Your car is collecting more data about you than you think
Northeastern researchers tested 21 vehicles and their accompanying mobile apps to investigate what data manufacturers are collecting
Major car manufacturers are sharing driver’s personal information to third party companies and data brokers, new Northeastern University research shows.
As part of the partnership with the nonprofit media group Consumer Reports, a group of privacy and cybersecurity professors at Northeastern tested 21 vehicles from 19 car brands to understand what data the automakers collect and share.
From their investigation, which included testing the vehicles themselves and their accompanying mobile apps, the researchers found a number of those companies were sharing details such as Vehicle Identification Numbers (VIN), location data and email addresses.
David Choffnes, a Northeastern cybersecurity professor and one of the authors of the report, said the group was interested in pursuing this research after a report from the New York Times revealed that General Motors was collecting data from people’s cars and selling it to insurance companies.
But Northeastern researchers were interested in conducting a wider-scale analysis of cars on the road today, he said.
Cars feature a range of internet components that allow them to communicate with vehicle manufacturers, Choffnes explained — from Wi-Fi and cellular systems to cameras, microphones and GPS receivers.
To understand what data these cars share, the researchers rerouted the internet traffic that the vehicles sent out to networks they controlled.
While the researchers couldn’t see what data was being transmitted from the vehicles, because of encryption, they could decrypt the data from the vehicle’s mobile apps, because they personally owned the phones used for testing and could more easily intercept data that was shared, Choffnes explained.
From there, the researchers identified that the companies were sending personal information, including VIN numbers, email addresses and even location data.
Editor’s Picks
Adobe Analytics, Axiom, a third party data broker, and ContentSquare, an analytics company were among the most contacted third parties that were sent personal information.
Northeastern Global News reached out to these companies for comment but did not hear back before publication.
While the researchers noted that all the manufacturers disclosed in their apps’ privacy policy that they may share personal information with third parties, they do not disclose which third parties they will contact and for what stated purpose.
“We have these companies that have nothing to do with car functionality that are getting information about you, what car you have, and sometimes also your GPS location,” Choffnes said.
“Such companies can use these stable identifiers and [personal information] to implement cross-context tracking of users, allowing advertising companies to link a person who owns a vehicle with their behavioral data and purchase history from other websites and mobile apps,” the researchers wrote in their study.
In response to the researcher’s findings, some automakers made changes when presented with the data, the researchers said.
Honda, for example, requested that Amplitude, the third party advertising company to which they had been sending location information and VIN numbers to, delete the data. The company additionally updated its mobile app to stop sending geolocation data to the advertising company, according to the report.
In a statement to Northeastern Global News, Andrew Quillin, a Honda spokesperson, confirmed the researcher’s assessment in the report.
He added that the VIN and location data shared with the company was “never available for independent use or sale, as such use was prohibited by contractual agreement” and that use of the app is completely voluntary.
NGN additionally reached out to other car makers who were found to be sharing personal information, including General Motors, the parent company of Cadillac Chevrolet and Buick, which the researchers uncovered were sharing personal information through their mobile apps.
“We’re committed to keeping customer data secure so people can enjoy the benefits of in‑vehicle connectivity—like better navigation, communication, and safety—alongside privacy policies that are clear and easy to understand,” a spokesperson General Motors told NGN.
General Motors said it only discloses data to service providers and third parties that help it deliver it services and under strict contract limits. These providers are not permitted to “sell, share or use” the data for their “own purposes.”
Regardless, Choffnes said his team’s research highlights that automakers must still be more transparent about the data they collect and share rather than use vague language.
Regulators, Choffnes said, should step in.
“We don’t actually know what the companies are doing with that data, and that should become more apparent,” he said. “But that’s the kind of thing that should be regulated because that’s where I think there’s a lot of potential harm.”
Additionally, the researchers said it should be easier for users to opt out of using these services without reducing major functionality of their vehicles. In fact, companies should default by asking drivers to opt in, they said.
“It’s becoming impossible to buy a car that is not connected to the internet in some way,” Choffnes said. “It’s not reasonable that we’re in a situation where if they opt out of this kind of data collection, they mostly brick their cars.”
The researchers will present their paper at the ACM Internet Measurement Conference 2026, which runs from Oct. 12 to Oct. 16 in Karlsruhe, Germany.
