Today’s cars and motorcycles increasingly collect more data and are more connected. Applications to consult information, locate the vehicle, record trips, access maintenance history or use certain functions are part of the daily life of many modern vehicles, but all this connectivity also has another side: the amount of information that is generated and ends up leaving the vehicle itself.
A study carried out in the United States by researchers from Northeastern University with the collaboration of Consumer Reports, has precisely attempted to verify how far these communications go. To do so, they analyzed 21 connected cars from 19 manufacturers, as well as 30 official applications.
The method used with the cars was quite curious. Each was placed in a Faraday cage to block mobile communications and force them to only use a WiFi network controlled by the researchers. In this way they had the possibility of observing which services it was trying to communicate with.
The result was that 19 of the 21 cars contacted at least one domain external to the manufacturer itself. But even more disturbing is the fact that 11 of them did so with some service related to advertising, tracking or behavioral analysis.
But where the results were even more striking was in the applications. Of the 30 analyzed, 28 sent information to at least one service dedicated to advertising or analysis, and seven even transmitted data capable of directly identifying the owner.
The problem appears especially when different information can be related to each other. A vehicle identifier, an email address or a precise location, separately, may have more or less value, but when combined, they allow much more complete profiles to be built about a person and their habits.
Connected motorcycles are not immune to this data collection problem either.
Although the study was carried out on cars marketed in the United States, the operation of many connected motorcycles may be similar. The difference, of course, is that in most of them communication does not depend on a mobile connection integrated into the motorcycle itself, but on the user’s phone.
The smartphone connects via Bluetooth and the application becomes the bridge between the motorcycle and the different online services. From there, data such as routes recorded using GPS, location, motorcycle identifiers, email or even information related to acceleration and braking can come into play.
That doesn’t necessarily mean that all apps collect all that data, nor that any information ends up being used for advertising purposes. In fact, what the study makes clear is that applications can become one of the central points of the entire connected system, and that for this reason it is important to know what permissions they have and what they are used for.
Another important thing in our case is that in Europe there is also a specific legal framework to protect this information. The General Data Protection Regulation (GDPR) regulates the processing of personal data and, since September 2025, the Data Act also establishes obligations related to access to data generated by connected products.
Even so, an important part of the control remains in our hands. That is why it is always a good idea to review the permissions granted to each application (and not just our motorcycle), limit access to the location when it is not necessary, and check which information sharing options are activated can prevent more data from being shared than is essential.
