Modern cars collect vast amounts of data

Connected vehicles track where drivers go, how fast they accelerate, how hard they brake, and how aggressively they turn, much like smartphones collect personal information.

Regulators have penalized automakers before

Last year, the Federal Trade Commission penalized General Motors for illegally collecting and selling precise location and driving behavior data without informed consent.

Ford and Honda faced fines too

Ford and Honda have faced minor fines for making it overly difficult for customers to opt out of data collection, though the practice hadn't been systematically investigated until now.

Researchers tested twenty-one vehicles

Northeastern University, in collaboration with Consumer Reports, examined connected vehicle privacy behaviors across twenty-one late-model vehicles from nineteen brands currently sold in the US.

Every vehicle sent data to third parties

All twenty-one vehicles transmitted data to at least one third-party domain over Wi-Fi. Over half contacted domains specializing in advertising, tracking, or analytics, including Adobe, LexisNexis, and Amplitude.

Google's platform drives most tracking

Vehicles equipped with Google's Android Automotive OS with Google Automotive Services contacted the highest number of third-party domains, as the platform includes built-in routines to communicate with Google's services and external entities.

Mobile apps leak sensitive vehicle data

Seven companion apps including HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC transmitted vehicle identification numbers, phone numbers, and precise locations directly to advertising networks.

VINs paired with personal data

Researchers found that pairing a vehicle's VIN with identifiable personal data allows data brokers to build detailed dossiers on individual drivers, raising serious privacy concerns about tracking capabilities.

Some automakers made changes

Honda requested that its analytics provider Amplitude delete all collected location data and updated the HondaLink app to cease transmitting geolocation after being presented with the Northeastern team's findings.

Researchers call for better transparency

David Choffnes, project lead at Northeastern, says automakers should use explicit opt-in rather than opt-out and help consumers understand what data is collected after making an expensive purchase.

“I think automakers would do well to earn that trust back. And one way to do that is through better transparency and helping consumers to not have data collected about them after they've made a really expensive purchase without having more explicit opt-in as opposed to opt-out.”