Browse
Log in / Register
Share
Your car is probably saying more than it should. A study from Northeastern University and Consumer Reports, still circulating this week, found that modern connected vehicles and their companion smartphone apps quietly send personal data to dozens of third-party companies. The researchers examined 21 vehicles across 19 brands sold in the United States, all from the 2022–2025 model years, and they did it by intercepting the actual data flowing out of cars rather than just reading privacy policies. As of May 9, 2026, the picture is still troubling: automakers are collecting more than drivers realize, and many are sharing it in ways most owners never agreed to.
That finding matters because cars are not just machines anymore. They are rolling data-collection devices that track where you go, how you drive, and even what you type into the dashboard. If you have spent years carefully declining cookies on your phone and laptop, your car may have undone a lot of that work.
The Northeastern team didn't rely on the polite White Papers automakers publish about privacy. Instead, they found clever ways to reroute Wi-Fi and cellular signals from the vehicles to equipment they controlled. For electric vehicles, the researchers used a Faraday cage tent, a metal-enclosed space that blocks cellular signals, to determine whether the cars would push the same data out over Wi-Fi when the cellular connection was removed.
The answer was yes. Cars kept transmitting.
The same technique was used on smartphone apps that pair with the vehicles, including HondaLink, MyNissan, and myCadillac. What emerged is a web of data sharing that most drivers would never expect.
Between the cars and their companion apps, data was sent to several major technology companies, including Alphabet, the parent of Google, along with Amazon, Spotify, Microsoft, and Meta, the parent of Facebook. The list also included Liberty Media Corporation. That name may not be familiar, but the company owns both Formula 1 and MotoGP.
Then things get stranger. Vehicle data was shared with Yahoo, Comscore, Comcast, X, Disney, Nielsen Holdings, and even Nextdoor, the neighborhood social network. The app-side data included names that have nothing to do with driving: Pinterest, Reddit, Docusign, Dun & Bradstreet, and Press Ganey Forsta. That last one is worth pausing on. If you have ever visited a hospital or doctor's office, you have likely received a follow-up survey from Press Ganey asking about your experience. Imagine your car separately handing driving-related data to the same kind of company.
Some of those data flows may be tied to advertising, analytics, or basic web features inside the vehicle. But the study shows that consumers were rarely given a clear, informed choice about any of it.
The most concerning finding involves the vehicle identification number, or VIN. A VIN is not just a random set of characters. It identifies the exact vehicle you own, and when it is paired with your location, email address, or phone number, it becomes a powerful identity key that can link together behavior from other apps and services.
The study found that Honda, Nissan, Lincoln, and the GM family of Cadillac, Chevrolet, Buick, and GMC were sharing VINs with third-party sites. When a VIN is combined with an identifier like an email address or phone number, data that once seemed separate can be stitched together. A person's driving habits, purchase history, and even medical-appointment patterns from other services could potentially be cross-referenced.
That matters because a car owner is not anonymous. The vehicle is directly tied to the person who owns or leases it, and a shared VIN creates a bridge between different parts of someone's digital life.
The researchers did not keep the findings private. They reached out to every manufacturer in the study, with one exception: Fisker, the EV startup that had already shut down before the study concluded.
Honda responded quickly. The company asked its third-party app to delete all location data it had already received and updated its app so it would no longer collect and send that data in the future. That is the kind of response you would hope to see across the industry.
Other manufacturers offered far less. Several said the data sharing was consistent with third-party service contracts. Some essentially pointed to the embedded browser that the vehicle's application relies on, implying that because a browser was involved, any data sharing was normal. Three manufacturers said that their apps would ask users to accept or reject cookies, but the researchers did not always find that happening in practice.
A few brands did offer a privacy "choice." But the warnings attached to that choice tell a whole story on their own. Tesla's opt-out warned that declining data collection could result in "reduced functionality, serious damage and inoperability." Rivian's warning was similar: choosing not to share data could limit or disable navigation, lane-keeping assistance, and over-the-air updates.
That is not a meaningful choice. It is closer to a ransom demand.
The United States still does not have a comprehensive federal consumer privacy law that specifically governs connected vehicle data. Several states, including California, Colorado, and Virginia, have broader consumer privacy laws that give residents the right to request access to their personal data and ask businesses to delete it. Those rights can apply to automakers, but exercising them is rarely simple.
Drivers can ask a manufacturer and its connected-services division what data has been collected and request deletion. In practice, however, automakers may route those requests through call centers, online portals, or legal departments. Some state laws also exempt certain types of data or apply only above revenue thresholds, which can make enforcement difficult.
Until regulators build clearer guardrails around vehicle data, the burden is on consumers to protect themselves.
First, read the privacy settings in your vehicle's infotainment system. Look for options related to data collection, location services, and connected services. Some cars let you turn off one category of sharing while keeping essential functions like emergency response.
Second, be thoughtful about linking your phone and your car. Companion apps like HondaLink or myCadillac often ask for more permissions than they need, including contacts, location, and background app refresh. Those permissions should be treated the same way you would treat them on any phone app.
Third, check your state's privacy rights. If you live in a state with a strong consumer privacy law, you can submit a data-subject request to the automaker. Ask what they have collected and request deletion. The process may be slow and annoying, but a paper trail can help if regulators ever investigate.
Fourth, pay attention to the fine print when you buy or lease a vehicle. Many dealerships now ask for consent to data sharing as part of the purchase paperwork. You are not always required to say yes, even if the salesperson implies otherwise. Ask precisely what "connected services" collect and who the data goes to before signing anything.
The study comes at a time when many people are worried about cameras, AI, and digital surveillance. A car that records where you go and then shares that record with a dozen companies is a uniquely powerful tracking tool because the car is often parked at your home, your workplace, and your doctor's office.
Transportation Secretary Sean Duffy has talked about "Freedom Cars" and the importance of giving consumers more control over their vehicles. The findings here suggest that idea deserves more than applause. Until automakers are required to be transparent about data flows, the freedom in question remains mostly theirs.
For Honda, the study appears to have led to real change. For other brands, drivers are left with the same choice: accept the data collection or park the car for good. That is not privacy. That is a goodbye letter.
