Modern cars can be remotely unlocked, started, and located. Still, a new study suggests the technology that enables this can also help advertisers track and identify the person behind the wheel.
Northeastern University researchers, working with Consumer Reports, examined 21 vehicles and 30 companion apps. Nineteen vehicles contacted outside companies, and seven apps transmitted sensitive identifiers to companies associated with advertising and tracking. The findings highlight privacy risks extending beyond phones and computers.
That raises a broader privacy concern as vehicles become increasingly connected to the internet and their owners’ digital identities. Instead of tracking a person only through their phone, advertising companies may have another source to work with — the car carrying that person, where it goes, and the digital accounts connected to it.
The researchers also asked manufacturers to explain the data sharing, finding that their responses often placed responsibility on consumers or third-party services.
What the researchers found
To see where connected cars were sending information, both the researchers and investigative reporters tested 21 vehicles representing 19 brands.
Testing ran from October 2024 to August 2025 and covered vehicles from model years 2022 to 2025, while stationary and driving. During companion-app testing, researchers accepted all requested permissions, including tracking and location access. Eleven EVs were also placed inside a Faraday tent to block cellular signals and test whether their traffic would switch to a monitored Wi-Fi connection.
Encryption prevented researchers from reading the contents of vehicle transmissions, but they could identify the destinations contacted, including advertising, tracking, and analytics services. Separate app testing allowed them to inspect personal information being transmitted. Contacting an outside service does not, by itself, establish how the recipient used the data.
The researchers also examined automakers’ companion apps, where they could inspect transmitted information more closely. Including these apps in the analysis revealed additional advertising, tracking, and analytics contacts, with some cases adding more than two dozen trackers.
Where the impact lies
Precise location data can reveal sensitive travel patterns on its own. Linking repeated location records with a VIN, phone number, or email address could make those patterns easier to associate with a specific person, potentially revealing where they live, work, and regularly visit.
That information could also be linked to data already collected from smartphones and other apps. The result could be a much richer profile of a person, giving advertisers, data brokers and other companies more ways to understand and target them.
That concern comes as the Flock’s license-plate reader network faces growing public opposition in the U.S. over its ability to record and store vehicle movement data. While Flock cameras and connected-car systems collect data differently, both show how vehicles can become a source of detailed information about where people go — and how that information can extend the ability to track them beyond their phones.
What is the way forward?
Researchers contacted 17 manufacturers and received 14 responses. All respondents cited contracts governing third-party data use. Five pointed to embedded browsers, while seven said consumers were responsible for accepting third-party software terms.
Honda took a different approach. Per the researchers, the company changed its data collection practices and asked its third-party provider, Amplitude, to delete geolocation data it had received.
Drivers should review both their vehicle’s connected services and its companion app when assessing privacy. Available controls vary, and declining data collection can limit connected features.
Before activating connected services, drivers should:
- Review privacy and data-sharing settings in both the vehicle and its companion app.
- Check the app’s location and tracking permissions, and limit optional access where available.
- Check which connected features would be limited or disabled before opting out.
- Ask manufacturer support which data-sharing controls and deletion options are available for their model and account.
The point is not to avoid connected cars altogether — it’s already a direction the automobile industry is moving towards anyway. The point, however, is to know what you are agreeing to when you connect one to your phone, location, and digital identity.
Read more: Concerns about sensitive data reaching advertisers also extend to healthcare, as the FTC’s lawsuit against Hims & Hers over alleged health-data sharing highlights.