Modern vehicles come with features such as advanced safety systems, smartphone integration, navigation, and customizable driving settings. However, these conveniences may come at the expense of personal privacy. Researchers have raised concerns about how automakers collect, store, and share data generated by drivers and their vehicles.
A widely discussed automotive privacy investigation by the Mozilla Foundation found serious privacy problems across 25 major car brands, reporting that all failed its privacy review. This article examines 21 popular car models, the information their vehicles may collect, how that information is gathered, and what drivers can do to protect their privacy.
What Researchers Discovered About Car Privacy
Modern vehicles are no longer simply machines that transport people from one place to another. Many now contain internet-connected computers, GPS receivers, cameras, microphones, wireless communication systems, and smartphone integration. These technologies help drivers navigate traffic, monitor vehicle performance, receive maintenance alerts, and control certain functions remotely.
However, they can also create extensive records about vehicle use and driver behaviour. Researchers studying automotive privacy have repeatedly warned that consumers may not fully understand how much information their vehicles generate or which organisations can access it. The privacy debate is therefore not just about technology collecting data, but also about transparency, consent, and the limits placed on its use.
A widely reported automotive privacy study by the Mozilla Foundation, published in 2023, examined the privacy policies of 25 major car brands. Its researchers concluded that all 25 failed the organisation’s privacy review. The investigation raised concerns about personal information, location tracking, sensitive data, and the possibility of sharing information with outside organisations.
This finding became a prominent warning for car buyers because connected features are now common across budget vehicles, family SUVs, luxury sedans, and electric cars.
However, Mozilla’s investigation assessed privacy policies and practices rather than conducting a single technical experiment on 21 vehicles. Its results should not be confused with the separate vehicle network study discussed below.
A later investigation reported by Consumer Reports examined 21 vehicles and 30 companion smartphone applications, looking at network connections made by cars and their associated apps. The researchers examined traffic under different conditions, including when vehicles were stationary and when they were being driven.
They also investigated connections to advertising, tracking, analytics, and other outside services. The results illustrated how vehicles and their applications can communicate with multiple organisations rather than sending every request exclusively to the manufacturer.
This technical approach offered a different perspective from reading privacy policies because it observed network activity directly. Nevertheless, the findings reflected a limited sample of vehicles and software configurations rather than every car sold worldwide.
The study reported that 19 of the 21 tested vehicles contacted at least one third party over Wi-Fi. In the associated application testing, 28 of the 30 apps contacted at least one advertising or analytics company, while seven transmitted personally identifiable information to an outside company. Such information can include a vehicle identification number, a name, or precise location information.
Researchers also recorded different levels of advertising and analytics activity among the tested cars. The Tesla Model 3, for example, contacted 34 advertising, tracking, and analytics domains in the reported test, while the Tesla Cybertruck contacted 23.
These figures represent observed network destinations, not the number of individuals tracked or a direct measurement of the amount of personal data disclosed.
It is important to understand what these findings do and do not establish. A connection to an outside domain does not automatically mean that a company received a driver’s name, sold personal information, or monitored every journey. Some connections may support essential software functions, while others may relate to analytics or advertising.
Similarly, a vehicle with fewer advertising-related connections may still gather extensive data for its manufacturer or service providers. This highlights a wider concern about consumer privacy and the need for automakers to clearly explain what information their vehicles collect, why it is collected, and with whom it is shared.
A meaningful privacy assessment must consider the full data flow, not just a single number or a manufacturer’s reputation.
The 21 Cars Tested and Their Data Collection Practices
1. Tesla Model 3
The Tesla Model 3 recorded 34 advertising, tracking, and analytics domains in the reported Wi-Fi test, the highest figure in that comparison. Tesla vehicles use connected software for functions such as navigation, remote monitoring, software updates, and vehicle management through a companion app.
These features can generate operational records and require communications with remote systems. The study’s domain count raises questions about the number of outside services contacted during the test, but it does not prove that all those destinations received identifiable personal information.
Drivers should examine the available privacy controls, connected-service terms, and account settings before deciding which features to activate.
2. Tesla Cybertruck
The Tesla Cybertruck contacted 23 advertising, tracking, and analytics domains in the same reported comparison. Its digital systems support vehicle monitoring, software-based features, and connectivity with Tesla’s online services. These capabilities can make ownership more convenient, but they also create potential pathways for data transmission.
The research does not establish that every connected service shared sensitive information or that all Cybertruck owners experience identical data flows.
Privacy settings, software versions, and account configurations can influence the information available to different services. Owners should regularly review their settings and pay attention to changes introduced through software updates.
3. Cadillac Lyriq
The Cadillac Lyriq recorded 10 advertising, tracking, and analytics domains. Its connected infotainment system and myCadillac application provide digital vehicle services, including remote functions and account-based features.
Researchers also identified myCadillac among the applications that transmitted vehicle identification information alongside other identifying details. A vehicle identification number, or VIN, is a unique identifier that can become more revealing when combined with a person’s name, email address, or location.
The findings illustrate why buyers should evaluate the privacy of both the vehicle and its companion app. They do not establish that every Cadillac owner has the same information transmitted under every operating condition.
