A team at Northeastern University has looked into how connected cars manage data, and their recent research, produced in partnership with Consumer Reports, shows that vehicles often share personal information with manufacturers and outside firms without drivers being aware of it. Once the data moves off a device, people no longer hold any power over it.
This research is titled “Car is a Smartphone on Wheels. Here’s Who’s Listening.”, and it stands as the first large-scale examination of how vehicles connect to each other and to outside systems. Its central message is a cautionary one: the very features that make cars more intelligent expose them to risk.
What a Connected Car Is
A connected car has built-in internet access — Wi-Fi, cellular, GPS — that lets it communicate constantly with its manufacturer and outside companies. Over 75% of vehicles sold globally have this connectivity built-in.
Every new vehicle rolling off the production line today is essentially a small computer with wheels, gathering information on your driving habits, your whereabouts, and your personal tastes, then shipping that data to some destination.
To study the privacy risks of connected cars, the team examined 21 recent models alongside 30 related smartphone applications. Their work was made possible through a partnership with Consumer Reports, which provided access to its own purchased fleet of test vehicles.
The paper has undergone peer review and will appear at IMC ’26, where it will be presented by a team of researchers from Northeastern University who specialize in privacy, security, and networking systems.
How the Data Flows
The investigators pinpointed two places within the ecosystem from which they could observe the data that connected vehicles transmit to both manufacturers and outside parties: inside the vehicles themselves and through the apps offered by manufacturers.
A Raspberry Pi was fitted with a custom access point (AP), and tcpdump was employed to record every packet sent or received through it. That arrangement let observers track all destinations to which vehicle data was directed, even though the contents of those packets remained hidden behind encryption.
To test whether blocking a vehicle’s ability to communicate over its cellular network would force more Wi-Fi communication, they drove the vehicles into a Faraday tent that blocked their cellular signal entirely. Inside the tent, they repeated both the Stationary Idle and Active tests to see whether traffic that normally goes out over cellular rerouted to Wi-Fi instead.
What They Found
A team of investigators captured information passing between a vehicle and its companion app. Each device transmits data, which includes personal consumer details, to distinct first and third-party servers via both Wi-Fi and cellular connections. In the paper’s illustrations, solid lines show the flows that were actually seized during the experiments.
It falls to the companies that take in the consumer information to decide what to do with it after it arrives at their servers. In many instances, this involves handing the data over to undisclosed third parties, or selling it outright.
Once data leaves a device, consumers lose any authority they might have had over it.
The Scope of the Study
From October 2024 to August 2025, the researchers conducted their study, looking at 21 vehicles from the U.S. market in a controlled setting alongside 30 companion mobile apps that were equipped with instrumentation inside on-site vehicles.
Not every manufacturer in the U.S. market was covered by the researchers. Just as with any empirical study, their findings represent a single point in time, and they do not necessarily apply to vehicles outside their sample or beyond the U.S.
What This Means for Drivers
The central discovery is straightforward: vehicles that connect to the internet through their own equipment do not offer the privacy people assume. Every time someone drives a car with built-in internet, they place their trust in the company behind it. That trust is one-sided.
Once data leaves a device, consumers lose all control over it, according to the researchers.
The researchers say there is no simple solution. They are asking for ongoing measurement and close examination of the connected vehicle system.
The Bigger Picture
This research sits within a larger field of work focused on connected vehicles, an area that remains in its early stages even as the stakes keep rising. Modern automobiles are essentially rolling computers, each one carrying data as it travels.
A group of scientists from Northeastern University, who study privacy, security, and computer-network systems, carry forward earlier work on the dangers posed by connected vehicles.
This document represents a current assessment of the situation. It functions as an appeal for further examination rather than a final decision. The authors are requesting increased scrutiny, greater measurement, and enhanced transparency.
Key Facts Box
- Study: First large-scale measurement study of the connected-vehicle ecosystem
- Partnership: With Consumer Reports
- Test vehicles: 21 late-model vehicles
- Companion apps: 30 instrumented apps
- Data flow: Wi-Fi and cellular service
- Disclosure: Went through a lengthy disclosure process with manufacturers
- Publication: Peer-reviewed, to appear at IMC ’26
- Scope: U.S. market, October 2024–August 2025
- Manufacturer coverage: Did not cover every U.S. manufacturer
Schedule Table
| Phase | Period |
|---|---|
| Vehicle testing | October 2024–August 2025 |
| App testing | October 2024–August 2025 |
| Publication | IMC ’26 |
What We Make of It
Scientists measured, recorded, and reported what they found, and they did so without raising alarms.
The outcome is troubling. Vehicles that connect to the internet gather information continually, and that information moves to locations consumers cannot see. Those who receive it can pass it on to other parties without informing anyone.
The authors admit their discomfort with this account. They discovered a flaw, recorded it diligently, and made it public. Their request is simple: they want clearer insight into how these vehicles handle our personal information.
We hold the data, and we ought to be aware of where it ends up.
Source material: “Car is a smartphone on wheels. Here's who's listening,” northeastern.edu.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.