The study, described as the first large‑scale measurement of the connected‑vehicle ecosystem, looked at 21 late‑model vehicles sold in the U.S. market and 30 companion mobile apps that are typically paired with those vehicles. According to the source material, the testing took place between October 2024 and August 2025 at Consumer Reports’ testing facility. The researchers said they partnered with Consumer Reports, which gave the team access to a purchased fleet of test vehicles that would have cost over $1.2 million to assemble independently.
To collect data, the team configured a custom Wi‑Fi access point on a Raspberry Pi and used tcpdump to log all packets sent or received by the vehicles. This allowed them to see the destinations of the traffic, although the packet contents remained encrypted. In one set of experiments, they placed 11 electric vehicles inside a car‑sized Faraday tent providing about 93 dB of attenuation to block cellular signals, then repeated stationary idle and active tests to see whether traffic normally sent over cellular would reroute to Wi‑Fi.
The researchers identified two vantage points for gaining insight into data sharing: the vehicles themselves and the manufacturer‑provided mobile apps. They noted that both devices send data—including private consumer data—to first‑ and third‑party servers via Wi‑Fi and cellular connections. Once the data reaches those servers, the companies that receive it decide what to do with it, and in many cases this includes sharing or selling the information to undisclosed third parties. The paper emphasizes that consumers have no control over their data once it has left their device.
The team also described a lengthy disclosure process with manufacturers to understand how they perceive the data‑sharing issue. Their findings underscore the need for continued measurement and scrutiny of the connected‑vehicle ecosystem. The work has been peer reviewed and is slated for publication at the IMC 2026 conference.
While the study covered a range of makes and models—including vehicles from General Motors, Stellantis, Ford, Honda, Toyota, Subaru, Lucid, Mercedes‑Benz, Nissan, Rivian, Tesla, and Volvo—the authors cautioned that the results represent a snapshot in time and may not generalize to all vehicles sold in the U.S. or globally.
According to the source, over 75 % of vehicles sold globally now have built‑in internet connectivity (Wi‑Fi, cellular, GPS), making the privacy implications examined in this study relevant to a large portion of the automotive market.
Key facts
- 21 vehicles and 30 companion apps tested
- Testing period: October 2024 – August 2025
- Custom Raspberry Pi AP and tcpdump used to capture Wi‑Fi traffic
- Faraday tent used to block cellular signals in subset of tests
- Data sent to first‑ and third‑party servers; consumers lack control once data leaves device
- Peer‑reviewed; to be published at IMC 2026
- Partnered with Consumer Reports; fleet access valued >$1.2 M