A study by Northeastern University researchers and Consumer Reports found that connected cars routinely contact advertising, tracking and analytics services, with some also sharing traffic with major technology firms. The findings matter because they show what cars actually connect to in practice, beyond what can be inferred from reading manufacturers’ privacy policies.

The team monitored 21 cars from 19 brands in different situations and examined 30 companion apps. Tesla’s Model 3 contacted 34 advertising, tracking and analytics domains, plus 37 domains linked to integrated apps; some car apps exposed users to more than 20 additional companies. Infotainment use generally led to the most domain contacts, while some electric cars switched to Wi-Fi when cellular signals were blocked. Automakers that replied said contracts restricted third parties’ use of personal information, but the researchers could not inspect the encrypted data itself.