A peer‑reviewed investigation by Northeastern University researchers, conducted with Consumer Reports, examined 21 late‑model vehicles from 17 manufacturers and 30 associated mobile applications. The study, slated for publication this week, found that 19 of the tested cars transmitted data to external entities and that seven of the apps shared sensitive information such as vehicle identification numbers, email addresses, phone numbers and precise location details with third‑party tracking and advertising firms.

When a vehicle’s companion app was used, exposure to advertising and tracking services roughly doubled. The data streams were often routed to multiple third parties, enabling advertisers and data brokers to construct detailed consumer profiles that can be sold to insurers, banks and other organizations.

The researchers disclosed their findings to the automakers; all but Honda responded by shifting responsibility onto consumers or external vendors. Honda subsequently revised its data‑collection practices and directed its vendor Amplitude to delete previously collected geolocation data.

Several manufacturers told Consumer Reports that certain links within companion apps opened external webpages that could drop tracking cookies, though drivers were typically unaware of this behavior. The study underscores the difficulty consumers face in avoiding data collection without abandoning connected‑car features such as remote start or remote unlock.

Kirsten Korosec, transportation editor at TechCrunch and co‑host of the Equity and Autonocast podcasts, reported on the findings. She can be reached at kirsten.korosec@techcrunch.com or via encrypted Signal message at kkorosec.07.