Car Is a Smartphone on Wheels. Here's Who's Listening

The first large-scale measurement study of the connected-vehicle ecosystem. A connected car is a vehicle with built-in internet access — Wi-Fi, cellular, GPS — that lets it communicate constantly with its manufacturer and outside companies. Over 75% of vehicles sold globally have this connectity built-in. Report Summary Partnering with Consumer Reports, we tested 21 late model vehicles and 30 companion mobile apps to understand the privacy implications of the connected vehicle ecosystem. We go through a lengthy discolure process and provide insight into how manufacturer's perceive this data sharing issue. Our findings underscore the need for continued measurement and scrutiny of the connected vehicle ecosystem. Consumer Reports gave the team access to its purchased fleet of test vehicles — a sample that would have cost over $1.2M to assemble independently. This work is peer reviewed and will be published at IMC '26. Read the paper → We are a team of privacy, security, and networking-systems researchers at Northeastern University. See the full team → Jump directly to any section, or scroll to see the whole thing. What is this paper about, and what were we looking for? An accessible explanation of the experiments we ran. A list of the vehicles we looked at The main results and what they tell us. How the manufacturers responded to our findings The bigger picture and key takeaways. This diagram shows the data flows to and from a vehicle and its companion mobile app. Both devices send data, including private consumer data, to different 1st and 3rd party servers using Wi-Fi and cellular service. Solid arrows represent flows that were intercepted through our experiments. Once the data gets sent to these servers, it is up to the companies that receive the consumer information to make decisions on what they do with it. Unfortunately, in many cases, this includes sharing or selling consumer data to other undisclosed 3rd parties. Consumers have no control over their data once it has left their device In this paper, we take the first steps to address the limited visibility into the privacy implications of the connected vehicle ecosystem. We identify two vantage points in the ecosystem where we can gain insight into the data that connected vehicles are sharing with both manufacturers and third parties: the vehicles themselves and the mobile apps provided by manufacturers. We ask the following guiding questions: We investigated 21 vehicles from the U.S. market in a controlled environment along with 30 companion mobile apps instrumented with on-site vehicles between October 2024 and August 2025. Below is a description of the experiments we ran and our setup. To collect Wi-Fi traffic from vehicles, we configured a custom access point (AP) on a Raspberry Pi and used tcpdump to log all packets that were sent or received via this AP. This allowed us to see all the destinations the vehicles were sending data to but not the information within the packets as it was encrypted. drive 5–45 mph with acceleration & hard braking One hypothesis we tested was whether blocking a vehicle’s ability to communicate over its cellular network would force more Wi-Fi communication. To block external cellular signals, we drove 11 EVs in the sample into a car-sized Faraday tent providing ≈93 dB of attenuation, blocking their cellular connection entirely. Stationary Idle and Active tests were repeated inside the tent to see whether traffic that normally goes out over cellular rerouted to Wi-Fi instead. In total, we experimented with 30 connected vehicle companion apps that were paired with the vehicles at Consumer Reports’s testing facility. | Manufacturer | Brand | Year | Model | Vehicle Tests | ||| |---|---|---|---|---|---|---|---| | Driving | Idle | In-Tent | Cellular | |||| | General Motors (GM) | Buick | 2024 | Envista | ✓ | ✓ | – | – | | Cadillac | 2024 | Lyriq | ✓ | ✓ | ✓ | – | | | Chevrolet | 2024 | Blazer | ✓ | ✓ | ✓ | – | | | Stellantis | Dodge | 2023 | Hornet | - | ✓ | – | – | | Fiat | 2024 | 500e | ✓ | ✓ | ✓ | – | | | RAM | 2025 | 1500 Bighorn | ✓ | ✓ | – | – | | | Fisker | Fisker | 2023 | Ocean | ✓ | ✓ | - | – | | Ford Motor Co. | Ford | 2022 | F150 Lightning | ✓ | ✓ | - | – | | Ford | 2024 | Mustang GT Fastback | ✓ | ✓ | – | – | | | Honda Motor Co. | Honda | 2024 | Prologue Touring AWD | ✓ | ✓ | ✓ | – | | Tata Motors | Land Rover | 2023 | Range Rover Sport | ✓ | ✓ | – | – | | Toyota Motor Corp. | Lexus | 2024 | NX450H+ PHEV | ✓ | ✓ | – | – | | Toyota | 2023 | Corolla Cross | ✓ | ✓ | – | – | | | Subaru | 2023 | Solterra | ✓ | ✓ | ✓ | – | | | Lucid | Lucid | 2023 | Air Touring | ✓ | ✓ | ✓ | – | | Mercedes-Benz Group AG | Mercedes | 2023 | EQS450 4Matic | ✓ | ✓ | - | – | | Renault-Nissan-Mitsubishi Alliance | Nissan | 2023 | Ariya Platinum | ✓ | ✓ | ✓ | – | | Rivian | Rivian | 2022 | R1S | ✓ | ✓ | ✓ | – | | Tesla | Tesla | 2024 | Cybertruck | ✓ | ✓ | ✓ | – | | Tesla | 2024 | Model 3 | ✓ | ✓ | ✓ | ✓ | | | Zhejiang Geely Holding Group | Volvo | 2024 | C40 | ✓ | ✓ | ✓ | – | *While we tested a wide range of vehicles, we did not cover every manufacturer in the U.S. market. As with all empirical studies, our results should be interpreted as a snapshot in time, and may not generalize to vehicles outside our sample or outside the U.S. | App | VIN | Location | Phone | |---|