Researchers at Northeastern University, working with Consumer Reports, tested 21 late-model vehicles from 17 automakers and 30 companion mobile apps, and found that connected cars routinely hand detailed data to advertising and analytics companies.
Nineteen of the 21 vehicles sent traffic to at least one third party. Seven of the 30 apps shared sensitive information — including vehicle identification numbers, email addresses, phone numbers and precise location — with companies tied to tracking and advertising. The named recipients include Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo. Pairing a companion app to its car roughly doubled the exposure to ad and tracking companies, the researchers found, because the same data can be collected through both channels.
The peer-reviewed study, published this week, shows how widespread the problem is and how hard it is for consumers to avoid — short of giving up convenient features such as remote start and unlock.
The findings were shared with the automakers. All but Honda pushed the blame elsewhere, often onto consumers, the researchers said. Honda, they said, improved its data collection practices and told a vendor, Amplitude, to delete the geolocation data it had received. Several automakers told Consumer Reports that links inside their apps opened external web pages that may set marketing cookies. Because the data can be resold to insurers and banks, the resulting profiles are hard for consumers to shed.
