The first large-scale measurement study of the connected-vehicle ecosystem.
\nA connected car is a vehicle with built-in internet access — Wi-Fi,\n cellular, GPS — that lets it communicate constantly with its manufacturer and outside companies. Over 75% of vehicles sold globally have this connectity built-in.
\n Photo is not loadingimages/connected-car.jpg
It knows where you drive.\n It knows who you are.\n It can share this data and more with insurance companies, advertisers, etc...
\nReport Summary
\nPartnering with Consumer Reports, we tested 21 late model vehicles and 30 companion mobile apps to understand the privacy implications of the connected vehicle\n ecosystem.
\nWe go through a lengthy discolure process and provide insight into how manufacturer's perceive this data sharing issue.
\nOur findings underscore the need for continued measurement and scrutiny of the connected vehicle ecosystem.
\nConsumer Reports gave the team access to its purchased fleet of test vehicles — a sample that would\n have cost over $1.2M to assemble independently.
\nThis work is peer reviewed and will be published at IMC '26. Read the paper →
\nWe are a team of privacy, security, and networking-systems researchers at Northeastern University.\n See the full team →
\n21 vehicles tested,\n19 brands\n 30 companion\n mobile apps\n 19 / 21 vehicles contacted a\nthird party over Wi-Fi\n 7 / 30 apps sent PII to trackers\n 5 / 30 apps sent VIN + other\nPII to trackers
\nJump directly to any section, or scroll to see the whole thing.
\n01
\nWhat is this paper about, and what were we looking for?
\n→
\n03
\nAn accessible explanation of the experiments we ran.
\n→
\n02
\nA list of the vehicles we looked at
\n→
\n04
\nThe main results and what they tell us.
\n→
\n05
\nHow the manufacturers responded to our findings
\n→
\n05
\nThe bigger picture and key takeaways.
\n→
\n Photo is not loading images/car-diagram.png
This diagram shows the data flows to and\n from a vehicle and its companion mobile app.\n Both devices send data, including private consumer data, to different 1st and 3rd party servers using Wi-Fi and cellular service.\n Solid arrows represent flows that were intercepted through our experiments.
\nOnce the data gets sent to these servers, it is up to the companies that receive the consumer information to\n make decisions on what they do with it. Unfortunately, in many cases, this includes\n sharing or selling consumer data to other undisclosed 3rd parties.
\nConsumers have no control over their data once it has left their device
\nIn this paper, we take the first steps to address the limited visibility into the privacy implications of the connected vehicle ecosystem.\n We identify two vantage points in the ecosystem where we can gain insight into the data that connected vehicles\n are sharing with both manufacturers and third parties: the vehicles\n themselves and the mobile apps provided by manufacturers.
\nWe ask the following guiding questions:
\nWe investigated 21 vehicles from the U.S. market in a controlled\n environment along with 30 companion mobile apps instrumented\n with on-site vehicles between October 2024 and August 2025. Below is a description of the experiments we ran and our setup.
\n Photo is not loading images/rpi.png
To collect Wi-Fi traffic from vehicles,\n we configured a custom access point (AP) on a Raspberry Pi and\n used tcpdump to log all packets that were sent or received via this\n AP.
\nThis allowed us to see all the destinations the vehicles were sending data to but not the information within the packets as it was encrypted.
\n Photo is not loading images/test-facility.jpg
Idle Baseline\nvehicle on — no activity\n Active Test\nperform all possible actions
\ndrive 5–45 mph with acceleration & hard braking
\n Photo is not loading images/faraday-tent.jpg
One hypothesis we tested was whether\nblocking a vehicle’s ability to communicate over its cellular network\nwould force more Wi-Fi communication. To block external cellular\nsignals, we drove 11 EVs in the sample into a car-sized Faraday tent providing ≈93 dB of attenuation, blocking their\n cellular connection entirely. Stationary Idle and Active tests were repeated inside the tent to see whether\n traffic that normally goes out over cellular rerouted to Wi-Fi instead.
\nIn total, we experimented with 30 connected vehicle\n companion apps that were paired with the vehicles at\n Consumer Reports’s testing facility.
\n01 We used a combination of test phones and iOS versions for our
experiments: an iPhone 8/iOS 16.6, an iPhone X/iOS 16.7.11, and an\niPhone 13/iOS 18.5.
02 To minimize background traffic, we deleted all
non-essential apps on the test phones and tested apps one-by-one,\nincluding deleting each vehicle app and restarting the phone before\ndownloading the next app.
03 We used the iOS native screen recording
feature to record our interactions with each app for later review.
04 To capture and decrypt network traffic from
the companion mobile apps, we used iPhones with custom root certificates connected\nto mitmproxy.
01 During app installation and login we accepted all permission requests (e.g., tracking,
location, calendar access, Bluetooth, notifications) that the application requested
02 We had a Consumer Reports employee log into the app using
their existing credentials associated with a vehicle on the lot.
03 Once we were logged-in, we manually exercised
all available functionality, such as looking for nearby charging staions, geolocating the vehicle, viewing vehicle data and service\nhistory (e.g., tire pressure), viewing notifications (e.g., “doors are\nunlocked”), and viewing in-app privacy policies.
04 Some apps allowed
us to perform physical interactions on the vehicle, such as remotely\nopening the trunk. We performed all such actions and verified that\nthe vehicle completed each request.
