Your car and mobile apps are probably handing over all kinds of data to tech companies.

Built with connected car technologies like WiFi and GPS, modern cars collect massive amounts of data about their owners. And according to a new study conducted by researchers at Northeastern University, that data doesn’t stay private.

This conclusion is not new. There have been numerous investigations and lawsuits exposing how driving data is collected and shared with third parties, including insurance companies. Research shows just how vast the problem is and how difficult it is to avoid unless consumers are using their vehicles or using convenient features like remote start and unlocking.

Working with Consumer Reports, researchers tested 21 late-model vehicles from 17 automakers, including GM brands Cadillac, Chevrolet, Ford, Lucid, Rivian, Tesla, and Toyota. They also examined 30 companion mobile apps to “understand the privacy implications of the connected vehicle ecosystem.” The peer-reviewed study is expected to be published this week.

It doesn’t mean much to consumers, whose data is shared with tech companies including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo.

Of the 21 vehicles tested, 19 sent traffic to at least one third party, and seven of the 30 apps provided sensitive data such as vehicle identification number (VIN), email, phone number, and precise location to third-party companies related to tracking and advertising.

Research shows that this often goes one step further, with multiple forms of information being sent to the same third party, allowing advertisers and data brokers to build in-depth profiles of consumers. Because these profiles are sold to a variety of companies, including insurance companies and banks, it can be difficult for consumers to sway them.

When researchers connected the companion app to the vehicles, exposure to advertising and tracking companies roughly doubled.

The findings were shared with several manufacturers, and all but Honda shifted responsibility elsewhere, often to consumers, the researchers said. (After learning of the findings, Honda responded by improving its data collection practices and ordered supplier Amplitude to delete all geolocation data it received.)

Consumer Reports has heard from several automakers that some links in their companion apps opened outside web pages that may contain cookies that collect customer data. Regardless of how this data was collected, drivers were not informed.