You buckled your seatbelt, started the engine, and headed to work — but you weren't alone in the car. Invisible passengers were riding along: advertisers, data brokers, analytics firms, and insurance companies. Your modern connected vehicle and its companion smartphone app are quietly transmitting a detailed portrait of your life to dozens of third parties, often without your meaningful knowledge or consent. This isn't a distant dystopian scenario. It's happening right now, to tens of millions of drivers.

Here's everything you need to know — and, crucially, what you can do about it today.

The Scale of the Problem Is Bigger Than You Think

A landmark study published in late September 2026 has put hard numbers to what privacy advocates have long suspected.

Researchers from Northeastern University, in collaboration with Consumer Reports, tested 21 connected cars from 21 brands and 30 related mobile apps.

The findings were striking.

Nineteen of the 21 vehicles sent Wi-Fi traffic to at least one third party, and 11 contacted at least one advertising, tracking, or analytics domain.

But the companion app situation was even more alarming.

Twenty-eight of 30 connected mobile apps sent data to at least one third-party advertising or analytics company. As the researchers put it, "pairing a companion app roughly doubled a vehicle's exposure to advertising/tracking companies on average, and in some cases added 20+ new ones."

Mozilla researchers had previously looked at the privacy terms of 25 global car brands and concluded that their cars were "the official worst category of products for privacy" they had ever reviewed.

The new Northeastern University study didn't just read privacy policies — it actually intercepted real data traffic.

Researchers parked 21 late-model vehicles at Consumer Reports' Auto Test Center in Connecticut, put a Raspberry Pi between each car and the internet, and decrypted traffic from 30 automaker companion apps on test iPhones. The peer-reviewed paper measures connected car data sharing on the wire, not just on paper.

What Data Is Actually Being Transmitted?

The data flowing out of your vehicle goes far beyond a simple location ping.

A 2025 survey by the Maryland Insurance Administration found that telematics systems can track speed and speeding events, hard braking, rapid acceleration, cornering, time of day driven, miles driven, phone use while driving, trip start and end locations, idle time, turn signal use, and altitude.

Perhaps most concerning is how individually identifying that data can become.

The most worrisome privacy finding, researchers say, is that some vehicles and their connected mobile apps shared both a VIN and another identifier, such as the vehicle owner's name or email address. With those two pieces of information, a major advertising or technology company can link the owner to one of many commercially available consumer profiles, which are sold by data brokers and other companies — data that often includes online behaviour and shopping history.

Seven apps transmitted personal information to advertising and tracking third parties — all four GM apps, HondaLink, Lincoln, and MyNissan. VINs were the most common identifier sent, with recipients including Google, Microsoft, and Meta.

The Insurance Angle: Your Driving Score Is Worth Money

One of the most financially damaging consequences of connected car data sharing is its use in insurance pricing — and it has already cost real drivers real money.

In March 2024, the New York Times published an investigation revealing that General Motors had been secretly sharing detailed driving behaviour with data brokers, who then sold it to insurance companies.

The pipeline worked like this:

LexisNexis Risk Solutions and Verisk received data from automakers and mobile apps and sold driver behaviour scores to insurance companies. LexisNexis packaged that data through its Telematics OnDemand product, which it markets as an exchange connecting automakers and insurance carriers.

If LexisNexis scored you as an aggressive driver based on your car's telematics data, your insurance company could raise your rate — without ever telling you why, without disclosing the data source, and without giving you a chance to dispute the information.

In January 2025, the Federal Trade Commission finalised a settlement with GM in which the company agreed to stop selling driver geolocation and driving-behaviour data to consumer reporting agencies and to obtain separate, affirmative consent before sharing sensitive telematics with any third party.

While that's a step forward, regulators acknowledge that the systemic problem extends well beyond one automaker.

Who's Receiving Your Data?

The list of companies receiving connected car data reads like a Who's Who of the digital advertising world.

Vehicles and companion apps have been found sending driver data to Adobe, ContentSquare, Google, Microsoft, Meta, Snap, and Yahoo.