4. Lucid Air
The Lucid Air contacted nine advertising, tracking, and analytics domains in the test. Its connected vehicle systems support digital functions that may involve online accounts, remote monitoring, diagnostics, and software services.
The observed connections placed it among the vehicles with relatively high activity in the advertising and analytics category. However, domain counts cannot independently establish what information was transmitted or whether any particular company used it for advertising.
Owners should check Lucid’s current privacy documentation, understand which connected features are enabled, and review permissions granted to the associated mobile application. These steps help drivers make informed choices without assuming that a particular count proves either good or poor privacy across every aspect of the vehicle.
5. Chevrolet Blazer
The Chevrolet Blazer recorded seven advertising, tracking, and analytics domains. Its connected systems and myChevrolet app can support remote access, vehicle management, and account-based functions. The app was among those identified in the investigation as transmitting identifying vehicle information with other details.
This matters because information from a phone application can sometimes be linked to an individual more easily than an isolated technical record from a vehicle. Drivers should review app permissions, account settings, and marketing preferences.
The study does not prove that every Chevrolet Blazer sent the same information or that every connection was advertising-related in purpose, but it highlights the importance of understanding app-based data collection.
6. Honda Prologue
The Honda Prologue recorded five advertising, tracking, and analytics domains. Its connected features can involve online services, remote vehicle functions, diagnostics, and account access.
Researchers also examined HondaLink, a companion application, and reported that precise location information had reached the analytics company Amplitude. According to Consumer Reports, Honda instructed the vendor to delete the location information and stopped sending it.
This case illustrates how technical testing can reveal data flows that may not be obvious to consumers reading an app description. It also demonstrates that companies can respond when researchers identify a concern. The finding should not be interpreted as proof that every Honda model or every version of HondaLink handles location data identically.
7. Volvo C40
The Volvo C40 contacted three advertising, tracking, and analytics domains in the reported comparison. Its connected systems can support navigation, diagnostics, remote functions, and account-based services. A lower number of advertising-related destinations does not establish that a vehicle collects no personal information.
The manufacturer may still process vehicle performance data, service records, or location information when specific features require it. Buyers should review the privacy policy for the exact model year and market, paying attention to location permissions and connected applications. Software updates and changes to service providers can also affect how a vehicle communicates with outside systems over time.
8. Rivian R1S
The Rivian R1S contacted two advertising, tracking, and analytics domains. As a connected electric vehicle, it can rely on online systems for remote access, software updates, charging-related services, and vehicle monitoring. These functions may require diagnostic records and account information to be transmitted to remote infrastructure.
Its relatively low advertising-domain count is useful for comparison, but it is not a complete privacy score. Drivers should examine Rivian’s data policy, check which connected services are enabled, and understand the permissions granted to its application.
A full assessment must distinguish between necessary vehicle operations, optional analytics, and advertising-related activities rather than treating all data collection as identical.
9. Ford F-150
The tested Ford F-150 recorded one advertising, tracking, and analytics domain. Ford vehicles can offer connected services through their onboard systems and companion applications. The investigation also identified the Lincoln app, associated with Ford’s luxury vehicle brand, among the applications transmitting identifying information to an outside company.
That app finding does not prove that the tested F-150 itself transmitted the same information. It highlights the importance of keeping model-specific and application-specific results separate.
F-150 owners should check their Ford account, review the privacy settings for their particular vehicle, and determine whether remote access or location features can be limited without affecting essential functions.
10. Ford Mustang
The tested Ford Mustang also recorded one advertising, tracking, and analytics domain. Connected vehicle services can provide navigation, diagnostics, account access, and software-based features, depending on the model and configuration.
The low count suggests that fewer advertising-related destinations were observed during this particular test than in several other vehicles. It does not establish that Ford retains no operational data or that every Mustang has identical privacy arrangements.
Buyers should review the policy associated with their exact model year and connected-service package. They should also distinguish the information required to provide a requested service from data used for optional analytics or marketing.
11. Toyota Corolla Cross
The tested Toyota Corolla Cross recorded one advertising, tracking, and analytics domain. Toyota’s connected services can support vehicle diagnostics, remote features, navigation, and account-based functions. Mozilla’s separate 2023 review raised concerns about the complexity of Toyota’s privacy documentation, identifying multiple policy documents in the materials it examined.
That earlier assessment focused on privacy policies and was methodologically different from the later network test. The two results should not be combined into a single privacy rating. Corolla Cross buyers should review the policy that applies to their market, determine which connected services they need, and examine the available controls for location information and optional data sharing.
12. RAM 1500 Big Horn
The tested RAM 1500 Big Horn recorded zero advertising, tracking, and analytics domains, alongside six domains in a separate integrated third-party category. This distinction is important because a vehicle can communicate with external service providers without those connections being classified as advertising or analytics.
Navigation, software platforms, account verification, and cloud services can require external communications for ordinary operation. The zero advertising-related count therefore does not mean that the truck never sends information outside its own systems.
