A Northeastern University and Consumer Reports study found extensive data sharing by connected cars and their companion apps, raising concerns about what owners know and can control. The findings add evidence to a debate already sharpened by US penalties against automakers for collecting or sharing driving data without adequate consent.

Researchers examined 21 cars from 19 brands sold in the US, plus 30 linked mobile apps. All 21 cars sent data over Wi-Fi to at least one third-party domain, and more than half contacted advertising, tracking or analytics companies; cars with Google’s Android Automotive platform reached the most third-party domains. Seven apps—including HondaLink, Lincoln and several GM apps—sent sensitive information such as VINs, phone numbers and precise locations to advertising networks.