Connected Cars Are Rolling Telemetry Goldmines

Your vehicle is no longer just a mode of transport; it is a surveillance node. As first reported by The Verge, a study conducted by researchers from Northeastern University and Consumer Reports found that every one of the 21 late-model vehicles tested transmitted data to at least one third-party domain. More than half of these vehicles contacted domains specializing in analytics, tracking, or advertising (ATA).

These ATA companies—including Amplitude, LexisNexis, and Adobe—collect driving behavior and vehicle details to target drivers with advertisements or sell information to insurance companies. David Choffnes, project lead and former director of Northeastern’s Cybersecurity and Privacy Institute, noted that the choice of software platform significantly impacts data exposure, specifically highlighting that vehicles running Google Automotive Services via Android Automotive OS contacted the highest number of third-party domains.

Beyond the hardware, companion mobile apps are serving as insecure vectors for data harvesting. The Verge reports that seven specific apps—myGMC, myBuick, myChevrolet, myCadillac, MyNissan, Lincoln, and HondaLink—transmitted precise locations, phone numbers, and vehicle identification numbers (VINs) directly to advertising networks. Over 70 percent of all tested companion apps contacted five or more unique ATA domains.

This systemic harvesting follows a pattern of regulatory scrutiny. The Federal Trade Commission previously penalized General Motors for the illegal sale of precise location and driving data without informed consent, while Ford and Honda have faced fines for making opt-out processes overly difficult for customers.