Study finds outside ad and analytics contacts in 28 of 30 car apps

A study by Northeastern University and Consumer Reports found that 28 of 30 tested connected-car apps contacted an outside advertising or analytics company, while seven sent at least one personal identifier to an outside company. The findings were published on September 29, 2026. The study covered 21 vehicles representing 19 brands, as well as the 30 apps.

What the app tests found

The seven apps each sent at least one identifier, such as an owner’s name, vehicle identification number (VIN), or precise location. The results apply to the tested apps; they do not establish that every app sent all three types of information.

How researchers measured network traffic

Researchers captured outgoing vehicle traffic through a custom Wi-Fi access point while vehicles were stationary and driven. Driving tests included rapid acceleration, hard braking, and swerving. They also tried app functions such as locating a car and checking its service history.

Modified certificates did not let the researchers inspect packet contents. Instead, they analyzed network metadata: DNS domains, which identify internet destinations; TLS Server Name Indication (SNI), which can identify the server a connection is trying to reach; transmission volume and timing; and changes between test scenarios.

Eleven electric vehicles were tested in a Faraday tent that blocked cellular signals so researchers could isolate Wi-Fi traffic. Some tested vehicles stopped using connected subsystems; others redirected traffic to Wi-Fi. The method measured network destinations and patterns, not the contents or subsequent use of every transmission.

Honda’s reported response

After researchers presented their findings, Honda reportedly instructed vendor Amplitude to delete location data it had received and stopped sending further location data to the company. The reported action concerned Amplitude and those location-data transfers.