Connected Cars Spied on Drivers and Shared Location Data With Ad Brokers Across 19 Brands

Your car is talking to more companies than you think, and some of them sell ads. Researchers at Northeastern University, working with Consumer Reports, tested 21 late-model vehicles from 19 brands sold in the US, along with 30 companion mobile apps. Every single vehicle sent data to at least one third-party domain.

More than half of the cars contacted advertising, tracking, or analytics domains, run by companies such as Adobe, LexisNexis, and Amplitude. The apps were worse. Seven of them, HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC, sent vehicle identification numbers, phone numbers, and precise locations to advertising networks.

A car full of trackers

Tesla's Model 3 stood out. It contacted 34 advertising, tracking, and analytics domains on its own, plus 37 more from the apps built into its infotainment system. Cars running Google's Android Automotive OS with Google Automotive Services tended to reach the largest number of third parties, which makes sense once you remember that the dashboard is now effectively a tablet with an app store.

Across the companion apps, more than 70 percent contacted at least five unique ad or tracking domains. That is the same ecosystem that follows people around phones and websites, now plugged into the vehicle they drive to work and to the doctor.

The VIN is what makes this more than a nuisance. A VIN is tied to one physical car, and usually to one registered owner. Pair it with a phone number and a precise location, and a data broker can build a dossier on an individual driver: where they live, where they park at night, where they go on weekends.

How the researchers caught it

Getting at car traffic is harder than sniffing a laptop. The team used Raspberry Pi devices as Wi-Fi taps and, for electric vehicles, parked the cars inside a car-sized Faraday tent. With the cellular connection blocked, the vehicles fell back to a Wi-Fi network the researchers controlled, as Ars Technica detailed.

They could not decrypt the encrypted payloads, so the study does not show exactly what every packet contained. But DNS lookups and the server names exposed during TLS handshakes still revealed who the cars were calling. For the seven apps, the researchers could see the identifiers and location data heading to ad networks directly.

Automakers shrug

Most carmakers told the researchers that third-party sharing was covered by contracts and privacy policies. Some went further and argued that cookie prompts or dense terms of service put the responsibility on the driver, according to TechCrunch. Few drivers read a privacy policy before starting their car, and fewer still can opt out of the infotainment system.

Honda was the exception that proves the point. After the researchers reached out, it asked Amplitude to delete the location data it had collected and updated HondaLink so the app no longer sends geolocation. The fix took one email, which raises the question of why it was there in the first place.

Regulators have seen this before

The industry has already been burned on this. The FTC penalized GM for selling drivers' precise location and driving behavior data, and Ford and Honda have faced fines over opt-outs that were deliberately hard to use. Location data remains a regulatory flashpoint well beyond cars, as Google learned when Ireland's data regulator fined it over location tracking. And cars are not the only products quietly routing personal data to outside parties: Microsoft recently faced questions after contractors read Copilot users' photos and prompts.

The difference with cars is scale and permanence. A phone can be swapped or left at home. A car is a long-lived, high-value asset registered to a named person, and it now ships with the same tracking plumbing as a free mobile game. The study shows that years of fines and public embarrassment have not changed that default.