers can collect, share and use. He also says consumers should not have to choose between hiding their location and being unable to use basic car features.
The research adds to a growing body of concerns about car privacy. In 2023, the Mozilla Foundation’s Privacy Not Included review of the automotive sector found that car brands are the worst category for privacy among the dozens of product types it evaluates. Mozilla researchers said none of the 25 car brands they reviewed met their basic privacy standards. They also cited examples of brands collecting data about drivers’ bodies, social networks and driving behavior.
There is also legislative and regulatory activity around this issue. California has enacted a number of privacy laws that apply to business data collection, and the Federal Trade Commission has pursued companies that buy and sell sensitive location data. In 2022, the FTC sued data broker Kochava, alleging that it had allowed clients to identify consumers at sensitive locations — such as health clinics or houses of worship — using location data. While that case has drawn attention to the broader data-broker economy, auto-generated data is an even newer layer of the problem.
Consumer advocates say car buyers need better tools to control their data. Some automakers give users an option to limit or disable connected services, but the Northeastern researchers say those options are often hidden or too broad. They argue that automakers should default to asking drivers to opt in before collecting or sharing data, rather than forcing them to navigate complex menus and privacy screens to get out of it.
“We’re in a situation where if you opt out of data collection, you mostly brick your car,” Choffnes said, noting that unlimited data sharing has become the default for connected vehicles.
For motorists who want to reduce the amount of data their car sends, privacy experts suggest a few immediate steps:
The Northeastern paper is scheduled for presentation at the ACM Internet Measurement Conference 2026, which runs from October 12 to 16 in Karlsruhe, Germany. The findings will add another layer of evidence to the ongoing debate about connected-car privacy, but researchers insist that more public pressure is needed.
“We don’t know what the companies are doing with this data,” Choffnes said. “That should become more apparent, but that’s exactly the kind of thing that should be regulated — because there’s a lot of potential harm.”
