Is Your Commute Being Sold? The Connected Car Data Trade

Every time an American commuter turns the ignition, an invisible auction quietly begins on the dashboard1. A landmark technical investigation released by researchers at Northeastern University in collaboration with Consumer Reports reveals that modern passenger cars and their companion mobile apps routinely harvest real-time travel records, hardware identifiers, and precise locations, transmitting them directly to commercial data brokers and Big Tech advertising giants1.

This revelation lands at a critical moment for the nation’s 230 million licensed drivers, as automotive manufacturers aggressively transition from mechanical vehicle builders into subscription-based software enterprises5. Today, more than nine out of ten new vehicles sold across the United States come equipped with factory-installed cellular modems that drivers cannot physically disconnect without disabling primary vehicle functions4. Rather than remaining sealed within vehicle hardware for mechanical safety, intimate travel histories are systematically monetized across the broader digital economy1.

The consequences of this unregulated extraction fall squarely on ordinary workers, commuters, and middle-class families9. Across the country, drivers are suffering sudden, algorithmic auto insurance rate hikes, predatory lending terms, and persistent digital profiling tied directly to where they drive and how they maneuver4. Because personal vehicle ownership remains an indispensable economic requirement for maintaining employment across most of the United States, millions of Americans are effectively coerced into trading their basic civil privacy for the right to drive to work5.

The Faraday Tent: Catching Connected Cars in the Act

To penetrate the proprietary software shielding modern automotive networks, computer scientists at Northeastern University’s Khoury College of Computer Sciences partnered with Consumer Reports at its Auto Test Center in Connecticut1. The researchers examined 21 late-model connected vehicles representing 19 distinct automotive brands across model years 2022 through 2025, alongside 30 linked smartphone companion applications1. The peer-reviewed study, titled Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem, was designed to measure real-world outbound data traffic rather than relying solely on automaker marketing claims1.

The experimental protocol required extraordinary measures to circumvent onboard cellular secrecy2. Because vehicles communicate over commercial cellular towers that conceal network packets from external observation, engineers parked 11 electric vehicles inside a massive, enclosed Faraday tent designed to suppress radio frequencies2. Once deprived of cellular signals, the vehicles defaulted back to a dedicated Wi-Fi access point controlled by the researchers, exposing all outgoing communication packets to deep network analysis2.

The empirical findings confirmed widespread behavioral tracking across the automotive market1. Nineteen of the 21 tested vehicles transmitted network traffic to outside third parties over Wi-Fi, and 11 connected directly to commercial advertising, tracking, and analytics (ATA) domains2. The Tesla Model 3 contacted 34 distinct advertising and analytics domains, followed by the Tesla Cybertruck with 23 and General Motors’ Cadillac Lyriq with 102. By contrast, the Mercedes-Benz EQS and Buick Envista avoided transmitting data to ad networks, demonstrating that invasive commercial tracking is a deliberate corporate design choice rather than an engineering requirement2.

The Identity Trap: Linking VINs Directly to Consumer Profiles

While in-dash displays present a polished interface to motorists, companion mobile applications represent the most aggressive vector of data extraction2. Automaker apps installed on smartphones to manage remote starting, door unlocking, and battery charging operate with broad operating-system permissions2. The Northeastern University investigation established that 28 of the 30 tested automaker apps transmitted user activity to outside advertising and analytics networks3.

Even more troubling for civil liberties advocates, seven automaker applications transmitted unique personally identifiable information alongside stable physical hardware tags2. Apps for brands including Honda, Nissan, Lincoln, Cadillac, Chevrolet, Buick, and GMC broadcasted Vehicle Identification Numbers (VINs), user email addresses, mobile phone numbers, and real-time GPS coordinates directly to tracking platforms2. General Motors’ companion apps forwarded vehicle VINs to ten external tech platforms, including Google, Meta Platforms, Microsoft, Adobe, Acxiom, ContentSquare, FullStory, Pinterest, Snap, and Yahoo2.

