Summary
A Northeastern-led study found that 19 of 21 US-market vehicles tested contacted at least one third-party domain over Wi-Fi. Seven of 30 companion apps sent sensitive identifiers to third parties associated with advertising and tracking.
A Northeastern University-led study of 21 vehicles sold in the US found that 19 contacted at least one third-party domain over Wi-Fi. The researchers also examined 30 companion apps and found that seven sent sensitive identifiers—including VINs, email addresses, phone numbers or precise location—to third parties associated with advertising and tracking.
The project, conducted with Consumer Reports, measured network traffic from vehicles and apps between October 2024 and August 2025. Its results offer a snapshot of how connected-car services communicate with outside companies, rather than a survey of every vehicle or app on the market.
Contents
How the researchers measured traffic
The team tested vehicles from 19 brands in a controlled setting. For vehicle tests, it routed Wi-Fi traffic through a custom access point built on a Raspberry Pi and recorded the network destinations. The researchers could see which domains vehicles contacted, but the vehicle traffic was encrypted, so its packet contents were not readable through this method.
The app tests used 30 companion apps paired with vehicles at the Consumer Reports facility. Researchers used test iPhones, installed apps one at a time, and captured and decrypted app network traffic using custom root certificates and mitmproxy. They logged in with existing vehicle-linked accounts and exercised available features, such as locating a vehicle or checking its data and service history. The researchers accepted the permission requests made by each app during testing.
The project describes its paper as peer reviewed and says it will be published at IMC '26.
What the study found
Nineteen of the 21 vehicles contacted at least one third-party domain over Wi-Fi, including domains the researchers identified as providing advertising or tracking services. This result concerns the destinations of vehicle network traffic; because that traffic was encrypted, the vehicle tests did not reveal the contents of each communication.
In the app tests, seven of 30 apps transmitted one or more sensitive identifiers to third parties associated with advertising and tracking. Five apps sent a vehicle identification number (VIN) along with other personal information to trackers. The researchers also report that pairing an app with a vehicle roughly doubled exposure to advertising and tracking companies on average, with some apps adding more than 20.
After the team shared its findings with manufacturers, Honda was a notable exception in its response: the researchers say it improved data-collection practices to prevent precise geolocation from being sent to a third party associated with user tracking.
Why the distinction matters
Connected vehicles and their apps are separate points of communication with outside services. The study’s vehicle measurements show which third-party domains cars contacted over Wi-Fi, while its app measurements could identify some of the information transmitted. Keeping those findings distinct matters: the vehicle results do not, by themselves, show that every contacted domain received a particular personal identifier.
The app results indicate that adding a companion app can increase a vehicle owner’s exposure to advertising and tracking companies. The researchers argue that limited visibility into these data flows makes it difficult for consumers to understand who receives information once it leaves a vehicle or app.
The sample was limited to 21 vehicles from the US market and 30 apps, so the findings are a measurement of that tested group at that time. The project notes that its results may not generalise to vehicles outside the sample or outside the US.