The Vehicle in Your Driveway Has a Data Problem
A joint study by Northeastern University and Consumer Reports has confirmed what privacy advocates have long suspected: the cars Americans are buying today are quietly harvesting personal data and routing it to third-party companies, including advertisers building detailed consumer profiles.
What the Research Actually Found
The Northeastern University and Consumer Reports investigation looked at data practices across new car models and found that automakers are not simply collecting diagnostic or safety-related information. The data flowing out of these vehicles is being structured and shared in ways that allow advertisers to construct granular profiles on individual drivers. That is a fundamentally different category of data use than most buyers understand when they sign a purchase agreement.
When most people think about vehicle data, they picture engine telemetry, GPS routing, or crash detection systems. Those functions make sense as part of owning a connected car. What the study describes, however, is a pipeline that moves behavioral and personal data from the vehicle to outside companies whose primary interest is not your safety or your car’s performance – it is your attention and your spending habits.
The scale of automaker data collection has grown dramatically as vehicles have added more onboard sensors, always-on internet connections, and integrated smartphone systems. A modern car can log where you go, how long you stay, how you drive, and what media you consume while doing it. Each of those data points has value on an advertising market. Automakers, facing pressure to grow revenue beyond vehicle sales alone, have found that data is a product they already own and can sell.
Consumer Reports has previously flagged automakers for weak privacy disclosures, and this study extends that work by showing the downstream effect – not just that data is collected, but that it ends up with parties whose business model depends on targeting consumers. The distance between “we collect data to improve your experience” and “advertisers are building profiles on you” is not well communicated in the contracts buyers sign.
Why This Matters More for Car Buyers Than Phone Users
Smartphones have trained people to expect data collection as a condition of using apps. There is a well-worn negotiation: free service in exchange for personal data. Cars do not carry that same cultural expectation. A buyer spending $35,000 or $55,000 on a vehicle is not operating under the assumption that the purchase itself comes with an ongoing data extraction arrangement. The psychological contract is completely different, and that gap is where the concern sits.
There is also a practical problem with opting out. On a smartphone, a user can delete an app, revoke location permissions, or switch platforms entirely. A car is a multi-year financial commitment. If a buyer discovers their vehicle’s data-sharing practices are more invasive than disclosed, their options are limited. They cannot easily update the privacy settings, and they certainly cannot return the car because they dislike the automaker’s advertising partnerships.
The profiles advertisers build from vehicle data can be more revealing than what social media generates. Driving patterns show where someone works, which places of worship they attend, which medical facilities they visit, and how often they go to a competitor’s retail location. That information, aggregated and cross-referenced with data from other sources, produces a portrait that goes well beyond what someone might voluntarily share on any platform. The fact that it’s generated passively – simply by driving – makes it harder for consumers to even conceptualize what they’re giving up.
For people who already pay attention to how tech companies monetize personal data, the car industry’s practices will feel familiar. Apple’s settlement over Siri recordings demonstrated how quietly ambient data collection can scale before most users realize it’s happening. The vehicle context adds a layer of inescapability that even the most privacy-conscious Siri users did not face.
Automakers are not uniformly transparent about these arrangements. Privacy policies exist, but they are written to satisfy legal minimums rather than to inform. The study’s findings suggest that disclosure language is not keeping pace with the actual complexity of what is being collected and where it travels. A document that runs dozens of pages in legal language is not a meaningful form of consent for the average buyer standing in a dealership.
What Buyers Can Do With Limited Options
The realistic options for a new car buyer concerned about data sharing are narrow. Reviewing privacy policies before purchase is theoretically possible, but few dealerships offer the time or context for that kind of due diligence. Some automakers provide account dashboards where owners can view and sometimes limit data collection, but those tools vary widely in what they actually control – and many data flows continue regardless of what a user adjusts in an app.
What the Northeastern University and Consumer Reports study adds to this conversation is documentation. The question of whether automakers share data with advertisers is no longer speculative. The mechanism – collection, aggregation, third-party access, profile building – is mapped. What remains unresolved is whether regulators will treat vehicle data with the same scrutiny applied to other industries, and whether automakers will face enough market pressure to change practices before legislation forces the issue.