In digital marketing, pairing an email address with a vehicle’s VIN completely eliminates consumer anonymity1. A VIN is a permanent physical identifier stamped onto a car’s chassis and recorded in state vehicle registries1. When programmatic ad brokers bind a VIN to digital advertising cookies, tech platforms successfully link an individual’s physical driving routes with their online search records, household finances, and home addresses1.

The Commute on the Auction Block: Insurer Kickbacks and Premium Hikes

The corporate monetization of driver telematics extends far beyond targeted banner advertising10. Over recent years, automakers established secondary revenue pipelines by packaging granular trip metrics—including sudden braking, rapid acceleration, late-night transit, and speeding—for commercial insurance underwriters10. These behavioral profiles were quietly channeled through data intermediaries such as LexisNexis Risk Solutions and Verisk Analytics to generate actuarial driver risk scores16.

For ordinary motorists, the financial consequences of these undisclosed exchanges have been severe9. Commuters across the country reported unexpected auto insurance premium surges of 20 to 50 percent, despite maintaining clean records free of moving violations or collisions9. Actuarial software frequently penalized drivers who engaged in defensive hard braking to avoid erratic traffic, mischaracterizing necessary accident-avoidance maneuvers as reckless driving habits9. In an extensive 2025 consumer survey conducted by J.D. Power, only 38 percent of policyholders agreed that telematics driving data collected by insurers was consistently accurate10.

A congressional investigation led by U.S. Senators Ron Wyden and Edward Markey exposed the meager payouts automakers accepted to sell out driver privacy18. Official vendor records revealed that Honda received $25,920 from Verisk for tracking records covering 97,000 vehicles, amounting to roughly 26 cents per car18. Hyundai collected just over $1 million for data from 1.7 million vehicles, or approximately 61 cents per car18. While families faced crippling insurance spikes, car manufacturers sold off their personal transit histories for pocket change18.

Dark Patterns and the False Promise of Driver Consent

Automotive manufacturers have long maintained that data collection practices are entirely voluntary and thoroughly disclosed in customer user manuals and mobile software terms1. Following the release of the Northeastern University study, Honda directed its software analytics contractor, Amplitude, to permanently purge previously acquired geolocation data and rolled out an over-the-air update removing location tracking from HondaLink1. General Motors spokespersons emphasized that the company shares data exclusively with contracted vendors bound by strict nondisclosure agreements, asserting that its privacy policies are transparent and clear1.

Consumer advocacy groups and privacy watchdogs sharply contest these corporate defenses4. An evaluation by the Mozilla Foundation reviewing 25 prominent car brands found that every single manufacturer failed basic data privacy benchmarks, ranking passenger cars as the absolute worst consumer product category ever evaluated8. Standard automotive privacy documentation routinely spans dozens of pages of convoluted legalese that the average motorist cannot reasonably parse while sitting at a dealership financing desk4.

Furthermore, exercising an opt-out choice is frequently engineered to be punitive4. When drivers attempt to shut off connected tracking, vehicle software routinely disables factory satellite navigation, emergency assistance buttons, roadside crash response services, and automated climate scheduling5. By conditioning basic vehicle conveniences and vital safety features on pervasive data surrender, automakers construct an unfair choice that leaves drivers with virtually no real control5.

The Human Cost: Economic Penalties for Working Commuters

The economic impact of vehicle surveillance falls heaviest on blue-collar shift workers, gig contractors, and low-income commuters4. Ride-hail drivers and warehouse employees frequently travel late at night and during early morning hours, periods that algorithmic insurance scoring systems automatically classify as elevated risk windows10. Drivers navigating congested urban centers or deteriorated public roadways are similarly penalized for abrupt stops necessitated by hazardous road conditions9.

These automated risk scores directly undermine family financial security9. When opaque algorithms assign poor driving grades to shift workers, insurance premiums can climb beyond what modest household budgets can bear10. Motorists priced out of traditional insurance carriers are pushed into state-assigned high-risk pools, resulting in thousands of dollars in added annual expenses through no fault of their actual driving history10.

