Researchers at Northeastern University, partnering with Consumer Reports, have completed the first large-scale measurement study of the connected-vehicle ecosystem, examining how modern cars collect and share personal data.
The study tested 21 late-model vehicles and 30 companion mobile apps between October 2024 and August 2025 to understand privacy implications in the connected car market. Over 75% of vehicles sold globally now have built-in internet connectivity—Wi-Fi, cellular, and GPS—enabling constant communication with manufacturers and outside companies.
To conduct the research, the team used a controlled testing environment at Consumer Reports’s facility. They intercepted Wi-Fi traffic from vehicles using a custom access point configured on a Raspberry Pi, logged network packets, and identified destinations where vehicles sent data. To test whether blocking cellular signals would cause vehicles to reroute data through Wi-Fi instead, researchers drove 11 electric vehicles into a Faraday tent providing approximately 93 decibels of signal attenuation, effectively blocking cellular connections entirely.
The key finding: once data leaves a vehicle or companion app, consumers lose all control over it. According to the research, manufacturers and companies that receive consumer information frequently share or sell this data to undisclosed third parties. The study documents data flows between vehicles, mobile apps, and numerous first and third-party servers.
The vehicle sample included models from major manufacturers including General Motors, Ford, Tesla, Honda, Toyota, Mercedes-Benz, Nissan, Rivian, and others. Researchers also conducted a lengthy disclosure process and documented how manufacturers perceive the data-sharing issue.
The study highlights limited visibility into privacy implications across the connected vehicle ecosystem. Researchers identified two key vantage points for gaining insight: the vehicles themselves and the manufacturer-provided mobile apps.
According to the team, their findings underscore the need for continued measurement and scrutiny of connected vehicle data practices. The peer-reviewed paper will be published at IMC ’26. The research was conducted by privacy, security, and networking-systems researchers at Northeastern University’s Khoury College of Computer Sciences.
Key facts
- Over 75% of vehicles sold globally have built-in internet connectivity
- Study tested 21 late-model vehicles and 30 companion mobile apps
- Research conducted between October 2024 and August 2025
- Connected cars send data to multiple first and third-party servers
- Consumers have no control over their data once it leaves their device
- Manufacturers frequently share or sell consumer data to undisclosed third parties
- Faraday tent experiments tested whether blocking cellular signals reroutes data to Wi-Fi