Connected Cars Contact Dozens of Advertising and Analytics Domains

What changed

Researchers from Northeastern University and Consumer Reports measured network traffic from 21 cars across 19 brands, along with 30 companion apps. Every car contacted its automaker, while some reached dozens of advertising, analytics and integrated-app domains. Tesla’s Model 3 contacted 34 advertising, tracking and analytics domains plus 37 domains tied to infotainment apps.

Why it matters

This is a measurement problem, not just a privacy-policy problem. The researchers watched what cars and apps actually contacted while vehicles sat idle, drove, used infotainment systems or switched between cellular and Wi-Fi connections.

The biggest exposure often came through the software around the car. Some companion apps connected users to more than 20 additional advertising, tracking and analytics companies. General Motors, Toyota and Nissan produced the broadest app traffic in the testing.

The results also show why “connected car” is an incomplete description. A car may be physically parked, yet its infotainment system can still create a busy trail of digital connections. Tesla’s Model 3 was the clearest example in the study. The Cybertruck behaved differently, contacting 26 more third-party domains while driving than while stationary.

The researchers could identify domains, timing and transmission volume, but could not see the contents of the encrypted packets. That means the study maps who the cars and apps contacted without establishing exactly what information each connection carried.

The practical lesson is blunt: buying a car increasingly means buying a network of software relationships. The automaker is only the first destination. I’d expect scrutiny to shift from dense privacy notices to a simpler question: which connections are genuinely needed to make the car work, and which exist because advertising and analytics have found another screen.