Beyond insurance premiums, this tracking infrastructure lays the groundwork for algorithmic surveillance pricing across everyday consumer life4. Financial intelligence firms and credit bureaus can ingest commute stability data, workplace travel duration, and late-night driving frequencies to dynamically alter automotive loan interest rates and credit card limits4. For millions of Americans working hard to pay off a vehicle note, the commute has ceased to be a private journey and has transformed into an extractive corporate ledger4.

Regulatory Crackdowns and Legal Retaliation

State and federal regulators have begun responding to public anger over automotive data harvesting17. In January 2026, the Federal Trade Commission finalized a major administrative consent order against General Motors after determining the company used misleading enrollment processes for OnStar Smart Driver to sell telematics to commercial data brokers17. The FTC’s landmark order prohibited General Motors from disclosing driver geolocation and driving telemetry to consumer reporting agencies for five years, while mandating affirmative consumer consent for any future tracking17.

State attorneys general have initiated parallel legal strikes19. In May 2026, California Attorney General Rob Bonta and the California Privacy Protection Agency secured a record $12.75 million civil settlement against General Motors under the California Consumer Privacy Act19. The enforcement action—which General Motors resolved without admitting liability—mandated that the automaker delete all retained driver telematics and formally instruct Verisk and LexisNexis to destroy previously purchased California commuter records19.

In Texas, Attorney General Ken Paxton filed major deceptive trade practices lawsuits against General Motors and insurer Allstate, targeting the unauthorized collection and brokering of over 45 million customer trips25. The Texas investigations expanded to include formal civil investigative demands against Subaru, Kia, and Mitsubishi regarding their telematics partnerships26. Meanwhile, private vehicle owners have launched multiple federal class-action lawsuits seeking statutory damages for unauthorized digital wiretapping and unfair enrichment5.

What Happens Next

The researchers behind the Northeastern University and Consumer Reports investigation will formally present their findings to the global cybersecurity community at the ACM Internet Measurement Conference in Germany1. The peer-reviewed technical paper is expected to provide key evidentiary support for pending congressional debates over comprehensive federal consumer privacy standards1. Consumer protection advocates are demanding federal legislation that legally separates baseline vehicle safety functions from commercial data collection1.

Federal regulators face mounting pressure to expand their enforcement actions across the entire automotive sector1. Following the precedents set by the FTC and California against General Motors, industry watchdogs anticipate similar federal consent decrees targeting domestic and foreign manufacturers operating active data-sharing programs1. In the private sector, major data brokers are already retreating from the automotive telematics market, with Verisk shutting down its driver behavior rating unit following widespread public backlash10.

For American motorists sitting in traffic today, practical self-defense options remain deeply constrained4. While motorists can audit their existing consumer files through LexisNexis and Verisk under the Fair Credit Reporting Act, permanently severing tracking requires structural regulatory intervention10. Until lawmakers enact federal protections guaranteeing drivers complete ownership over vehicle data, the simple act of driving to work will remain an open pipeline for corporate surveillance1.

Mozilla Foundation. “Privacy Not Included: Modern Cars Are a Privacy Nightmare.” September 6, 2023. https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/

Northeastern University Global News. “Car Companies Are Sharing Location and Email Address Data, Northeastern and Consumer Reports Study Shows.” September 29, 2026. https://news.northeastern.edu/2026/09/29/connected-car-privacy-violation-research/

Consumer Reports. “Your Car Is Sharing Data With Big Tech Companies, Study Finds.” September 29, 2026. https://www.consumerreports.org/electronics/personal-information/your-car-is-sharing-data-with-big-tech-companies-study-finds-a4474820962/

ACM SIGCOMM Internet Measurement Conference 2026. “Accepted Papers: Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem.” October 2026. https://conferences.sigcomm.org/imc/2026/accepted-papers/

