{"id":7827,"date":"2026-09-29T10:37:34","date_gmt":"2026-09-29T10:37:34","guid":{"rendered":"https:\/\/silvybrand.com\/?p=7827"},"modified":"2026-09-29T10:37:34","modified_gmt":"2026-09-29T10:37:34","slug":"car-data-privacy-northeastern-study-honda-gm-ford","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=7827","title":{"rendered":"Your car\u2019s data privacy problems are worse than you think"},"content":{"rendered":"


\n<\/p>\n

\n
\n

You hear it all the time: Modern cars are basically smartphones on wheels. And just like the phone in your pocket, the car in your driveway collects vast amounts of data \u2014 tracking where you drive, how fast you accelerate, how hard you brake, how aggressively you turn, and much more.<\/p>\n<\/div>\n

\n

The legality of this data harvesting remains hotly debated. Last year, the Federal Trade Commission penalized General Motors<\/a> for illegally collecting and selling precise location and driving behavior data without informed consent. Other automakers, like Ford<\/a> and Honda<\/a>, have faced minor fines for making it overly difficult for customers to opt out. While industry observers long suspected that other carmakers were doing the same, the practice hadn\u2019t been systematically investigated \u2014 until now.<\/p>\n<\/div>\n

\n

This week, researchers from Northeastern University, in collaboration with Consumer Reports<\/em><\/a>, published an in-depth examination of connected vehicle privacy behaviors. Utilizing nearly two dozen vehicles from CR<\/em>\u2019s test fleet, the team sought to answer critical questions: Which cars transmit data? Who receives it? Does it cross international borders? And what personally identifiable information is actually being exposed?<\/p>\n<\/div>\n

\n

David Choffnes, project lead and former director of Northeastern\u2019s Cybersecurity and Privacy Institute, said the goal was to reveal the sheer scale of modern vehicle data tracking and highlight how little visibility or control owners truly have over it.<\/p>\n<\/div>\n

\n

\u201cI think the conclusion is that there\u2019s a lot to be worried about,\u201d Choffnes said in an interview.<\/p>\n<\/div>\n

\n

To get a complete picture, researchers analyzed 21 late-model vehicles from 19 brands currently sold in the US, along with 30 companion mobile apps linked to active vehicles.<\/p>\n<\/div>\n

\n
\n

\u201cI think the conclusion is that there\u2019s a lot to be worried about.\u201d<\/p>\n

\u2014 David Choffnes<\/cite><\/div>\n<\/div>\n

\n

For traffic sent directly from the cars, the team identified the destination domains \u2014 including various third-party tracking companies \u2014 though they could not decrypt the encrypted payload data without hacking the vehicles.<\/p>\n<\/div>\n

\n

Intercepting Wi-Fi traffic proved relatively straightforward. Researchers placed a Raspberry Pi inside each car, connecting it to the vehicle\u2019s Wi-Fi while routing its internet through a mobile hotspot. This setup let them monitor outgoing Wi-Fi traffic while the car was in motion.<\/p>\n<\/div>\n

\n

Capturing cellular traffic required a more creative approach. To avoid deploying an unauthorized cellular base station that could interfere with public networks, the team built a car-sized Faraday tent. The tent blocked all signal transmissions between the vehicle and external cell towers, forcing the car to fall back on the controlled Wi-Fi connection.<\/p>\n<\/div>\n

\n

The results were stark: Every single one of the 21 vehicles transmitted data to at least one third-party domain over Wi-Fi. Over half contacted domains specializing in advertising, tracking, or analytics (ATA). These companies, like Adobe, LexisNexis, and Amplitude, gather details about your vehicle or driving behavior to sell to insurance companies or target you with ads.<\/p>\n<\/div>\n

\n

Vehicles equipped with advanced infotainment systems \u2014 particularly those running Google\u2019s Android Automotive OS with Google Automotive Services \u2014 contacted the highest number of third-party domains. Choffnes noted that an automaker\u2019s choice of software platform directly impacts how much data reaches third parties. Google\u2019s platform, for instance, includes built-in routines to communicate both with Google\u2019s own services and external entities.<\/p>\n<\/div>\n

\n

\u201cA lot of the tracking we also see through the apps that are built into the car,\u201d Choffnes said. \u201cSo now, cars are essentially turning into the global smartphones.\u201d<\/p>\n<\/div>\n

\n

Mobile apps present an equally insecure vector. The team discovered that seven companion apps \u2014 HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC \u2014 transmitted sensitive details like vehicle identification numbers (VINs), phone numbers, and precise locations directly to advertising networks. Over 70 percent of the tested companion apps contacted at least five unique ATA domains.<\/p>\n<\/div>\n

\n

Researchers were particularly alarmed by the pairing of a vehicle\u2019s VIN with identifiable personal data, which allows data brokers to build detailed dossiers on individual drivers.<\/p>\n<\/div>\n

\n

\u201cWe sort of think, \u2018Oh, well, if your online companies can track what you\u2019re doing online, but you\u2019re in your car, are they tracking what car you have?\u2019\u201d Choffnes said. \u201cAnd so we\u2019re seeing they actually can. And these are going to companies that probably most consumers don\u2019t have a relationship with or have never heard of.\u201d<\/p>\n<\/div>\n

\n

Automakers offered mixed reactions to the findings. Some defended their practices as legally compliant, while others acknowledged the vulnerabilities and issued software fixes. Honda, for example, requested that its analytics provider Amplitude delete all collected location data and updated the HondaLink app to cease transmitting geolocation after being presented with the Northeastern team\u2019s findings.<\/p>\n<\/div>\n

\n

Choffnes believes the deeper issue is that consumers rarely understand what they agree to when buying a connected car or setting up its app. Most drivers will not sit in a dealership parking lot reading dense privacy policies on a tiny dashboard screen before agreeing to the terms.<\/p>\n<\/div>\n

\n

\u201cI don\u2019t think there\u2019s a lot of trust as a result of this,\u201d Choffnes said. \u201cI think automakers would do well to earn that trust back. And one way to do that is through better transparency and helping consumers to not have data collected about them after they\u2019ve made a really expensive purchase without having more explicit opt-in as opposed to opt-out.\u201d<\/p>\n<\/div>\n

Follow topics and authors<\/strong> from this story to see more like this in your personalized homepage feed and to receive email updates.<\/span><\/p>\n