The Tesla Model 3 connected to 34 tracking domains. The study involved 21 cars.
Researchers from Northeastern University and Consumer Reports tested 21 cars from various brands as well as 30 manufacturer apps. Tests conducted from October 2024 to August 2025 showed that 19 vehicles connected to the internet with at least one external company.
Tesla performed worst. The Model 3 connected to 34 advertising, tracking, or analytics domains, while the Cybertruck connected to 23.
Tesla, Cadillac, and Lucid top the list
The researchers analyzed Wi-Fi and cellular data transmission, checked infotainment systems, and even placed the cars inside large Faraday cages. The goal was to determine with whom a vehicle communicates outside its manufacturer’s servers.
The Tesla Model 3 connected to 34 unique ATA domains, while the Cybertruck connected to 23. This is particularly concerning given recent questions from owners about why American Teslas were sending data to China.
Following behind were the Cadillac Lyriq with 10 domains, Lucid with 9, and Chevrolet Blazer with 7. The Nissan Ariya, Range Rover, Mercedes EQS, and Buick Envista did not connect to any ATA domains. It is therefore possible to build a modern, constantly connected car without all the accompanying advertising tracking.
The problem wasn’t limited to cars alone. Seven of the 30 mobile apps shared data such as VIN, email address, phone number, or the user’s exact location with external parties affiliated with ATA.
Manufacturers cite contracts and terms of service
The researchers contacted 17 out of the 18 manufacturers subject to further analysis. Fourteen responded. The companies claimed that the data sharing was “in line with contracts signed with external service providers,” and that the agreements prohibited using personal data beyond what was agreed upon.
Honda treated the VIN as trade information that could be used for marketing purposes. After intervention by the researchers, the manufacturer agreed to change its classification.
Five companies blamed web browsers built into multimedia systems. Another seven believed users should read the terms of services for platforms like Spotify or Google’s operating system on their own. However, a car buyer is unlikely to expect a terms-of-service document as lengthy as those for a phone subscription.
Tesla and Rivian also warn that disabling telematics or data sharing may limit the car’s functions. Telematics is needed for remote vehicle control, diagnostics, and app functionality, but forcing consent by compromising the car’s performance hardly seems like a voluntary choice.
In a software-defined vehicle, a “no” button should not disable parts of the product for which we have already paid. Would you agree to limiting Tesla or Rivian’s features in order to prevent the manufacturer from accessing telemetric data?
Order your Tesla and enjoy purchase bonuses using the referral link!
LovEV Newsletter
Want more content like this?
Sign up — we’ll send you a weekly roundup once the newsletter starts.
