Tesla Reached Most Tracking-Related Domains; 19 of 21 Cars Contacted Outsiders

Nineteen of 21 connected cars contacted at least one third party during a network-traffic study, and the two tested Tesla vehicles reached the most domains associated with advertising, tracking or analytics. The Consumer Reports and Northeastern University investigation also found that seven of 30 automaker companion apps transmitted identifiers such as vehicle identification numbers, email addresses, phone numbers or precise locations to third parties associated with those functions.

The numbers expose two related but technically distinct data paths. A connected vehicle can communicate through its cellular modem or Wi-Fi connection, while its companion app operates through the owner’s phone. Telematics services, embedded browsers, navigation tools and integrated entertainment platforms can each add companies and infrastructure beyond the automaker to that chain.

Researchers examined 21 vehicles representing 21 brands and 30 companion apps between October 2024 and August 2025. They scanned Wi-Fi and cellular traffic, inspected infotainment systems and used Faraday tents to isolate communications. More than half of the vehicles reached at least one domain the researchers classified as advertising, tracking or analytics.

Tesla led the measured domain count

The tested Tesla Model 3 contacted 34 unique advertising, tracking or analytics domains, while the Cybertruck contacted 23. The Cadillac Lyriq reached 10, Lucid reached nine and the Chevrolet Blazer reached seven. At the other end of the measured range, the Nissan Ariya, Land Rover Range Rover, Mercedes EQS and Buick Envista contacted no domains in that category.

Those counts describe particular vehicles under the study’s conditions. They do not establish that every model from a brand behaves identically, nor does contact with a domain prove that the recipient obtained personal information. Much of the traffic leaving the vehicles was encrypted, allowing researchers to identify its destination without necessarily seeing the transmitted payload.

The companion apps provided a clearer view because the researchers controlled the test phones and could inspect their communications. Seven apps sent one or more identifiers including VINs, contact information or precise location to third parties associated with advertising, tracking or analytics. A VIN is especially consequential when combined with another stable identifier because it can connect an online interaction to a specific vehicle and potentially to its owner.

That distinction matters when evaluating the privacy risk. A domain lookup shows the breadth of the connected ecosystem, but the app analysis supplies the more direct evidence that potentially identifying information crossed an organizational boundary. Neither finding, by itself, establishes unlawful tracking or proves that every recipient independently used or sold the information.

Contracts do not give owners much visibility

Researchers disclosed their findings to 17 of the 18 automakers they contacted, and 14 responded. According to the study’s whitepaper, the responding companies said the observed connections were in line with the contracts they have with their third party service providers. Those contracts, automakers said, restricted how personally identifiable information could be used.

Five automakers attributed some connections to browsers embedded in infotainment systems. Seven pointed to the terms governing integrated services, such as streaming platforms or an operating system supplied by another company. These explanations illustrate a systems-integration problem: even if an automaker controls its own servers, an embedded webpage, analytics package or contracted digital service can create another route for vehicle or user data.

Contractual restrictions can constrain a service provider, but owners generally cannot observe those restrictions from the dashboard. They may see a single consent screen even though the resulting service depends on multiple companies, privacy policies and data flows. The study therefore measured a transparency gap as much as a traffic count.

Honda changed its handling after researchers challenged its classification of the VIN as a commercial item used for marketing. The company requested that vendor Amplitude delete location information it had received and updated its app to stop sending geolocation data to that company. Honda said the information had not been available for independent use or sale because its contract prohibited those activities.

Opting out may carry a functional cost

Connected services can support navigation, communication, remote controls and software-dependent features, which complicates the apparent choice between sharing data and disconnecting. Researchers criticized warnings from Tesla and Rivian that turning off telematics connectivity or data sharing could degrade vehicle functionality. Tesla’s warning said declining its data-sharing agreement could result in reduced functionality, serious damage or inoperability.

That does not show that all connected functions require advertising- or analytics-related communication. It does show why consent in a vehicle is different from rejecting an optional website cookie: the owner has already purchased an expensive machine whose features may depend on continuing network access.

The researchers are scheduled to present their paper at the ACM Internet Measurement Conference in Karlsruhe, Germany, running October 12-16, 2026. The next engineering-policy question is whether automakers can separate essential vehicle communications from optional analytics clearly enough that owners can decline the latter without sacrificing core functions.

By Thomas Caldwell — AMI’s senior editor for mechanical and mobility engineering, covering vehicle electronics, systems integration, electrification, chassis systems, propulsion, and safety policy.