A new study conducted by researchers at Northeastern University, in collaboration with Consumer Reports, measured data transmission from 21 late-model vehicles and 30 of their companion mobile applications. The research, carried out between October 2024 and August 2025, used a custom Raspberry Pi access point to capture Wi-Fi traffic and a Faraday tent to isolate cellular signals, enabling precise observation of network behavior under controlled conditions.

The investigation revealed that 19 of the 21 tested vehicles transmitted data to at least one third-party domain via Wi-Fi, with some contacting advertising and tracking services. Seven of the 30 companion apps sent personally identifiable information — including vehicle identification numbers, email addresses, phone numbers, and precise location data — to external entities associated with advertising and user profiling. When a companion app was installed and used, the average vehicle’s exposure to third-party trackers increased significantly, sometimes by more than two dozen additional identifiers.

Researchers noted that blocking cellular connectivity with a Faraday tent did not eliminate data transmission; instead, it often prompted vehicles to rely more heavily on Wi-Fi, suggesting alternative pathways for data exchange. The study also documented variations in network behavior among vehicles from the same manufacturer, complicating broad conclusions about data practices across model lines.

Manufacturers were informed of the findings, with responses generally emphasizing consumer choice and system opacity rather than addressing structural data-sharing mechanisms. One exception was Honda, which modified its practices to stop transmitting precise geolocation data to third-party trackers.

The researchers concluded that the current architecture of connected-vehicle ecosystems creates significant gaps between public disclosures and actual data flows, calling for greater transparency to help users understand how their information moves through manufacturer platforms and external services.