21 US Cars Found Sending Data To Third Parties

A recent study has found that connected vehicles are sending consumer data to various servers, including those of manufacturers and third parties, without giving users control over their information. The research, which analyzed 21 vehicles from the US market and 30 companion mobile apps between October 2024 and August 2025, used a custom access point on a Raspberry Pi to collect Wi-Fi traffic from vehicles.

The investigation involved driving 11 electric vehicles into a car-sized Faraday tent to block their cellular connection entirely, providing approximately 93 dB of attenuation. This allowed researchers to collect data on the vehicles' communication patterns.

The study found that consumer data is sent to various servers using Wi-Fi and cellular service, and once the data is sent, it is up to the companies receiving the information to decide what to do with it. In many cases, this includes sharing or selling consumer data to other undisclosed third parties.

## What the study reveals The research highlights the lack of visibility into the privacy implications of the connected vehicle ecosystem. By investigating the data flows to and from a vehicle and its companion mobile app, the study aimed to address this limited visibility. The findings raise concerns over consumer privacy, as users have no control over their data once it has left their device.

## Why it matters The study's findings have significant implications for consumer privacy. With the increasing number of connected vehicles on the road, the potential for data sharing and selling without user consent is a growing concern. As the connected vehicle ecosystem continues to evolve, it is essential to address the privacy implications and ensure that users have control over their personal data.

The study's results also underscore the need for greater transparency and regulation in the industry. As consumers become more aware of the potential risks associated with connected vehicles, manufacturers and third-party companies must prioritize user privacy and provide clear guidelines on data collection and sharing practices.