Connected cars remain a privacy nightmare, according to a new study by researchers at Northeastern University and Consumer Reports. Testing 21 cars from 19 brands revealed traffic to advertisers and trackers, as well as data shared with Big Tech firms like Microsoft and Adobe. Using a car's companion app can multiply the problem.

The 2023 Mozilla Foundation report called cars "the worst product category we have ever reviewed for privacy," but that was based on reading privacy policies. This study measured actual traffic from cars in scenarios like idling and driving. Researchers even parked 11 electric cars in a Faraday tent to test Wi-Fi fallback, but modified certificates failed to decrypt data.

Despite that, network traces yielded valuable info via DNS traffic and TLS handshakes. All cars contacted first-party domains, but some, like the Buick Envista and Mercedes-Benz EQS, went no further. Others were more promiscuous, with Tesla topping the chart: The Model 3 contacted 34 advertising, tracking, and analytic domains, plus 37 from integrated apps. Alphabet's domains were most frequently contacted, including doubleclick.net and googlesyndication.com for advertising.

Media streaming services like Spotify and Sirius XM were well represented, as were mapping companies such as HERE, Tom Tom, and Mapbox.