A study by Northeastern University found late-model vehicles and their companion mobile applications routinely collect and transmit driver data to major technology companies. Researchers at Consumer Reports' Auto Test Center in Connecticut documented these data flows between vehicles, apps and third-party recipients.
The investigation tested 21 vehicles and their companion apps from model years 2022 through 2025. It documented the specific data siphoned from cars and the companies receiving it. The vehicles included both mass-market and luxury brands, with many being electric vehicles to facilitate indoor testing within a Faraday tent.
Nearly every automaker's vehicle sent data to outside companies. Nearly one-quarter of the tested vehicle apps transmitted personally identifiable information (PII), including vehicle owners’ names, vehicle identification numbers (VINs) and precise geographic locations.
This PII allows companies to link driving behavior to existing personal data profiles assembled by data brokers and marketers. These profiles are regularly sold to financial institutions, insurers, pharmaceutical companies and retailers, who then use the information for personalized loan terms and targeted offers, according to a prior investigation by Consumer Reports and CalMatters.
The primary recipients of this driver data include major tech entities such as Amazon, Google, Meta, Microsoft, Pinterest, Snap and Yahoo. Nicole Zagson, a doctoral candidate in cybersecurity at Northeastern and a co-author of the study, said, “Whether or not consumers are aware, big tech companies are all over the vehicles that we drive.”
The study’s findings highlight a revenue stream for these tech companies, leveraging granular consumer behavior data to enhance advertising targeting and inform new product development. This access to driving patterns and personal identifiers strengthens competitive moats in the digital advertising and data brokerage sectors.
Sarah Elizabeth Gillespie, another co-author, said there is a lack of consumer choice. “It does not appear that a customer can buy a new car that does not track you,” Gillespie said. This indicates a pervasive data collection model integrated into modern automotive manufacturing.
Automakers have faced regulatory reprimands and fines, in addition to lawsuits, for allegedly failing to clearly disclose these data collection practices. The Northeastern study is the first to directly document the specific data flows to third-party tech firms.
The economic implications extend to sectors beyond direct advertising. Insurers and lenders can tailor premiums and interest rates based on driving habits, creating a direct financial impact on consumers. This data underpins personalized financial products, shifting risk assessments and pricing models for millions of vehicle owners.
