Modern cars are equipped with networking vehicle technologies such as WiFi and GPS, which collect a large amount of data about car owners. According to a new study conducted by researchers at Northeastern University, this data is not kept private.

This conclusion is not new – previous investigations and lawsuits have already revealed how driving data is collected and shared with third parties, including insurance companies. What this research reveals is the scale of the problem, as well as how difficult it is for consumers to avoid this data, unless they simply choose not to use that car, or to forego convenient features such as remote start and remote unlocking.

Researchers collaborated with Consumer Reports to test 21 newer models from 17 automobile manufacturers, including Cadillac and Chevrolet under General Motors, as well as brands such as Ford, Lucid, Rivian, Tesla, and Toyota. They also examined 30 mobile apps that come with these vehicles to “understand the privacy implications of connected car ecosystems.” This peer-reviewed study will be published this week.

Research shows that the consequences are not optimistic for consumers, as their data is being shared with technology companies including Adobe, ContentSquare, Google, Microsoft, Meta, Snap, and Yahoo.

Of the 21 vehicles tested, 19 sent traffic to at least one third-party entity; among the 30 applications, 7 provided sensitive data such as vehicle identification numbers ( VIN ), email addresses, phone numbers, and precise locations to third-party companies related to tracking and advertising.

The study found that this situation often goes a step further: various forms of information are sent to the same third party, allowing advertisers and data brokers to create detailed profiles of consumers. These profiles are particularly difficult for consumers to escape from, as they are sold to a variety of companies, including insurance companies and banks.

After researchers paired the supporting applications with vehicles, the exposure to advertising and tracking companies nearly doubled.

The research findings have been shared with various manufacturers. Researchers stated that, except for Honda, all other companies shifted the blame to other parties and often attributed it to consumers. (Upon learning of these findings, Honda indeed improved its data collection practices and requested its supplier Amplitude to delete all geolocation data it had received.)

Consumer Reports was informed by several automobile manufacturers that certain links within their companion apps would open to external web pages, which may contain cookie that collects customer data. Regardless of how this data is collected, drivers were not notified about this.