New Cars Are Spying On You - Here's What Researchers Found

"They're listening to everything." It's a sentiment many smartphone owners have likely heard at one time or another. The truth is that there are some ways your phone can actively track you, and now it seems that your new car is doing the same thing. Researchers have found that new cars can send information about their drivers to outside companies, including businesses involved in both advertising and tracking.

In a partnership with Consumer Reports, a Northeastern University team tested twenty-one late-model vehicles from the U.S. market, representing brands including Ford, GM, Honda, Mercedes-Benz, Nissan, Toyota, Tesla, and others. The team found that nineteen of the vehicles contacted at least one third party over Wi-Fi. The researchers also tested thirty companion apps from the manufacturers and found that seven transmitted sensitive information, including vehicle identification numbers (VINs), email addresses, phone numbers, or even precise location data, to third parties associated with advertising and tracking.

But the study found that the data sharing wasn't limited to just the vehicles themselves. Using an automaker's companion app with a vehicle roughly doubled its exposure to advertising and tracking companies on average, with some apps adding more than twenty third-party contacts. Several apps were even found to send combinations of identifying information to outside companies. That includes VINs paired with email addresses or location data. This can give companies several pieces of information that can be associated with an individual and their vehicle.

The third-party companies receiving information from some new vehicles include names that drivers will likely recognize. Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo are among the biggest recipients of data from tested vehicles and apps. This means that information being collected through a car can become part of the much larger data-collection systems that drivers may already interact with.

The automakers responded after the researchers investigating the situation shared their findings. Honda said it had Amplitude, a third-party advertising company, delete the information it had received. Honda also changed its HondaLink app so that it would no longer send geolocation data to the company. Honda maintained that contractual restrictions prevented the information from being independently used or sold. GM also said that the companies it shares data with are bound by contracts that restrict how they can use that information.

The researchers monitored the cars' network connections during testing. This allowed them to see which outside servers were actually contacted. The vehicles were tested both while parked and while being driven, giving the research team a way to compare their communications under different conditions. They also separated cellular and Wi-Fi connections during some of the testing, to see if communications were limited by how they connected.

The study was extensive, so if you're curious to learn more, such as what data was shared with which companies, you can see the results in the published paper. It's also worth noting that the cars in the study were independently purchased by Consumer Reports — the company buys all the products it tests as a matter of policy.