Connected cars: 19 of 21 models send data to third parties, including advertising agents

With Consumer Reports, Northeastern researchers have intercepted the traffic of 21 vehicles and 30 applications: serial numbers, e-mails and precise positions are moving towards trackers.

A team from Northeastern University has published what it presents as the first large-scale measurement of the connected car ecosystem. Thanks to Consumer Reports' test fleet — 21 recent vehicles on the U.S. market, which would have cost more than $1.2 million to assemble — the researchers captured the Wi-Fi traffic of the cars between October 2024 and August 2025, and decrypted that of 30 companion mobile applications. Eleven electric vehicles were even placed in a Faraday tent to cut off the cellular network and observe what switched to Wi-Fi.

Applications that double the exposure

As a result, 19 out of 21 vehicles contacted at least one third party, including known areas of advertising and tracking. Seven out of 30 apps transmit sensitive identifiers — VIN number, email address, phone, precise location — to companies linked to ad targeting. Coupling the app to the car doubles on average the number of advertising actors to which the owner is exposed, sometimes with more than twenty additional trackers.

Informed, the manufacturers mainly shifted the responsibility to the customers, who accepted the terms of use. Only Honda changed its practices to no longer send precise geolocation to a third party. The study, peer-reviewed, will be presented at the IMC 2026 conference.