It used to be the case that “if something is free, you’re the product.” Now, we pay to be the product and insert it into our lives – from voice assistants and video doorbells to smart thermostats, TVs, even refrigerators, and, of course, apps on our phones, our data is being harvested, sold, and used. Now, according to the first large-scale measurement study of the connected-vehicle ecosystem, many automakers are in on the act.
The study, conducted by a team of researchers at Northeastern University, Boston, assisted by Consumer Reports, tested 21 cars and published the extremely concerning results.
BMW OTA connectBMW
Of the 21 vehicles tested for the research paper, 19 send traffic to at least one third party. It was horribly predictable that GM brands were the worst offenders, the vehicles being the Cadillac Lyriq and Chevrolet Blazer. The research split the tests between the connected vehicle itself and the companion app, and pairing the companion app to the cars roughly doubled a vehicle’s exposure to advertising/tracking companies on average, and in some cases added 20+ new ones.
The outlier there is Tesla, where the two vehicles (Tesla Model 3 and Cybertruck) send the majority of their driver’s data from the vehicle only. The Nissan Ariya is also an outlier, as the vehicle didn’t expose any data, but the companion app put it in the top five tested for leaking data. In the graph below, the teal color represents vehicle data exposed while the orange arrow represents data exposed to advertising/tracking companies by the companion app.
Results of first large-scale measurement study of the connected-vehicle ecosystem.Automatic Transmission
As we can see, the Mercedes EQS, Subaru Solterra, Land Rover Range Rover, and Ram 1500 Big Horn passed the least amount of data on and only through the connected app. But there’s still a problem there, which we’ll get to.
Who Is This Data Being Sent To?
Genesis owner’s app on smartphoneGenesis
The research paper linked below outlines the methods to test and gather data as well as the source of the vehicles. That includes a custom network access point and logging all packets that were sent or received via the access point. That allowed the team to identify where the vehicles were sending data to, but not the information within the encrypted data. Unsurprisingly, Google, Meta, and Microsoft crop up a lot in the connected apps. Not so obviously, Adobe of Photoshop and Acrobat software fame does as well.
Adobe shows up alongside Axciom, which is one of the biggest data brokers in the world and partners with Adobe for analytics. Content Square pops up a lot, and markets itself as an “all-in-one experience intelligence platform.” That includes behavioral data and analytics and analytics that tracks users across the web and apps.
According to the research, 7 of 30 companion apps transmitted sensitive identifiers (VINs, emails, phone numbers, precise location) to third parties associated with advertising and tracking.
What The Automakers Have To Say
2026 Tesla Model Y Smartphone App FeaturesTesla Australia
According to the research, the team reached out to 17 of the manufacturers. Three didn’t respond, five said that some in-app links open an embedded browser and attributed any third-party tracking to the browser, 14 simply said the data flow matched their contracts with third-party vendors and was in line with what’s stated in the privacy policy. Then it got cynical.
Seven manufacturers said it’s the owner’s job to read and individually accept the terms of every third-party app or service on the vehicle, even software that ships pre-installed. And that is saying the quiet bit out loud by shifting the blame to the consumer who has three choices if they own a connected car and are concerned about their privacy.
They can accept the agreements regardless, stop using their car’s connected-vehicle features (which are more and more often including features like remote start), or sell the car. For those shopping for a car, it seems a lot simpler – don’t buy a connected car. However, generally, that means looking at low-equipped models without Wi-Fi chips, or going older and used. Buying new seems to leave you with almost no choice.
CarBuzz Insight – Why This Matters
Verne RobotaxiVerne
There are two ways this matters when it comes to internet-connected cars and companion apps. The first is how much data a car can generate and how it can be used, and something we’ve covered in depth. Essentially, even small things tell stories. It knows what doctors you visit and how often, how often you get fast food or coffee, what school your children might go to, what church you might go to or political events or meeting places you might visit.
At best, you might, say, go to McDonald’s a couple of times and find Google advertising Burger King to you later in a web search. Or, your driving habits can be sold to insurance companies. At worst, people can be targeted by political or religious beliefs by anyone willing to pay for it, including governments. And that’s a big can of worms.
The second way this matters is that some automakers make a profit by selling a car, then the owner becomes a continuous revenue stream through their data. The owner is literally paying money to become a product.
Source: Automatic Transmission
