The archetypal large-scale measure study of the connected-vehicle ecosystem.
A connected car is a conveyance alongside built-in net admission — Wi-Fi, cellular, GPS — that lets it communicate continually alongside its manufacturer and exterior companies. Over 75% of vehicles sold globally have this connectity built-in.
Photo is not loadingimages/connected-car.jpg
It knows anywhere you drive.
It knows who you are.
It can portion this data and additional alongside coverage companies, advertisers, etc...
Report Summary
Partnering alongside Consumer Reports, we tested 21 delayed example vehicles and 30 companion mobile apps to comprehend the privacy implications of the connected vehicle ecosystem.
01We discover that the two vehicles and companion apps communication many third-party domains, including advertisers and trackers.
0219/21 vehicles tested dispatch traffic to at smallest one third party
03Seven of 30 apps transmit delicate identifiers to third-party companies
We go through a lengthy discolure procedure and provision understanding into how manufacturer's comprehend this data sharing issue. Our findings underscore the need for continued measure and scrutiny of the connected conveyance ecosystem.
Partnership alongside Consumer Reports
Consumer Reports gave the squad admission to its purchased fleet of test vehicles — a example that would have disbursal complete $1.2M to collect independently.
The Paper
This activity is equal reviewed and volition be published at IMC '26. Read the document →
The Research Team
We are a squad of privacy, security, and networking-systems researchers at Northeastern University. See the complete squad →
21
vehicles tested, 19 brands
19 / 21
vehicles contacted a third gathering complete Wi-Fi
7 / 30
apps sent PII to trackers
5 / 30
apps sent VIN + other PII to trackers
Research Questions
Photo is not loading images/car-diagram.png
Connected Vehicle Ecosystem
This diagram shows the data flows to and from a conveyance and its companion mobile app. Both devices dispatch data, including personal person data, to distinct 1st and 3rd gathering servers using Wi-Fi and cellular service. Solid arrows portray flows that were intercepted through our experiments.
The Problem
Once the data gets sent to these servers, it is up to the companies that obtain the person data to create decisions on what they do alongside it. Unfortunately, in many cases, this includes sharing or marketing person data to another undisclosed 3rd parties. Consumers have no authority complete their data formerly it has remaining their device
In this paper, we obtain the archetypal steps to location the constricted visibility into the privacy implications of the connected conveyance ecosystem. We acknowledge two advantage points in the ecosystem anywhere we can acquire understanding into the data that connected vehicles are sharing alongside the two manufacturers and third parties: the vehicles themselves and the mobile apps provided by manufacturers. We ask the following directing questions:
01What individual person data do connected vehicles and their companion mobile apps transmit?
02Who receives that individual person data?
03What is the manufacturer reply to these findings?
Methods
We investigated 21 vehicles from the U.S. market in a controlled surroundings alongside alongside 30 companion mobile apps instrumented alongside on-site vehicles between October 2024 and August 2025. Below is a clarification of the experiments we ran and our setup.
Vehicle Testing
Photo is not loading images/rpi.png
Wi-Fi Testing Setup
To collect Wi-Fi traffic from vehicles, we configured a tradition admission item (AP) on a Raspberry Pi and used tcpdump to log all packets that were sent or received via this AP. This allowed us to see all the destinations the vehicles were sending data to but not the data inside the packets as it was encrypted.
One assumption we tested was whether blocking a vehicle’s capability to communicate complete its cellular network would power additional Wi-Fi communication. To obstacle external cellular signals, we drove 11 EVs in the example into a car-sized Faraday shelter providing ≈93 dB of attenuation, blocking their cellular association entirely. Stationary Idle and Active tests were repeated inner the shelter to see whether traffic that normally goes out complete cellular rerouted to Wi-Fi instead.
App Testing
In total, we experimented alongside 30 connected vehicle companion apps that were paired alongside the vehicles at Consumer Reports’s evaluation facility.
Device Setup
01We used a blend of test phones and iOS versions for our experiments: an iPhone 8/iOS 16.6, an iPhone X/iOS 16.7.11, and an iPhone 13/iOS 18.5.
02To minimize backdrop traffic, we deleted all non-essential apps on the test phones and tested apps one-by-one, including deleting all conveyance app and restarting the phone before downloading the next app.
03We used the iOS native display recording characteristic to document our interactions alongside all app for afterward review.
04To grasp and decrypt network traffic from the companion mobile apps, we used iPhones alongside tradition base certificates connected to mitmproxy.
Process for Testing Each App
01During app facility and login we accepted all approval requests (e.g., tracking, location, calendar access, Bluetooth, notifications) that the use requested
02We had a Consumer Reports employee log into the app using their existing credentials connected alongside a conveyance on the lot.
