Overview
- The Northeastern University and Consumer Reports study, published Tuesday, tested 21 late-model vehicles and 30 companion apps and found every car contacted at least one third-party domain.
- Researchers observed seven companion apps sending sensitive identifiers such as vehicle identification numbers, phone numbers, and precise GPS locations directly to advertising and analytics networks.
- Vehicles running Google’s Android Automotive OS and Google Automotive Services contacted the most third-party domains, and Alphabet/Google domains were the single most frequently reached set of addresses.
- The team captured traffic using Raspberry Pi devices and a car-sized Faraday tent to force cars onto controlled Wi‑Fi, but researchers could not decrypt payloads and therefore inferred sharing from DNS records, TLS metadata, and timing.
- Honda asked analytics vendor Amplitude to delete collected location data and updated its HondaLink app after disclosure, while other automakers gave mixed responses, a development that builds on prior privacy scrutiny and could prompt increased regulatory action and consumer concern.