Many automakers share data with third-party companies for a fee, including insurance providers, data brokers, advertisers, and marketing firms.

And the privacy policies that are supposed to protect you?

Every manufacturer whose app shared personal data disclosed that it may share data with third parties — but the policies did not name those third parties or the purposes.

Meanwhile,

seven manufacturers said consumers are responsible for reading and accepting the terms for third-party software in the vehicle, including pre-installed software.

The regulatory landscape is struggling to keep up.

Some states have focused on regulating how car manufacturers handle consumer data, while others have considered measures to restrict its use by third parties. With no cohesive national strategy, consumers are left vulnerable.

The Trade-Off Trap: Opting Out Comes at a Cost

Here's the cruel twist in this story.

Some companies warn that certain vehicle features may not work fully if users do not allow telematics connectivity or data sharing — leaving consumers choosing between protecting their personal data and accessing some connected car features.

Most automakers provide options to opt out of unnecessary data sharing, but these settings are often buried within menus. Moreover, opting out of data sharing often comes with trade-offs, mostly requiring disabling useful or desirable features.

Northeastern professor David Choffnes, one of the study's authors, put it plainly:

drivers who opt out risk being left with a car that barely works.

It's a deliberately uncomfortable position for consumers to be placed in.

Practical Tips: How to Take Back Control of Your Car's Data

You're not entirely powerless. Here are concrete steps you can take right now:

1. Review and restrict your companion app permissions.

Most modern cars allow you to adjust privacy settings through the infotainment system or app. Look for options to turn off location sharing, usage reporting, and driving behaviour tracking.

2. Use your automaker's privacy portal.

Under state privacy laws, some carmakers allow owners across the United States to submit requests to limit the use of their personal data, opt out of sharing it, or delete it.

You can also go through Privacy4Cars, a free online service that streamlines the process. It can point car owners to their automaker's request portal or file a submission on behalf of owners in the US, Canada, the EU, Britain, and Australia.

3. Disable connected services you don't actively use.
For Ford/Lincoln owners,

Ford requires users to disable data sharing from within the vehicle's infotainment system

via Settings > Connectivity > Connected Vehicle Features. For Toyota and Lexus owners,

the Privacy Portal on the Toyota app allows you to see the data your vehicle is transmitting, how Toyota utilises it, and to review or change your vehicle's data transmission preferences.

4. Unpair your phone when not needed.

If your phone is connected to your car, unpair it or limit data access. Remove shared contacts, messages, and app permissions

when you don't need them for navigation.

5. Read update terms carefully.

Software updates often include new data-sharing terms. Read update notes carefully before agreeing.

What you consent to at the update screen may have lasting implications.

6. Ask the right questions before buying your next vehicle.

The report recommends that buyers consider not only battery capacity, range, power, and technology when purchasing a new car, but also what data the vehicle collects, where it is sent, how it is used, and whether users can opt out of data sharing.

The Road Ahead

An estimated 90% of new cars now collect detailed driving information — where you go, how fast you drive, how hard you brake, and much more. Even more alarmingly, 84% of car companies sell or share this data with third parties.

As vehicles become more software-defined and internet-connected, the data flowing out of them will only grow richer and more revealing.

Positive regulatory momentum is building. Utah's 2026 legislature, for instance,

introduced legislation that would require motor vehicle manufacturers to obtain affirmative consent before sharing personal data with third parties and would prohibit manufacturers from conditioning a vehicle's sale or operation on consumer consent to data sharing.

But legislation moves slowly, and your data is being collected today.

Take the Wheel on Your Own Privacy

Your car should be a private space — not a data harvesting platform. The good news is that awareness is the first and most powerful step. Now that you know your connected car and its companion app are likely feeding information to advertisers, data brokers, and insurers, you have the knowledge to push back.

Start today: open your vehicle's companion app, navigate to its privacy or data settings, and see what's switched on by default. Visit your automaker's privacy portal and submit an opt-out or data deletion request. Share this article with fellow drivers who may not yet know what's happening under the hood of their digital vehicle experience. Your privacy is worth the ten minutes it takes to reclaim it.