03Once we were logged-in, we manually exercised all accessible functionality, specified as looking for nearby charging staions, geolocating the vehicle, viewing conveyance data and service former (e.g., tire pressure), viewing notifications (e.g., “doors are unlocked”), and viewing in-app privacy policies.
04Some apps allowed us to execute bodily interactions on the vehicle, specified as remotely beginning the trunk. We performed all specified actions and verified that the conveyance completed all request.
Vehicle Dataset
$1.2M+
estimated disbursal to independently procure this fleet, lone imaginable because of Consumer Reports partnership
Manufacturer
Brand
Year
Model
Vehicle Tests
Driving
Idle
In-Tent
Cellular
General Motors (GM)
Buick
2024
Envista
✓
✓
–
–
Cadillac
2024
Lyriq
✓
✓
✓
–
Chevrolet
2024
Blazer
✓
✓
✓
–
Stellantis
Dodge
2023
Hornet
-
✓
–
–
Fiat
2024
500e
✓
✓
✓
–
RAM
2025
1500 Bighorn
✓
✓
–
–
Fisker
Fisker
2023
Ocean
✓
✓
-
–
Ford Motor Co.
Ford
2022
F150 Lightning
✓
✓
-
–
Ford
2024
Mustang GT Fastback
✓
✓
–
–
Honda Motor Co.
Honda
2024
Prologue Touring AWD
✓
✓
✓
–
Tata Motors
Land Rover
2023
Range Rover Sport
✓
✓
–
–
Toyota Motor Corp.
Lexus
2024
NX450H+ PHEV
✓
✓
–
–
Toyota
2023
Corolla Cross
✓
✓
–
–
Subaru
2023
Solterra
✓
✓
✓
–
Lucid
Lucid
2023
Air Touring
✓
✓
✓
–
Mercedes-Benz Group AG
Mercedes
2023
EQS450 4Matic
✓
✓
-
–
Renault-Nissan-Mitsubishi Alliance
Nissan
2023
Ariya Platinum
✓
✓
✓
–
Rivian
Rivian
2022
R1S
✓
✓
✓
–
Tesla
Tesla
2024
Cybertruck
✓
✓
✓
–
Tesla
2024
Model 3
✓
✓
✓
✓
Zhejiang Geely Holding Group
Volvo
2024
C40
✓
✓
✓
–
*While we tested a broad range of vehicles, we did not shield all manufacturer in the U.S. market. As alongside all empirical studies, our results have to be interpreted as a snapshot in time, and may not generalize to vehicles exterior our example or exterior the U.S.
Findings
19 of 21 vehicles contacted at smallest one third gathering complete Wi-Fi, including known promotion and tracking domains
7 of 30 companion apps transmitted delicate identifiers (VINs, emails, phone numbers, precise location) to third parties connected alongside promotion and tracking. Transmiting multiple forms of PII to the identical third gathering allows advertisers to build in-depth profiles on consumers
Click any business part for what it received and from which app.
Pairing a companion app roughly doubled a vehicle's visibility to advertising/tracking companies on average, and in several cases added 20+ new ones.
vehicle-only ATA companies added by the companion mobile app
Manufacturer Disclosures
The squad disclosed these findings to the distinct manufacturers featured in the study, below is an interactve summary of the distinct explanations received.
Click any box complete for additional info.
The ongoing theme of all these responses was shifting the accuse to the consumer.
The current scheme does not provision owners the capability to choose. Assuming owners can discover the particular agreements, if an owner decides they are uncomfortable alongside the data sharing described inside them, they are faced alongside (arguably) unfair choices: 01accept the agreements despite of their concerns 02stop using their car's connected-vehicle features - which includes distant start, the app, and another extremely helpful features 03stop using the conveyance entirely
As one notable exception, Honda improved its data gathering practices to forestall sending exact geolocation to a third gathering connected alongside person tracking.
Conclusion
We established that vehicles, under a assortment of real-world settings, communication not lone a broad range of archetypal parties (i.e., manufacturer domains) and car-specific assistance parties, but additionally third parties that are known to provision promotion and tracking services.
Vehicles from the identical manufacturer exhibit distinct network behaviors - this makes it extremely difficult and costly to study these vehicles.
When adding conveyance companion apps to the analysis, we established that conveyance owners are exposed to even additional privacy-sensitive ATA communication—in several cases more than two dozen additional trackers.
Our study revealed a large gap between what vehicle manufacturers publically disclosed and how the connected vehicle ecosystem really shares data complete the Internet
Based on the opaque nature of vehicular systems, we contend that there is a need for improved transparency to justify risen visibility into the complete ecosystem to acknowledge and location corresponding harms.
