Your car and its mobile app are probably handing over all kinds of data to tech companies

Modern vehicles equipped with connected car technology like WiFi and GPS collect reams of data about their owners. And according to a new study by researchers at Northeastern University, that data is no longer private.

This finding is not new – there have been several investigations and lawsuits that address how driving data is collected and shared with third parties, including insurance companies. The study shows how big the problem is and how difficult it is for consumers to avoid it by not using the vehicle or using convenient features like remote start and unlock.

Researchers in partnership with Consumer Reports tested 21 late-model vehicles from 17 automakers, including GM brands Cadillac and Chevrolet as well as Ford, Lucid, Rivian, Tesla, Toyota and others. They also examined 30 partner mobile apps to “understand the privacy implications of the connected vehicle ecosystem.” The peer-reviewed study will be published this week.

The implications aren’t great for consumers whose data is being shared with tech companies including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo.

Nineteen of the 21 vehicles tested sent traffic to at least one third party, and seven of the 30 apps gave sensitive data such as vehicle identification number (VIN), email, phone number and precise location to third-party companies involved in tracking and advertising.

According to the findings, this often went a step further by sending multiple types of information to the same third party, a scheme that allows advertisers and data brokers to build in-depth profiles of consumers. These profiles can be especially difficult for consumers to shake off because they are sold to a variety of companies, including insurers and banks.

When researchers linked the companion app to the vehicle, its performance for advertising and tracking companies nearly doubled.

The researchers said the findings were shared with various manufacturers and all but Honda placed the blame elsewhere and often on consumers. (Honda responded by improving its data collection practices after learning of the findings and ordered its vendor Amplitude to delete all geolocation data it received.)

Several automakers reported in Consumer Reports that some links in their companion apps that open outside webpages may contain cookies that collect customer data. Regardless of how this data was collected, drivers were not informed.