Your car and its mobile apps are probably handing over all kinds of data to tech companies

Modern vehicles built with connected car technologies like WiFi and GPS collect information about their owners. And that information is no secret, according to a new study conducted by researchers at Northeastern University.

This conclusion is not new — there have been numerous investigations and lawsuits revealing how driving data is collected and shared with third parties, including insurance companies. What the study reveals is how big the problem is and how difficult it is for consumers to not use the car or skip convenient features like remote start and unlock.

Researchers in partnership with Consumer Reports tested 21 late-model vehicles from 17 automakers, including GM brands Cadillac and Chevrolet, as well as Ford, Lucid, Rivian, Tesla, Toyota and more. They tested 30 companion mobile apps to “understand the privacy implications of the connected car ecosystem.” The peer-reviewed study will be published this week.

The implications aren’t great for consumers, whose data is being shared with tech companies including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo.

19 of the 21 vehicles tested sent traffic to at least one third party, and seven of the 30 apps provided sensitive data such as vehicle identification number (VIN), email, phone number and precise location to third-party companies linked to tracking and advertising.

It often goes a step further with sending multiple types of information to the same third party, a scheme that allows advertisers and data brokers to build in-depth profiles of consumers, according to the findings. These profiles can be particularly difficult for consumers to decipher because they are sold to a variety of organizations, including insurers and banks.

When the researchers added the companion app to the vehicle, it nearly doubled the exposure of advertising and tracking companies.

The findings were shared with various manufacturers, and all but Honda shifted blame elsewhere and often to consumers, the researchers said. (Honda responded by improving its data collection practices after learning of the findings and ordered its vendor Amplitude to delete all geolocation data it had received.)

Consumer Reports was told by several automakers that some links to their companion apps open outside webpages, which may include cookies that collect customer data. Regardless of how this data was collected, drivers were not informed.