Your new car is talking to strangers. Researchers at Northeastern University, working with the non-profit Consumer Reports, tested 21 late-model cars from 19 brands and the 30 apps that pair with them. 19 of the 21 cars contacted at least one outside company over Wi-Fi during the tests, among them advertising and tracking companies.
They could not read what most of those cars were sending, because the traffic was encrypted. What they could read was the companion apps, and that is where the picture sharpened.
What the apps shared
7 of the 30 apps passed sensitive identifiers to advertising and analytics companies: a Vehicle Identification Number, an email address, a phone number or a precise location. Several apps sent a VIN alongside other personal details. The recipients named in the research included Adobe, the data broker Acxiom and the analytics firm ContentSquare.
"We have these companies that have nothing to do with car functionality that are getting information about you, what car you have, and sometimes also your GPS location," said David Choffnes, the Northeastern professor who led the work, as reported by TechCrunch.
The single most useful finding for a buyer is this: the researchers found that pairing a car's companion app, the one that unlocks remote start or shows your battery level, roughly doubled its exposure to advertising and tracking companies on average. The car reaches some outside servers on its own; pairing its app roughly doubled that.
Why this reaches Malaysia
Malaysia just set a registration record. The country registered 74,259 new cars in September 2026, the most of any September since the public record began in 2000, going by JPJ figures published on data.gov.my and our own reading of them. The study did not test a single Malaysian-market unit, a limit we come back to below.
That gap matters, so we will not paper over it. The study was run on cars and apps sold in the United States. We do not know which of those exact models and app versions reach Malaysian showrooms, and consent screens, data routes and the companies on the receiving end can all differ from one country to the next.
What does not change is that this is personal information, and Malaysia has a law about personal information. The Personal Data Protection Act governs how companies may handle personal data in a commercial transaction. Whether, and how, it reaches the data a connected car and its app collect is exactly the kind of question it exists to answer.
A modern car is a software product its maker keeps changing from afar, as we reported when Tesla dropped the Full Self-Driving label in Europe. What you agreed to on delivery day may not be what governs the car a year later.
What an owner can actually do
The uncomfortable finding is how little say an owner has. The researchers concluded that owners lack meaningful choices without giving up the connected features, or in some cases the use of the car itself. The one clear lever is simple: much of the tracking the study measured was tied to the companion apps, so leaving the app uninstalled avoids that part of it. Short of that, read the privacy screen before you tap agree, rather than after.
Here is the honest limit of what we know. We have found no equivalent test on a Malaysian-market car, on the Malaysian build of these apps, against Malaysian law. Until someone runs one, the exposure for a driver here is unmeasured. What is measured sits in the registration data: 74,259 new cars in a single month.
Image(s) courtesy of Benjamin Zhao on Unsplash. Chart by ProductNation.
