Consumer Reports (Organization): news timeline & CVEs

Automatic Transmission – a data-privacy study of connected vehicles

Northeastern and Consumer Reports found most tested connected cars share data with third parties.

Researchers at Northeastern University, working with Consumer Reports, published a large-scale privacy measurement of connected vehicles that will appear at IMC 2026. They tested 21 late-model U.S. vehicles and 30 companion mobile apps between October 2024 and August 2025, using a Raspberry Pi access point, a Faraday tent, and mitmproxy. Nineteen of 21 vehicles sent traffic to at least one third party over Wi-Fi. Seven of 30 apps transmitted sensitive identifiers to third parties, and five sent a VIN plus other personal data.

Hacker News · securityOct 1, 20:23 UTC · 7d agoResearch HN 120↑ · 105 comments

Connected Cars Are a Surveillance Platform

Consumer Reports and Northeastern found connected cars share driving data with insurers, brokers, and agencies.

Northeastern University and Consumer Reports reviewed privacy policies from 15 automakers and filings from insurtech data brokers. They report that first-use infotainment and mobile-app consent screens often secure permission for driving-data collection that drivers accept without reading. Recipients can include insurers, lenders, telematics exchanges, risk-scoring brokers, infotainment vendors, and government agencies. Bruce Schneier argues connected-car owners remain under manufacturer surveillance even as paying customers.

Schneier on SecurityOct 1, 11:06 UTC · 7d agoResearch

Some car apps are slipping owners’ data to big tech companies

Researchers found car apps sending VINs, emails, and location to advertising and analytics firms.

Northeastern University researchers, working with Consumer Reports, tested 21 vehicles from 19 brands and 30 companion apps and found some sending VINs, email addresses, phone numbers, or location to advertising, tracking, and analytics companies. Nineteen of 21 vehicles contacted at least one third party over Wi-Fi, 11 reached advertising or analytics domains, and 13 contacted Google-owned domains. Seven of 30 apps sent personal data onward; GM's myCadillac, myChevrolet, myBuick, and myGMC apps sent VINs to companies including Adobe, Acxiom, Google, Meta, and Microsoft. Manufacturers said the flows matched vendor contracts, while privacy policies disclosed third-party sharing without naming recipients or purposes.

Help Net SecurityOct 1, 09:52 UTC · 7d agoResearch

Automakers routinely share personally identifiable connected-car data with third parties, report says

Researchers say most automakers share connected-car personal data with advertisers and brokers.

Northeastern University researchers and Consumer Reports found that 19 of 21 major automakers collect connected-car data and share it widely. Twenty-eight of 30 companion apps sent data to at least one advertising or analytics firm, and seven shared names, email addresses, or precise geolocation. GM, Honda, Nissan, and Lincoln apps were described as packaging VINs with location or email, which can identify individual drivers. Recipients included Alphabet, Amazon, Microsoft, Meta, Reddit, and Pinterest. After notification, Honda directed a vendor to delete ingested location data; California previously fined GM more than $12 million over driver-data sharing.

The RecordSep 30, 20:32 UTC · 8d agoResearch

Your car’s app could be telling Big Tech who you are and where you go

Northeastern and Consumer Reports found 19 of 21 cars and 7 of 30 companion apps send data to advertising and tracking domains.

Northeastern University researchers working with Consumer Reports tested 21 cars from 19 brands (model years 2022-2025) and 30 companion apps, observing network traffic while stationary, driving, and during app use. They found 19 of 21 vehicles contacted at least one third party over Wi-Fi and 7 of 30 apps transmitted sensitive identifiers to advertising and tracking domains; Amazon, Google, Meta, and Microsoft were among leading recipients. VINs combined with precise location, names, and emails can link driving patterns to advertiser and data broker profiles. After findings were presented, Honda directed vendor Amplitude to delete location data, and the study follows Texas AG Ken Paxton's lawsuit against GM over selling driving data.

Malwarebytes LabsSep 30, 11:28 UTC · 8d agoResearch

The End of a Fair Price: Dynamic Pricing and the Normalization of Gouging

An American Prospect review of Lindsay Owens's Gouged critiques AI-aided personalized pricing and corporate price increases.

An American Prospect review of Lindsay Owens's book Gouged argues that companies used inflation, consolidation, and personalized pricing, sometimes with AI and outside consultants, to raise prices. It cites a Groundwork Collaborative, Consumer Reports, and More Perfect Union study finding that roughly 75 percent of items in identical Instacart baskets varied in price between shoppers at the same time. The review says the critique prompted Federal Trade Commission scrutiny and that Instacart later disavowed the surveillance pricing technology. The article is a consumer-economics essay rather than cybersecurity or AI-security news.

Hacker News · AISep 29, 18:09 UTC · 9d agoOther HN 44↑ · 26 comments

The smart home graveyard is getting crowded

Weber shut off June Oven cloud services, adding another bricked product to the smart-home graveyard.

A Verge column says Weber, which bought June in 2021 and stopped making its smart ovens in 2022, shut off the June app and cloud services, leaving owners with a basic oven and no updates or parts. It lists other recently abandoned connected products, including Nest Secure, early Nest thermostats, Belkin WeMo, Neato vacuums, Brava, Logitech Pop, Bose SoundTouch, and Sengled bulbs. The piece argues for local control, Matter and other local protocols, and consumer protections such as a local API before a cloud shutdown.

Hacker News · securitySep 28, 11:27 UTC · 10d agoOther HN 23↑ · 14 comments

Consumer Reports

Timeline7 articles

Appears with