Connected cars can contact dozens of outside domains, new research finds

At a glance

What data do connected cars send?

Researchers at Northeastern University and Consumer Reports have taken a direct look at how connected cars communicate over the internet, measuring network traffic rather than relying only on what manufacturers say in their privacy policies. The study covered 21 cars from 19 brands and found a wide range of connections, from manufacturer-owned services to advertising, tracking, analytics, mapping, media and large technology companies.

Every vehicle tested contacted at least one first-party domain belonging to its manufacturer. Some appeared to go little further. The Buick Envista and Mercedes-Benz EQS did not appear to contact any additional domains during the researchers' tests. At the other end of the range, the Tesla Model 3 contacted 34 advertising, tracking and analytics domains, along with another 37 domains associated with apps integrated into its infotainment system.

Alphabet-owned domains appeared more frequently than those of any other company. The study's authors linked that prevalence to the spread of Android Automotive OS across the industry. They also said many of the second-level domains they observed were not required for basic services, citing advertising-related domains including doubleclick.net and googlesyndication.com. Other frequently represented categories included media services such as Spotify and Sirius XM, and mapping providers HERE, TomTom and Mapbox.

The important limitation is that the researchers could see where network traffic was going, not the contents of the encrypted packets themselves. Attempts to inspect those contents using modified certificates failed in every case. The study therefore establishes that connections were made to particular domains and shows their timing and volume, but it does not establish exactly what personal information, if any, each individual transmission contained.

How did researchers test connected car privacy?

The study was designed around observed network behaviour. Rather than drawing conclusions from written policies alone, the researchers measured traffic generated by real vehicles under several conditions, including while cars were sitting idle, being driven and using their infotainment systems. That allowed them to compare not just which domains were contacted, but also how those connections changed with different types of use.

Although encrypted traffic prevented the researchers from reading the contents of the packets, the surrounding network activity still revealed useful information. They could identify domains through DNS traffic and through Server Name Indication data in TLS handshakes. They could also compare the amount and timing of traffic and see whether a vehicle behaved differently from one scenario to another.

The team also parked 11 electric cars inside a Faraday tent. Only electric vehicles were used for this part of the experiment because running combustion-engined cars in the enclosed environment would have created an exhaust-fume problem. The aim was to cut the cars off from cellular networks and see whether their connected systems would stop communicating or shift traffic to a Wi-Fi connection that the researchers could observe.

The results were mixed. The Cadillac Lyriq, Chevrolet Blazer, Honda Prologue and Rivian R1S were among the electric vehicles that simply stopped using the affected connected systems after losing cellular service. Some other vehicles instead redirected communications over Wi-Fi. That change exposed network flows that had not previously been visible to the researchers, adding another view of how connected systems choose between available connections.

Does using a car's infotainment system increase tracking?

In almost every vehicle tested, using the infotainment system resulted in connections to more domains than either leaving the car idle or driving it. That suggests the privacy footprint of a connected vehicle is not fixed: it can expand depending on which built-in services, apps and interfaces are active at a particular time.

The Tesla Cybertruck was the exception to that broad pattern. It contacted 26 more third-party domains while being driven than it did while stationary. The finding does not reveal what information those domains received, but it shows that network activity can vary substantially according to how the vehicle is being used.

Integrated services help explain part of the picture. Modern infotainment systems can incorporate mapping, streaming media, software platforms and other connected features supplied by outside companies. The study observed traffic involving services from firms including Alphabet, Microsoft and Adobe, alongside media and mapping providers. In the Tesla Model 3, the researchers separately counted 37 domains associated with applications integrated into the infotainment system, in addition to its 34 advertising, tracking and analytics domains.

That distinction matters because a connection to a third-party domain is not, by itself, proof that a manufacturer is secretly transmitting a driver's personal information to that company. The research mapped network destinations and patterns, not packet contents. Its value is in showing how broad the connected ecosystem can become and how difficult it may be for an owner to understand all the companies involved simply from interacting with the car.

Can connected car apps share even more data?

The car itself was only part of the researchers' investigation. They also examined 30 companion smartphone apps associated with connected vehicles. In some cases, installing and using those apps exposed users to more than 20 additional advertising, tracking and analytics companies. General Motors, Toyota and Nissan were the worst performers on this particular measure.

That means the privacy footprint of a connected vehicle can extend beyond the hardware parked on the driveway. Companion apps can add another layer of software, accounts and third-party services, potentially expanding the number of companies involved in the wider connected-car system. For owners, the practical issue is that the car and the phone app may need to be considered together rather than as separate products.

The finding also helps explain why measuring live network traffic can reveal something that a policy review alone cannot. In 2023, the Mozilla Foundation examined the privacy policies of more than two dozen carmakers and described cars as the worst product category it had ever reviewed for privacy. That work was based on reading the policies rather than observing actual network connections.

The newer Northeastern University and Consumer Reports study addresses a different question. Instead of asking what companies say they may collect or share, it records which internet domains cars and apps actually contact under defined test scenarios. Even so, it does not resolve every privacy question, because encrypted packet contents remained inaccessible. The two approaches therefore illuminate different parts of the same problem: declared practices on one side and observed network behaviour on the other.

What do car manufacturers say about connected car data?

The researchers contacted 17 carmakers about their findings. Fisker had already gone out of business, and 14 of the manufacturers approached responded. All 14 said that their data-sharing arrangements with third parties were governed by contracts that prevented personally identifiable information from being used outside the scope of the relevant privacy agreements.

Some manufacturers pointed to the embedded browser used by their infotainment systems and said responsibility could fall on users to choose the appropriate option when presented with a cookie consent prompt. Seven manufacturers said consumers are responsible for reading and accepting the terms and conditions covering all the connected services they use, even where that software is already installed in the vehicle when it is purchased.

That can create a difficult trade-off. The study's authors noted that rejecting a data-sharing agreement can mean losing access to certain services or functions. Connected features are often part of the product owners expect to use, so privacy choices may not always amount to a simple decision between sharing data and continuing with the same functionality unchanged.

At least one manufacturer altered its practices after the researchers made contact. Honda changed its data handling so that it no longer shares precise location data with at least one tracking company. More broadly, the research shows why connected-car privacy is difficult to reduce to a single claim about whether a vehicle does or does not "track" its owner. Different cars contacted very different numbers and types of domains, apps could add further companies, and the study could see connection patterns without seeing the underlying encrypted information being transmitted.

Sources & further reading

• Ars Technica — This study looks at how and with whom connected cars share your data (29 September 2026)
• Consumer Reports — co-author of the connected-vehicle network measurement study
• Northeastern University — co-author of the connected-vehicle network measurement study

Figures, prices and policy details were current at the last-updated date above. Automotive pricing, incentives and regulations change frequently — verify time-sensitive details with the linked primary sources. Read our editorial policy and fact-checking standards.