Your car may be sharing your location and other data with Big Tech

• Researchers testing 21 late-model vehicles found that every one contacted at least one third-party internet domain.
• More than half communicated with advertising, tracking or analytics companies, while some automaker apps transmitted VINs, phone numbers and precise location data.
• The findings suggest that buying a connected car can expose drivers to much of the same tracking ecosystem they encounter online — often with few obvious ways to stop it.

Modern cars increasingly resemble smartphones on wheels — and a new study suggests they may be tracking their owners much like smartphones do.

Researchers from Northeastern University, working with Consumer Reports, examined 21 late-model vehicles from 19 brands sold in the United States, along with 30 automaker mobile apps tied to active vehicles.

They found that all 21 vehicles transmitted information to at least one third-party internet domain when connected over Wi-Fi. More than half contacted companies involved in advertising, tracking or analytics, according to the researchers.

The destinations included companies such as Adobe, LexisNexis and Amplitude.

The researchers could identify where the vehicles were communicating but generally could not decrypt the contents of the transmissions without hacking the vehicles themselves. That means the study does not establish that every connection involved sensitive personal information.

But researchers found much more detail when examining automakers' companion smartphone apps.

Seven apps — HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick and myGMC — transmitted information including vehicle identification numbers, telephone numbers or precise location data to advertising networks, the study found. More than 70% of the apps tested contacted at least five advertising, tracking or analytics domains.

That matters because a VIN is not merely a description of a type of car. It identifies a specific vehicle and can often be associated with its owner.

Combine that with a phone number or location history, and what might appear to be anonymous vehicle information can become considerably more personal.

Cars have joined the tracking economy

Internet tracking has long been part of browsing websites and using smartphone apps. Cars are now becoming another source of behavioral data.

Connected vehicles can potentially collect information about where a driver goes, how fast the vehicle travels, how quickly it accelerates, how hard the driver brakes and other details of vehicle use. Cars also increasingly contain cameras, microphones, navigation systems and connections to smartphones.

The Northeastern researchers found that vehicles with more sophisticated infotainment platforms tended to communicate with more outside companies.

Cars using Google's Android Automotive operating system with Google Automotive Services contacted particularly large numbers of third-party domains, according to the research.

That illustrates an important change in the auto business: The privacy practices of a car may depend not just on its manufacturer, but also on the software platforms, apps and analytics services built into it.

David Choffnes, who led the Northeastern research, said cars are effectively becoming another part of the digital tracking ecosystem.

“A lot of the tracking we also see through the apps that are built into the car,” Choffnes told The Verge.

Honda changed its app after researchers raised concerns

The study also produced at least one immediate change.

Researchers found that Honda's HondaLink app was transmitting location information to analytics company Amplitude.

After researchers contacted Honda, the automaker asked Amplitude to delete the collected location information and changed HondaLink so that it would no longer send geolocation data to the analytics service, according to reports on the study.

Other automakers told researchers that their data practices complied with applicable laws or were covered by their privacy policies.

That highlights one of the central problems surrounding connected-car privacy: A company may technically disclose data collection somewhere in a privacy policy while drivers remain largely unaware that it is happening.

Consumers buying a $40,000 or $60,000 automobile may encounter privacy disclosures while activating a dashboard feature or installing a manufacturer's app, hardly the setting in which most people are likely to read thousands of words of legal language.

Regulators have already found problems

The issue is not entirely theoretical.

In 2025, the Federal Trade Commission took action against General Motors and its OnStar subsidiary over allegations that the companies collected and sold drivers' precise location and driving-behavior data without adequately informing consumers or obtaining proper consent.

The data included information about hard braking, speeding and late-night driving and was sold to consumer reporting agencies that could make it available to insurers, according to the FTC.

Ford and Honda have also faced enforcement actions in California over how consumers could exercise privacy rights, including opting out of certain data practices.

Concerns about vehicle privacy predate the latest research. A 2023 Mozilla Foundation examination of 25 automakers concluded that cars represented the worst privacy practices among the product categories the organization had studied. Nineteen of the 25 automakers said they could sell personal information, according to Mozilla's analysis.

The problem with "consent"

Automakers generally rely on privacy notices, terms of service and user consent to authorize collection and sharing of vehicle information.

But meaningful consent becomes questionable when drivers cannot realistically use major features of a vehicle without accepting lengthy agreements.

Choffnes argues that automakers should move toward explicit opt-in systems rather than assuming consumers agree unless they find and activate an opt-out.

Better disclosure would also help consumers understand which information is necessary to operate the car and which is being collected for advertising, analytics or other purposes.

For consumers, those categories can be difficult to distinguish.

A vehicle may legitimately need location information to provide navigation, emergency services or roadside assistance.

It does not necessarily follow that the same information needs to reach an advertising or analytics company.

Privacy Watch: What drivers can do now

Connected-car privacy controls vary widely by manufacturer, but drivers can reduce some unnecessary collection.

Check your automaker app. Look under privacy, permissions or account settings and disable location access or advertising personalization that isn't needed.

Review phone permissions. On iPhones and Android devices, check whether the automaker's app has continuous access to location, contacts, Bluetooth or other information. Location access can often be changed from “Always” to “While Using.”

Look for privacy choices in the vehicle. Newer cars may provide settings covering connected services, personalized advertising or data sharing.

Don't automatically activate every connected service. Features such as remote start or vehicle-location services may be useful, but accepting every optional service can increase the amount of information leaving the vehicle.

Delete your data before selling the car. Perform a factory reset of the infotainment system and remove paired phones, contacts, saved destinations and account information.

Ask what happens if you opt out. Some manufacturers allow drivers to restrict data collection but warn that certain connected features may stop working. Find out exactly which ones before deciding.

What this means

The biggest change isn't simply that cars collect data. Vehicles have recorded certain information for decades.

What's different is the network surrounding the car.

A modern vehicle can communicate continuously with an automaker, software provider, analytics company, advertising platform or other third party — while the owner's smartphone and vehicle app create still more connections.

That means the familiar online advertising ecosystem is extending into another place consumers once considered private: the driver's seat.

And unlike a website or a free smartphone app, a car is something consumers may have paid tens of thousands of dollars to own.

The question now facing automakers and regulators is whether purchasing that car should also mean becoming another source of data for the tracking economy.