Office of the California Attorney General. “General Motors to Pay $12.75M to Settle California Consumer Protection Lawsuit Alleging Data Privacy Violations.” May 8, 2026. https://da.lacounty.gov/media/news/general-motors-pay-1275m-settle-california-consumer-protection-lawsuit-alleging-data

Office of U.S. Senator Ron Wyden. “Wyden, Markey Investigation Reveals Automakers Sold Americans’ Location and Driving Data to Brokers for Pennies.” July 26, 2024. https://www.wyden.senate.gov/imo/media/doc/wyden-markey_auto_privacy_letter_to_ftc.pdf

Federal Trade Commission. “FTC Consent Order In the Matter of General Motors LLC Regarding Connected Vehicle Data and Telematics Monitoring.” January 19, 2026. https://captaincompliance.com/news/ftc-finalizes-settlement-with-gm-over-unauthorized-driver-data-sales-as-texas-ag-targets-connected-car-privacy-violations/

Office of the Texas Attorney General. “Attorney General Ken Paxton Sues General Motors for Unlawfully Collecting and Selling Drivers’ Private Data.” August 14, 2024. https://www.legaldive.com/news/texas-sues-gm-for-selling-customer-driving-data/724280/

Works cited

19 of 21 Connected Cars Sent Data to Third Parties: Study – Gblock,

Study of Data Privacy in the Connected Cars Shows OEM Apps,

Your Car Is Sharing Your Data With Google and Meta. Opting Out,

How Cars Became The Worst Product Category For Privacy – Session,

If you thought your phone was spying on you, wait until … – Facebook,

Your car’s data privacy problems are worse than you think / A team,

4 ways ‘cars are the worst’ for privacy – WardsAuto,

GM Got Caught Selling Its Driver’s Data to Insurance Companies,

Is Your Car Selling Your Driving Data to Insurers? (2026),

Publications – Christo Wilson,

最新の車21台をテストした結果ほぼすべての車両が第三 … – UQライフ,

Bilarnas datainsamling oroar forskare i ny studie – Vi Bilägare,

Your car’s data privacy problems are worse than you think / A team,

Attorney General sues GM for collecting, selling your driving data,

Kashmir Hill – Wikipedia,

Tests of 21 of the latest cars revealed that almost all of them were sending data to third-party domains, and more than half were sending messages to advertising companies.,

How car data sales affect US insurance premiums – Facebook,

From “Paper Compliance” To “Technical Verification”: The $12.75M,

Automakers Sold Drivers’ Data for Shockingly Low Amounts of Money,

Senators urge FTC to investigate carmakers selling drivers’ location,

Wyden-Markey Auto Privacy Letter to FTC,

July | 2024 | The Overspill: when there’s more that I want to say,

Automakers Are Still Selling Customer Data – MediaPost,

FTC Finalizes Settlement with GM Over Unauthorized Driver Data,

Data Sold to Auto Insurers Without Drivers’ Knowledge or Consent,

GM $12.75M CCPA Settlement: Impact on US Privacy Enforcement,

General Motors to Pay $12.75M to Settle California Consumer,

Texas sues GM for selling customer driving data | Legal Dive,

GM is selling driver data to insurers without consumers … – CBS News,

Mozilla study reveals that “modern cars are a privacy nightmare”,

Mozilla: Here’s Why Your Connected Car’s Privacy Sucks – PCMag,

Your Car Is Sharing Data With Big Tech : r/Rivian – Reddit,

Texas probes four more car companies over how they collect and,

Congressional Leaders Cross The Aisle In Support Of Data Privacy,

Subscribe to Our Newsletter

Stay updated with the latest stories and articles.

Please enable JavaScript in your browser to complete this form.

Name Email

Name *

First

Last

Email *

By subscribing you agree to receive email updates from The Voice of Human. We use your details only for this newsletter and you can unsubscribe at any time. See our Privacy Policy.

Submit