If you drive a car, you need to be aware of this: The Calls You Make and the Apps You Use in Your Car are Monitoring and Tracking You in Real Time.

A new study from Northeastern University finds that nearly every North American automaker has vehicles that transmit your personal data to outside companies, primarily third parties such as big tech firms, without your knowledge.

The study includes General Motors, Stellantis, Fisker, Ford, Honda, Land Rover, Toyota, Lucid, Mercedes-Benz, Nissan, Rivian, Tesla, and Volvo.

Study Overview:

Conducted in partnership with Consumer Reports, the study tested 21 late-model vehicles and 30 associated mobile apps to investigate the privacy implications within the connected-vehicle ecosystem.

The researchers found that 19 out of 21 vehicles, under various real-world conditions, communicated not only with a range of first parties (i.e., manufacturer domains) and automotive support parties but also with third parties known for providing advertising and tracking services. When companion apps were included in the analysis, vehicle owners faced even greater exposure to privacy-sensitive communications—sometimes more than two dozen additional trackers.

Of the 30 companion apps analyzed, seven (7) transmitted sensitive identifiers, such as Vehicle Identification Numbers (VINs), emails, phone numbers, and precise locations, to third-party advertisers and trackers. On average, these apps nearly doubled the amount of data a vehicle shared with advertising and tracking companies. Notably, Tesla and General Motors vehicles, including Cybertruck and Cadillac Lyriq, shared data at a significantly higher rate. The most common recipients include Alphabet, Amazon, Meta, Microsoft, Pinterest, and Reddit.

The researchers contacted 17 manufacturers regarding their findings, and most deflected responsibility to third-party service contracts. Of the 14 manufacturers that responded, all claimed the data flow was consistent with these contracts, which privacy experts argue are often vague and allow continual, unchecked data leaks.

Seven manufacturers also shifted the onus onto consumers, saying individuals are personally responsible for reading the terms of every third-party app or service associated with their vehicle.

However, they did not mention that declining these intrusive and potentially harmful data-sharing agreements would disable essential features like navigation, driver assistance, or over-the-air updates.

Conclusion:

The study highlights a significant gap between what vehicle manufacturers disclose to customers and what they actually share over the internet. The authors argue for greater transparency so customers can see the full ecosystem and identify and address associated risks. They cited a CalMatters report indicating that car owners’ personal information is highly valuable to third parties such as banks, insurers, pharmaceutical companies, lenders, and retailers. These entities can use the data to create driver profiles, often without the owners’ knowledge.