Buyers should check the privacy policy for the particular model year, review connected-service permissions, and ask which data transfers are optional. Results may also change when software or service configurations change.
13. Fiat 500e
The tested Fiat 500e recorded zero advertising, tracking, and analytics domains and six integrated third-party domains. Electric vehicles can generate information about battery condition, charging activity, diagnostics, and vehicle performance.
Manufacturers may process some of these records to support maintenance, improve reliability, and provide connected services. The test result indicates limited observed activity in one category, not an absence of information collection.
Fiat owners should review the privacy documentation relevant to their country and identify which online features require an account or access to location information. They should also ask how long records are retained and whether optional data sharing can be disabled.
14. Dodge Hornet
The Dodge Hornet recorded zero advertising, tracking, and analytics domains and six integrated third-party domains. Its connected features may depend on external systems for navigation, remote services, account access, and software functions.
These connections illustrate why a single advertising-domain figure cannot explain the entire privacy profile of a vehicle. Drivers should examine the purposes of individual services and determine whether information is shared for functionality, diagnostics, or optional commercial uses.
They should also review the current privacy notice rather than relying on the findings from a single test. The results do not prove that every Dodge Hornet configuration has identical network activity or data retention practices.
15. Subaru Solterra
The tested Subaru Solterra recorded zero advertising, tracking, and analytics domains and six integrated third-party domains. Its connected systems can support online services and remote vehicle functions, depending on the model configuration and services enabled.
Mozilla’s separate privacy review raised concerns about consent language in Subaru’s privacy materials. That finding related to the organisation’s policy analysis, not proof that the tested Solterra transmitted sensitive information during the later network experiment.
Drivers should check current privacy terms and understand how connected systems may process information about the vehicle and its occupants. They should also consider whether passengers know which connected functions are active.
16. Lexus NX 450h
The Lexus NX 450h recorded zero advertising, tracking, and analytics domains and five integrated third-party domains. Lexus vehicles may support navigation, remote monitoring, diagnostics, and connected account features, depending on their configuration.
Although Lexus belongs to Toyota’s vehicle group, available features and privacy practices can differ between models and markets. The low advertising count does not prove that the vehicle collects no location or operational information.
Prospective buyers should examine the privacy documentation for their specific vehicle and determine whether optional data collection can be disabled. They should also check whether connected functions continue to operate when particular permissions are restricted.
17. Fisker Ocean
The tested Fisker Ocean recorded zero advertising, tracking, and analytics domains and four integrated third-party domains. Its connected architecture could support remote services, diagnostics, and software-based features. However, a low count in one category cannot guarantee complete privacy or cybersecurity.
For used-car buyers, the status of connected services and software support is also important because changes to online infrastructure can affect how a vehicle functions. Prospective owners should verify the current availability of vehicle services and examine any accessible privacy documentation.
The test was not a comprehensive security audit and does not guarantee that later software versions or different operating conditions would produce the same network activity.
18. Nissan Ariya
The Nissan Ariya recorded zero advertising, tracking, and analytics domains and three integrated third-party domains. Nissan’s connected services may support remote functions, diagnostics, account access, and navigation. Mozilla’s 2023 privacy review separately raised concerns about sensitive information described in Nissan’s privacy policy, including health and genetic data.
That policy assessment does not establish that the tested Ariya transmitted such information during the network experiment. It does demonstrate why written disclosures and technical network testing provide different kinds of evidence.
Buyers should examine the current policy for their region and clarify what information is collected, how it is obtained, and whether any particular feature requires additional consent.
19. Land Rover Range Rover Sport
The tested Range Rover Sport recorded zero advertising, tracking, and analytics domains and two integrated third-party domains. Its connected features may involve navigation, remote monitoring, account services, and vehicle diagnostics.
A low number of observed advertising connections can be encouraging, but it cannot independently establish that the manufacturer retains little information or that all third-party processing is absent.
Buyers should review the privacy policy applicable to their vehicle and ask which services transmit location or operational records. It is also important to consider software updates because network activity may change after the original test was performed.
20. Mercedes-Benz EQS
The tested Mercedes-Benz EQS recorded zero advertising, tracking, and analytics domains and one integrated third-party domain. This placed it among the vehicles with the lowest observed counts in those categories. Its connected services can still process information needed for navigation, remote access, diagnostics, and account-based functions.
Mozilla’s earlier privacy investigation separately assessed Mercedes-Benz’s privacy and security disclosures, including questions concerning encryption.
Those findings addressed different issues and should not be treated as a single measurement. Buyers should review current privacy terms, determine which digital features are active, and ask how personal information is protected and retained.
21. Buick Envista
The tested Buick Envista recorded zero advertising, tracking, and analytics domains and one integrated third-party domain. The result placed it among the lowest-count vehicles in the comparison for these particular categories.
Its connected services and myBuick application can still involve account information, remote vehicle functions, and service-related communications.
A low count does not prove that every Buick Envista is free from tracking or that its mobile application shares no information. Owners should review the privacy settings for both the vehicle and the app, since their data flows can differ. The findings also reflect the specific model and software configuration examined during the research.
