Your Car's App May Be the Bigger Privacy Leak: Study Maps Where 21 Cars and 30 Apps Send Data

Modern cars are often called "smartphones on wheels," and a new study suggests the comparison holds up where privacy is concerned. Researchers at Northeastern University measured where 21 late-model vehicles and 30 automaker companion apps send data, and found traffic to advertising, tracking and analytics companies across most of the sample. The biggest exposure often came not from the car itself but from the app owners install to unlock doors or check charge levels.

The paper, "Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem," was presented at the ACM Internet Measurement Conference (IMC '26) in Karlsruhe, Germany, and published by ACM on October 12 (DOI 10.1145/3777912.3839795). Its authors are Nicole Zagson and Sarah Elizabeth Gillespie (co-first authors), Jason Veara, Devin Patel, David Choffnes, Alan Mislove, Aanjhan Ranganathan, Piotr Sapiezynski and Christo Wilson. The work was done with Consumer Reports, which supplied its test fleet and track in Connecticut.

This is privacy measurement, not a hack. The researchers describe no exploit, and most of what the cars sent was encrypted, so the vehicle findings are about who the cars talk to rather than what they say. The app findings go further, because the team could decrypt app traffic on its own test phones.

How the cars were tested

The team tested 21 U.S. vehicles from 19 brands between October 2024 and August 2025, a fleet the authors estimate would have cost over $1.2 million to buy themselves. Each car was joined to a Raspberry Pi Wi-Fi access point that logged every packet while the vehicle sat idle for 30 minutes, while researchers pressed every button and explored every infotainment menu for 30 minutes, and during 15 minutes of driving on Consumer Reports' private roads, including hard braking and swerving.

The obstacle is cellular. Every car had an active manufacturer-provisioned connection that researchers could not see. To push traffic onto Wi-Fi, they drove 11 electric vehicles into a 5.8 m by 2.75 m by 2.45 m Faraday tent that blocked roughly 93 dB of cellular signal. Only EVs went inside, to avoid running combustion engines in an enclosed space. One car, the 2024 Tesla Model 3, has a user-accessible SIM slot, so the team loaded a custom SIM and ran a private LTE/5G network inside the tent to capture its cellular traffic directly.

Payloads stayed out of reach. The vast majority of vehicle traffic was TLS-encrypted, and every tested car rejected the team's attempts to insert a man-in-the-middle certificate, which the authors take as evidence that manufacturers enforce certificate validation. What remained visible was the domain names (from DNS lookups and TLS Server Name Indication), plus the volume and timing of traffic.

For the apps, the researchers used iPhones with their own root certificates and mitmproxy, logged in with Consumer Reports staff accounts tied to real cars on the lot, accepted every permission prompt, and exercised every feature, including remote actions such as opening the trunk. Some apps pinned certificates for login domains, which the team excluded from interception; those were mostly the automakers' own domains.

Who the cars talk to

Across 1,338 distinct domain names, the researchers hand-classified 227 as first party (the automaker), 136 as support services such as CDNs and cloud providers, 600 as integrated services built into infotainment (navigation, roadside assistance, streaming), and 367 as advertising, tracking or analytics (ATA). They built their own lists because standard blocklists such as EasyList and Disconnect misclassified 360 domains, or 26.91%, in the vehicle context.

The cars varied enormously. Eleven contacted at least one ATA domain, averaging 8.7 unique ones each, and 13 of 21 contacted Google-associated ATA domains such as doubleclick.net and googlesyndication.com. Cars with rich infotainment or full Android Automotive with Google services contacted the most third parties; the Buick Envista and Mercedes EQS reached only their automaker's servers over Wi-Fi.

Unique second-level domains contacted over Wi-Fi, from the paper's Table A3. The full table covers all 21 vehicles.

Even sister brands behaved differently. The Envista shares GM's backend with the Lyriq and Blazer but does not run Android Automotive, which the authors say likely explains its far smaller footprint. The most common third-party companies were Alphabet (13 vehicles), Amazon (12), Spotify (8) and Liberty Media, SiriusXM's parent (7). The team also found 14 vehicle-focused tracking domains that existing blocklists miss, such as appsvc-ingest.inrix.io.

