Connected Cars May Be Sending Driver Data to Tech Companies
Modern vehicles collect far more information than many drivers realize. Privacy researchers at Northeastern University, working with Consumer Reports, tested 21 vehicles and 30 connected mobile applications to examine how driving data moved between cars, manufacturers, apps, and outside companies. Their findings indicate that connected vehicles can share detailed information with advertising and analytics companies, including some of the largest technology businesses in the United States.
The tested apps commonly transmitted data to third parties. Twenty-eight of the 30 applications contacted at least one external advertising or analytics company. Seven apps sent personally identifiable information, such as the vehicle owner’s name, vehicle identification number (VIN), or precise location. Several apps shared VINs together with an email address or location data, making it easier to connect vehicle activity with existing consumer profiles held by data brokers.
From a European Union data protection perspective, this type of processing may raise significant concerns under the General Data Protection Regulation (GDPR). A VIN may not identify a person on its own in every situation, but it can become personal data when combined with an owner’s name, email address, account details, or location history. Precise driving and location information can also reveal sensitive details about a person’s routines, workplace, home, and habits.
The researchers identified major technology companies—including Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo—among the recipients of vehicle-related data. These businesses may act as analytics providers, advertising platforms, software suppliers, or intermediaries in the digital advertising ecosystem. Under the GDPR, vehicle manufacturers and app providers must clearly determine their roles and responsibilities, explain the purposes of processing, identify recipients, and ensure that data sharing has a valid legal basis.
Automakers often describe connected services as “opt-in.” However, consent may not always be genuinely voluntary when drivers need to accept extensive terms to use key features or even operate the vehicle. The GDPR requires consent to be freely given, specific, informed, and unambiguous. If refusing data sharing causes substantial loss of functionality, companies may need to examine carefully whether consent is truly valid or whether another lawful basis is being relied upon.
The testing also showed that contractual restrictions on third parties may not fully protect drivers. After researchers informed Honda that one of its vendors had received location data, the company reportedly instructed the vendor to delete the information and stopped sending it. This illustrates the importance of supplier oversight, data-processing agreements, audits, retention limits, and effective deletion procedures.
Vehicle manufacturers and app providers operating in Europe should apply privacy by design and by default. They should minimize the data collected, separate vehicle operation from optional marketing services, provide clear privacy notices, limit third-party tracking, and offer practical ways to access, delete, and object to the use of personal data. Drivers should also review connected-car settings, disable unnecessary services, and exercise their GDPR rights where appropriate.
The findings demonstrate that buying a connected vehicle may involve joining a wider personal-data ecosystem. For European consumers, the key question is not only whether a car collects data, but also why the information is collected, who receives it, how long it is retained, and whether the driver has a real and informed choice.
