Your car is a tracker you paid for.
Northeastern University × Consumer Reports measured exactly what 21 connected cars quietly ship out of your driveway. We read all of it — because every leak in this report is the argument for the opposite kind of AI: one that runs on your device and answers to you, not the ad market.
Read this as what it actually is — not a car story, but the clearest receipt yet for a broken bargain. The surveillance model is paid for with your data: your car leaks because someone downstream profits from the leak. AuraVision is the opposite bet — privacy-first AI that runs on your device and never phones home, on a network powered by $PSI instead of your secrets. Everything below is why that bet has to exist. The cars are just the proof.
01What they actually measured
This is not a survey or a privacy-policy reading. Researchers put real cars and their apps on a monitored network and watched the packets — every domain each vehicle and app reached out to, and what it sent. 21 cars across 19 brands, 30 companion apps, independent and peer-reviewed (IMC ’26). When we say “your car phones trackers,” it is measured traffic, not a hunch.
02What leaves your car
Bundled together, keyed to you, and sent to the ad-tech and data-broker ecosystem — not just the manufacturer:
- PRECISE LOCATION. Real-time GPS and trip history. Where you live, work, worship, and drop your kids.
- VIN & IDENTITY. The vehicle’s unique ID, tied to your name, email, and phone number.
- YOUR CONTACTS. Phone books synced over Bluetooth — pulling in people who never opted into anything.
- DRIVING BEHAVIOR. Speed, braking, hours — the exact signal insurers and brokers pay for.
03The app is the multiplier
The “convenient” companion app is where it gets worse. 7 of 30 apps shipped sensitive identifiers straight to third parties, and installing one roughly doubled how much a given vehicle was tracked. The feature you downloaded to unlock your car remotely is also the one broadcasting where that car has been.
04“Consent” is theater
The deepest problem is not any single data point — it is that what is disclosed and what is done do not match. The agreement is a 50-page dialog you cannot meaningfully refuse without losing the car you bought. Once the data is out, it is gone.
“Consumers have no control over their data once it has left their device.”
Northeastern University × Consumer Reports · IMC ’26
05It is fixable — most brands just don’t
One bright spot: Honda was singled out for improving — cutting precise-geolocation sharing with trackers. That is the tell. The technology is not the blocker; the incentive is. Collecting and brokering your data is a revenue line, so most brands collect. It is a choice.
That is the whole reason AuraVision runs on the device. Intelligence that hears you, helps you, and keeps every word in the room. Nothing uploaded. Nothing brokered. Nothing to breach. On-device is not a feature — it is the premise, and $PSI is the economy that makes it pay without ever touching your data.
With Aura, you never have to.