Most connected cars on the road today send data to companies other than the automakers that built them, and the mobile apps that pair with those cars add substantially to the tracking, according to a study by Northeastern University researchers and Consumer Reports, TechCrunch reported Tuesday. The peer-reviewed paper is due to be published this week.

What Happened

The researchers examined 21 late-model vehicles from 17 automakers along with 30 companion mobile apps that drivers use to unlock, locate or monitor their cars. The brands tested included General Motors' Cadillac and Chevrolet, Ford, Lucid, Rivian, Tesla and Toyota, among others.

Nineteen of the 21 vehicles sent network traffic to at least one third party. Among the apps, seven passed sensitive information to outside companies, including vehicle identification numbers, email addresses, phone numbers and precise location. The recipients named in the study included Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo, companies whose businesses include analytics, advertising and tracking.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The apps made the biggest difference. Drivers who used a carmaker's companion app roughly doubled their exposure to advertising and tracking companies compared with the vehicle alone, the researchers found.

TechCrunch did not break down which automaker sent which data to which company. The researchers have posted their dataset and study materials on a Northeastern Khoury College website.

How Automakers Responded

When the researchers shared their findings, every automaker except Honda pushed responsibility elsewhere, often onto drivers themselves, according to the report. Several argued that links inside their apps opened external web pages carrying their own tracking cookies, implying the tracking was not the app's doing.

Honda took a different approach. After reviewing the results, it changed its data practices and instructed Amplitude, an analytics vendor, to delete all the geolocation data it had received.

Why It Matters

A VIN or a precise location tied to an email address or phone number can identify a specific person and reveal where they live, work and travel. When that information flows to analytics and advertising platforms, it moves outside the relationship a driver thinks they have with a carmaker and into systems that can combine it with other data.

The study also shows that the risk is not confined to a vehicle's built-in telematics. Companion apps can embed the same third-party analytics and advertising code found across the wider mobile app industry, and the doubling effect the researchers measured suggests they are a major channel through which data leaves the car ecosystem.

Context

Automaker data handling has already drawn legal consequences. TechCrunch noted earlier New York Times reporting on how carmakers tracked drivers, and a $12.75 million settlement General Motors reached over a California driver privacy lawsuit. The new findings suggest that sharing with outside technology firms remains widespread across manufacturers, not limited to one company.

The automakers' tendency to blame drivers is also notable, because most drivers have little practical way to inspect what a car or its app transmits.

What to Watch

The formal publication of the peer-reviewed paper this week should provide more detail on which vehicles and apps shared what. Watch for whether state attorneys general or federal regulators take up the findings, and whether other automakers follow Honda in cutting off or purging data sent to third-party vendors.