$1.2M+\n estimated cost to independently procure this fleet, only possible due to Consumer Reports partnership
\nManufacturer\n Brand\n Year\n Model\n Vehicle Tests
\nDriving\n Idle\n In-Tent\n Cellular
\nGeneral Motors (GM)\n Buick 2024 Envista ✓ ✓ – –
\nCadillac 2024 Lyriq ✓ ✓ ✓ –\n Chevrolet 2024 Blazer ✓ ✓ ✓ –
\nStellantis\n Dodge 2023 Hornet - ✓ – –
\nFiat 2024 500e ✓ ✓ ✓ –\n RAM 2025 1500 Bighorn ✓ ✓ – –
\nFisker\n Fisker 2023 Ocean ✓ ✓ - –
\nFord Motor Co.\n Ford 2022 F150 Lightning ✓ ✓ - –
\nFord 2024 Mustang GT Fastback ✓ ✓ – –
\nHonda Motor Co.\n Honda 2024 Prologue Touring AWD ✓ ✓ ✓ –
\nTata Motors\n Land Rover 2023 Range Rover Sport ✓ ✓ – –
\nToyota Motor Corp.\n Lexus 2024 NX450H+ PHEV ✓ ✓ – –
\nToyota 2023 Corolla Cross ✓ ✓ – –\n Subaru 2023 Solterra ✓ ✓ ✓ –
\nLucid\n Lucid 2023 Air Touring ✓ ✓ ✓ –
\nMercedes-Benz Group AG\n Mercedes 2023 EQS450 4Matic ✓ ✓ - –
\nRenault-Nissan-Mitsubishi Alliance\n Nissan 2023 Ariya Platinum ✓ ✓ ✓ –
\nRivian\n Rivian 2022 R1S ✓ ✓ ✓ –
\nTesla\n Tesla 2024 Cybertruck ✓ ✓ ✓ –
\nTesla 2024 Model 3 ✓ ✓ ✓ ✓
\nZhejiang Geely Holding Group\n Volvo 2024 C40 ✓ ✓ ✓ –
\nWhile
we tested a wide range of vehicles, we did not cover every manufacturer in the U.S. market.\nAs with all empirical studies, our results\nshould be interpreted as a snapshot in time, and may not generalize\nto vehicles outside our sample or outside the U.S.
19 of 21 vehicles contacted at least one third party over Wi-Fi, including known advertising and
tracking domains
7 of 30 companion apps transmitted sensitive identifiers (VINs, emails, phone numbers, precise
location) to third parties associated with advertising and tracking.
Transmiting multiple forms of PII to the same third party allows advertisers to build in-depth profiles on consumers
\nAll apps\n Only apps with cross-context tracking
\nApp VIN Location Phone Email
\nClick any company chip for what it received and from which app.
\n-
\nPairing a companion app roughly doubled a vehicle's exposure to advertising/tracking companies on
average, and in some cases added 20+ new ones.
vehicle-only ATA companies
\nClick any box above for more info.
\n-\n The current system does not give owners the ability to choose.
\nAssuming owners can find the particular agreements, if an owner decides they are uncomfortable with the\n data sharing described within them, they are faced with (arguably)\n unfair choices:
\n01 accept the agreements regardless of their concerns
\n02 stop using their car's connected-vehicle features - which includes remote start, the app, and other very useful features
\n03 stop using the vehicle entirely
\nAs one notable exception, Honda improved its data
collection practices to prevent sending precise geolocation to a third\nparty associated with user tracking.
We found that vehicles, under a variety of real-world settings,
contact not only a wide range of first parties (i.e., manufacturer\ndomains) and car-specific support parties, but also third parties\nthat are known to provide advertising and tracking services.
Vehicles from the same manufacturer exhibit
different network behaviors - this makes it very difficult and expensive to study these vehicles.
When adding vehicle companion apps
to the analysis, we found that vehicle owners are exposed to even\nmore privacy-sensitive ATA communication—in some cases more\nthan two dozen additional trackers.
Our study revealed a large gap between what vehicle
manufacturers publicly disclosed and how the connected vehicle\necosystem actually shares data over the Internet
Based on the opaque nature of vehicular
systems, we argue that there is a need for better transparency to\nensure increased visibility into the entire ecosystem to identify and\naddress corresponding harms.
© 2026 Northeastern University.
","headings":[{"level":1,"text":"Your car is a smartphone on wheels. Here's who's listening.","id":"your-car-is-a-smartphone-on-wheels-here-s-who-s-listening"},{"level":3,"text":"Research Questions","id":"research-questions"},{"level":3,"text":"Methods","id":"methods"},{"level":3,"text":"Vehicle Dataset","id":"vehicle-dataset"},{"level":3,"text":"What We Found","id":"what-we-found"},{"level":3,"text":"Manufacturer Responses","id":"manufacturer-responses"},{"level":3,"text":"What It Means","id":"what-it-means"},{"level":2,"text":"Research Questions","id":"research-questions-2"},{"level":2,"text":"Methods","id":"methods-2"},{"level":3,"text":"Vehicle Testing","id":"vehicle-testing"},{"level":3,"text":"App Testing","id":"app-testing"},{"level":2,"text":"Vehicle Dataset","id":"vehicle-dataset-2"},{"level":2,"text":"Findings","id":"findings"},{"level":2,"text":"Manufacturer Disclosures","id":"manufacturer-disclosures"},{"level":2,"text":"Conclusion","id":"conclusion"}]}}