Blocking cellular revealed more. For seven of the 11 EVs in the tent, the Wi-Fi capture showed more first and third parties than outside it, including 27 more ATA domains for the Model 3 and 14 more for the Cybertruck. On the Model 3, the analytics domain conviva.com appeared only over cellular, and moved to Wi-Fi once cellular was blocked. Driving generally produced less third-party traffic than playing with the infotainment system, with the Cybertruck a notable exception at 19 more integrated and seven more ATA domains while driving.

The apps are the bigger leak

Seventy percent of the apps contacted more than five unique ATA domains, compared with 29% of vehicles, and all but one app contacted multiple ATA third parties. For most vehicles, the companion app at least doubled the owner's total exposure to tracking companies; the Buick Envista and Nissan Ariya, nearly silent on their own, reached 20 or more ATA companies once their apps were counted. The heaviest apps by unique ATA domains were myCadillac (51), myBuick, My BMW and Toyota (47 each). Across apps, Alphabet appeared in 28, Adobe and Meta in 15 each, and Microsoft and OneTrust in 12 each.

Because app traffic could be decrypted, the team searched it for the test owners' VINs, license plates, names, phone numbers, emails, locations and Wi-Fi details, including hashed versions. Seven apps sent personal data to ATA companies:

From the paper's Table 6. The four GM apps are myCadillac, myChevrolet, myBuick and myGMC. All four sent email; myCadillac, myChevrolet and myGMC sent location; myGMC also sent a phone number. The 10 recipients of VINs from the GM apps were Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo; email, location and phone went to Adobe and ContentSquare. HondaLink and MyNISSAN sent their extra data to the same company that received the VIN.

The VIN is the crux. The authors suspect it is being used as a stable identifier, much like a phone's advertising ID, except that a VIN cannot be reset. Paired with an email address, it lets an ad company link a specific car, and its owner, to that person's behavior elsewhere online. The paper also found five vehicles and six apps reaching 13 IP addresses outside the U.S., in the Netherlands, Ireland, Germany and Canada.

The authors stress these are lower bounds: they could not read vehicle payloads, most cellular traffic or pinned app domains, and could not see any data automakers share server to server.

What the automakers said

Reviewing privacy policies in May 2025, the researchers found that every manufacturer whose app shared personal data disclosed that it may share with third parties, but not which ones or why. GM, Lincoln and Nissan disclosed VIN sharing; Nissan, the paper says, "questionably asserted" that sharing a VIN was more privacy-preserving than other identifiers.

The team contacted 17 of 18 manufacturers (Fisker had gone out of business) and received 14 responses. All said the flows matched their contracts with service providers. Five said their apps open some links in an embedded browser, where third-party trackers may sit, and three claimed those pages ask for cookie consent, which the researchers did not always see in their recordings. Seven said it is the owner's job to read and accept third-party terms for preinstalled in-car software. The authors call that an unfair choice and quote Tesla's warning that declining its data sharing "may result in your vehicle suffering from reduced functionality, serious damage, or inoperability."

One company changed course. Honda told the researchers it asked Amplitude to delete all location data it had received and updated HondaLink to stop sending geolocation to it. The authors call for more transparency and continued measurement of vehicles as connected systems rather than standalone products. Their domain classification lists are published on GitHub.

The paper also cites earlier enforcement. In January, the U.S. Federal Trade Commission finalized an order with GM and OnStar over allegations that they collected and sold drivers' precise location and driving behavior data without informed consent.

What you can do

• Treat the companion app as the main exposure. In this study the app usually at least doubled an owner's contact with tracking companies. If you do not use its remote features, consider whether you need it installed.
• Review tracking permissions on your phone. The researchers accepted every prompt, including tracking. On iPhone, Settings, Privacy & Security, Tracking lets you withdraw permission per app; Apple says "Ask App Not to Track" blocks access to the advertising identifier and bars tracking with other identifiers such as email, per its support page. The paper did not test whether declining changes what car apps send, and a VIN is not a phone identifier you can reset.
• Be wary of links inside car apps. Several automakers told the researchers that in-app links open web pages in an embedded browser, where third-party trackers may collect data.
• Read the opt-out screens before you tap. Declining data sharing can limit features; Rivian warns it may disable navigation, lane keeping assistance and over-the-air updates. Know the trade-off before choosing.
• GM owners have new rights. Under the FTC order, GM must let U.S. consumers request a copy of their data and its deletion, disable precise geolocation collection where the vehicle supports it, and opt out of geolocation and driver behavior collection, with limited exceptions.