Researchers from Northeastern University, in partnership with Consumer Reports, examined the data traffic of 21 vehicles and 30 apps from different manufacturers. The study, to be shared at the Internet Measurement Conference in October, discovered that all vehicles except two connect to third-party companies, and seven of the apps transmit sensitive information to advertising or tracking firms. Features such as remote access, navigation, and maintenance alerts are often sold as conveniences to consumers. The study found that a Tesla Model 3 communicates with 34 tracking domains—related to advertising, tracking, or data analysis—compared to 23 for the Cybertruck. In contrast, the Buick Envista and the Mercedes EQS only send data to their respective manufacturers. To test how vehicles handle signal loss, researchers placed 11 electric vehicles in a Faraday tent, which blocks mobile network signals. Some vehicles switched to Wi-Fi, revealing 27 additional trackers for the Model 3 and 14 for the Cybertruck. Mobile apps provided by manufacturers, which are installed on smartphones, further increase data sharing. Seventy percent of these apps contact more than five trackers, compared to 29% of the vehicles. The Buick Envista and the Nissan Ariya, which are nearly silent in terms of data transmission from the car itself, share data with more than 20 advertising or analysis companies when their mobile apps are considered. Seven apps—HondaLink, Lincoln, MyNISSAN, myCadillac, myChevrolet, myBuick, and myGMC—transmit the vehicle’s serial number (VIN), an email, a phone number, or a location to companies like Adobe, Google, Meta, or Snap. Unlike the advertising identifier on a smartphone, which can be reset, the VIN is assigned at the time of manufacturing and never changes. When linked to an email, it connects the owner, their car, and their online behavior across different platforms. Last year, the Federal Trade Commission (FTC) accused GM of reselling customer location and driving habits collected through OnStar to Verisk and LexisNexis, which may have led to higher insurance premiums. Four of the seven apps in question belong to GM. Out of 17 manufacturers contacted by the researchers, 14 responded. Some explained that the trackers are part of contracts with service providers, while others said they are embedded in open web pages or integrated browsers within the apps. Some pointed to the customer’s responsibility to review terms of use. Tesla warned that declining data collection could lead to reduced features or potential damage to the vehicle. Only Honda took action by requesting Amplitude, a usage analysis tool, to delete the location data it had received. As a result, HondaLink no longer sends location information.