Your car and its mobile app are likely transmitting all sorts of data to tech companies.

Modern cars, built using connected car technologies such as Wi-Fi and GPS, collect a wealth of data about their owners. And that data doesn’t remain private, according to a new study by Northeastern University researchers.

This finding is not new: There have been numerous investigations and lawsuits exposing how driving data is collected and shared with third parties, including insurance companies. The study shows how widespread the problem is and how difficult it is for consumers to avoid it, short of not using the car or its convenience features such as remote start and unlocking.

The researchers, in collaboration with Consumer Reports, tested 21 late-model vehicles from 17 automakers, including GM’s Cadillac and Chevrolet brands, as well as Ford, Lucid, Rivian, Tesla, Toyota and others. They also studied 30 companion mobile apps to “understand the privacy implications of the connected vehicle ecosystem.” The peer-reviewed study will be published this week.

The consequences are limited for consumers whose data is shared with technology companies including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo.

Nineteen of the 21 vehicles tested sent traffic to at least one third party, and seven of the 30 apps shared sensitive data such as vehicle identification number (VIN), emails, phone numbers and precise location with third-party tracking and advertising companies.

It often went further, with multiple forms of information sent to the same third party, according to the findings. This scheme allows advertisers and data brokers to create detailed consumer profiles. It can be especially difficult for consumers to change these profiles because they are sold to different companies, including insurers and banks.

When the researchers connected the companion app to the car, it roughly doubled the impact of advertising and tracking companies.

The results were shared with various manufacturers, and all of them, with the exception of Honda, shifted the blame elsewhere and often to consumers, the researchers said. (Honda responded by improving its data collection methods after learning of the results, and ordered its supplier Amplitude to delete all geolocation data collected.)

Several automakers told Consumer Reports that some links in their companion apps open outside of web pages, which may include cookies that collect customer data. Regardless of how this data was collected, drivers were not informed.