Your car is watching you, and it is telling other companies what it sees. A new study from Northeastern University found that 21 late-model vehicles and 30 companion mobile apps collect and share reams of driver data with third parties, often without clear consent.
The peer-reviewed study, conducted with Consumer Reports, tested vehicles from 17 automakers. The list includes Cadillac, Chevrolet, Ford, Lucid, Rivian, Tesla, and Toyota. Researchers examined WiFi, GPS, and connected car systems built into each vehicle, then cross-referenced what the 30 mobile apps did with the same data.
The conclusion is not new. Prior investigations and lawsuits have exposed how driving data flows to insurance companies and data brokers. What this study shows is the scale of the problem and how few options drivers have.
"Short of not using the vehicle or its convenient features like remote start and unlock," the study found, consumers have almost no way to opt out.
Remote start and remote unlock are among the most common connected features. They require a mobile app, and that app typically requires permissions that give automakers and their partners access to location, driving behavior, and phone data.
The study arrives as connected car technology becomes standard rather than optional. Most new vehicles sold in the US include built-in WiFi and GPS. Automakers market these features as conveniences, but they also function as data pipelines.
Insurance companies have paid for driving data in the past. Lawsuits have accused automakers of sharing speed, braking, and mileage information without telling customers. The Northeastern study suggests those cases are not isolated incidents but part of a broader system.
Researchers did not name which third parties received the data or how much money changed hands. They focused on the architecture itself: how vehicles collect information and how apps transmit it.
The study will be published this week. Its findings add pressure on automakers and regulators. The Federal Trade Commission has signaled interest in connected car privacy, but no federal rule currently limits what automakers can collect or sell.
For now, drivers who want privacy have few choices. Buying an older car without connected features is one option. Another is refusing to install the companion app, though that means giving up remote start, remote unlock, and other features tied to the app.
The study's authors say the burden should not fall on consumers. They argue that automakers and app developers should be required to disclose what they collect and give drivers a real way to say no.
