These Popular Cars Were Exposing Your Sensitive Data Through Connected Features

Modern cars have become computers on wheels, and a peer-reviewed study published in September 2026 shows they were behaving like one: quietly sending your data to third parties. Researchers at Northeastern University, working with Consumer Reports, tested 21 vehicles across major brands and 30 companion mobile apps between October 2024 and August 2025 — and found that 19 of the 21 cars contacted at least one third-party company over the internet, while several popular automaker apps handed advertisers genuinely sensitive personal data, including vehicle identification numbers (VINs), email addresses, phone numbers, and precise locations.

If you drive a connected car — one with remote start, live navigation, Wi-Fi hotspots, or a companion app on your phone — this is what the research found about where your data was going.

How the Study Worked

The researchers did not just read privacy policies. They captured the actual network traffic from the cars: vehicle Wi-Fi data streams while cars were parked and driven, infotainment system behavior, and, for some tests, a giant Faraday tent that blocked cellular connections so they could isolate exactly what each car was sending. They also decrypted companion-app traffic using instrumented phones.

What they found: more than half of the tested vehicles contacted domains classified as advertising, tracking, or analytics (ATA) companies — names like Alphabet (Google), Amazon, Mapbox, and Meta. And pairing the companion app to the vehicle roughly doubled the number of advertising and tracking companies your data reached.

The Worst Offenders Among the Cars

The study named names. The Tesla Model 3 topped the charts, contacting 34 unique ad-tracking domains; the Tesla Cybertruck reached 23. Other vehicles flagged included:

• Cadillac Lyriq — 10 advertising/tracking domains
• Lucid — 9 domains
• Chevrolet Blazer — 7 domains

On the other end of the spectrum, the Nissan Ariya, Land Rover Range Rover, Mercedes-Benz EQS, and Buick Envista contacted no advertising or tracking domains at all — proof that it is technically possible to build a connected car without constantly phoning home to ad companies.

The researchers shared their findings with 17 of the 18 automakers involved; only 14 replied.

The Bigger Problem: The Apps on Your Phone

If the vehicles’ behavior was concerning, the companion apps were worse. Seven of the 30 apps transmitted sensitive identifiers — VINs, email addresses, phone numbers, or precise location — to third parties associated with advertising and tracking. Those apps were:

• myCadillac
• myChevrolet
• myBuick
• myGMC
• HondaLink
• Lincoln
• MyNISSAN

The four General Motors apps transmitted VINs to multiple companies, including Google, Meta, Microsoft, Adobe, and Acxiom. And when Cadillac’s companion app was paired with the vehicle, it added 26 advertising and tracking companies beyond what the car itself was already contacting.

Why do VINs matter so much? Unlike a phone’s advertising ID, which can be reset, a VIN is a permanent identifier for your vehicle. Combined with your email or phone number, it lets advertisers link your car ownership to your activity across other apps and websites — and those profiles get sold on to insurers, banks, and other buyers.

This is not the first time automakers have been caught here. Texas Attorney General Ken Paxton has investigated car manufacturers over their data practices and sued General Motors over allegations that it sold customer driving data to third parties.

Mozilla’s Earlier Warning: “The Worst Category Ever Reviewed”

The 2026 study builds on an earlier alarm. In September 2023, the Mozilla Foundation reviewed 25 major car brands for its “Privacy Not Included” research and found that every single one failed. Cars became the worst product category Mozilla had ever reviewed for privacy — ranking below even mental-health apps and sex toys.

Mozilla’s findings:

• 84% of car brands shared or sold personal data; 76% sold it outright
• 92% gave drivers no meaningful control over their data
• Only Renault and Dacia allowed users to delete their personal data
• Not one brand met Mozilla’s minimum security standards, which include basics like encryption
• Nissan and Kia’s privacy policies admitted to collecting categories including sexual activity and genetic data

Why This Matters in Pakistan

Pakistani buyers are increasingly purchasing connected cars. Toyota, Honda, Nissan, and Suzuki dominate local roads, and newer imported and electric models arrive with companion apps, over-the-air updates, and always-on telemetry. The study’s flagging of HondaLink and MyNISSAN — apps from brands that are among Pakistan’s best-sellers — should give local drivers pause before tapping “accept” on every permission prompt.

The more serious problem is legal. As of May 2026, Pakistan still had no comprehensive, enacted data protection law; the Prevention of Electronic Crimes Act (PECA) 2016 is a criminal statute rather than a privacy framework, and the long-drafted Personal Data Protection Bill had not been passed into law. That means if your car’s data is collected, sold, or leaked, there is no GDPR-style right to access it, correct it, or have it deleted — and no dedicated regulator to complain to.

What You Can Actually Do

You cannot realistically disconnect a modern connected car entirely — features like remote start and unlock depend on the same channels that leak data. But you can reduce exposure:

1. Check your car’s privacy settings. Most modern vehicles have a menu for data collection preferences; turn off what you do not need.
2. Audit the companion app. Review the permissions it holds on your phone, and consider uninstalling it if you only use features that work without it.
3. Limit phone pairing. Android Auto and Apple CarPlay move data both ways — disconnect when not in use.
4. Buy older or simpler when privacy matters. Some models contacted no tracking domains at all.