The Model 3 Contacted 34 Ad and Tracking Domains. The Tesla App Contacted Nine.

Nine researchers at Northeastern University drove 21 late-model cars into a Faraday tent and recorded everything each one tried to say to the internet. The Tesla Model 3 talked to more advertising and tracking companies than any other vehicle tested. The Tesla phone app talked to fewer than almost any other app. Both findings come from the same paper.

What was measured

"Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem" is peer-reviewed and is being presented at the 2026 ACM Internet Measurement Conference in Karlsruhe on 12-16 October. The team worked with Consumer Reports, testing CR's own cars at its Connecticut facility between October 2024 and August 2025. Wi-Fi traffic was intercepted at idle, during infotainment use, and on private roads; the 11 electric cars were then rolled into a tent that cut cellular signal by roughly 93 dB, pushing traffic that would normally leave over the modem onto the readable Wi-Fi link.

The ranking

ATA is the paper's label for advertising, tracking and analytics domains. Nineteen of the 21 cars contacted at least one third party, and 13 reached a Google-owned ad domain — among them doubleclick.net and googlesyndication.com, which the authors note are not required for any core vehicle function.

Why the table is not a fair fight

The paper's explanation is capability, not misconduct: cars with sophisticated infotainment — both Teslas, the Lucid Air, the Rivian R1S — and those running full Android Automotive with Google services contact the most parties. The EQS, Range Rover and Envista have limited infotainment and reached one or two domains each.

The measurement caveat deserves equal billing. The tent exposed 27 more ATA domains for the Model 3 and 14 more for the Cybertruck than were visible outside it, and only the 11 EVs could go inside, so the cellular traffic of the ten combustion and hybrid cars was never seen at all. The Model 3 was also the only car whose cellular link could be tapped directly, because it has a user-accessible SIM slot. Teslas offer a non-default setting to keep Wi-Fi on while driving, which the researchers enabled "to maximize the data available to us"; the Land Rover, Mercedes and Nissan dropped Wi-Fi the moment they left Park. The Teslas sit on top partly because more of their behaviour was observable.

The app tells the opposite story

Across 30 companion apps the pattern inverts. The Tesla app reached nine ATA domains; myCadillac reached 51, and myBuick, My BMW and Toyota 47 each. Seven apps sent personal data — VINs paired with an email address or precise location — to tracking firms: GM's four, HondaLink, MyNissan and Lincoln. Tesla's was not among them. Shown the results, Honda told analytics vendor Amplitude to delete the location data it had received.

What a European owner should take from it

Almost all this traffic stayed in the United States; only 13 destination addresses sat outside it, one a Microsoft server in Ireland reached by the Cybertruck. These were US-market cars on US networks, so the counts are not a direct read on what a European car sends under GDPR.

The harder finding travels anyway. Of 18 manufacturers contacted, 14 replied, and most pointed to their third-party contracts or to the owner's own consent. Tesla's opt-out language is quoted in the paper: decline the data-sharing agreement and you are warned the car may suffer "reduced functionality, serious damage, or inoperability". The authors' verdict is that this is no real choice — and that the Mercedes and Buick results show the traffic is a design decision, not a fact of modern cars.