Study Finds New Cars and Apps Share Data With Third Parties
A joint study by Northeastern University and Consumer Reports highlights how modern cars and companion smartphone apps share driver data with third-party tracking companies.
Radwan AbdulhadiEditor and technology writer
Vehicle Data Collection and Third-Party Tracking
A comprehensive research effort conducted between October 2024 and August 2025 has shed light on how modern connected vehicles handle consumer information. According to a study detailed by <a href="https://www.engadget.com/2281212/new-car-sharing-data-third-party-companies-study-northeastern-university/">Engadget</a>, researchers from <a href="https://automatictransmission.khoury.northeastern.edu/">Northeastern University</a> and <a href="https://www.consumerreports.org/electronics/personal-information/your-car-is-sharing-data-with-big-tech-companies-study-northeastern-university/">Consumer Reports'</a> fleet testing analyzed traffic from 21 vehicles and 30 companion apps. The findings indicate that automakers are collecting substantial data that allows advertisers to build in-depth profiles on consumers.
The analysis revealed that 19 out of the 21 vehicles contacted at least one third-party company via Wi-Fi, which included various advertising and tracking domains. While some vehicles did not contact tracking domains directly on their own, their companion apps often exposed owners to dozens of ad and tracking companies. Overall, 28 of the 30 tested apps contacted at least one advertising or analytics company.
Apps Passing Identifiers to Advertisers and Data Brokers
The investigation highlighted specific instances where automaker apps transmitted unique identifiers to major tech platforms and data brokers. For example, General Motors' apps were found to send vehicle identification numbers (VINs) to companies such as Pinterest, Snap, Yahoo, Meta, Google, and the data broker Acxiom.
Seven of the tested apps were found to pass sensitive identifiers—including VINs, email addresses, and precise locations—directly to advertising and analytics companies. Four of those applications belonged to GM: myCadillac, myChevrolet, myBuick, and myGMC. Each of these four apps sent VINs to 10 different companies, including Microsoft and Adobe. Additionally, HondaLink transmitted VINs and location data to the analytics firm Amplitude, with Lincoln and MyNISSAN apps also appearing on the list.
Unlike a smartphone's resettable advertising ID, a vehicle's VIN is permanent. When a permanent VIN is paired with an email address, advertising companies can easily tie an owner's vehicle identity to their activity across other mobile applications and websites.
Regulatory Actions and Prior Investigations
Data privacy practices within the automotive industry have drawn intense scrutiny from federal regulators. Earlier, the <a href="https://www.engadget.com/transportation/ftc-finalizes-gm-punishment-over-driver-data-sharing-scandal-130012313.html">FTC finalized GM's punishment over its driver data sharing scandal</a>, addressing improper data handling practices. The regulatory agency issued an order <a href="https://www.engadget.com/transportation/ftc-bans-general-motors-from-selling-driver-data-for-five-years-000019615.html">banning the company from selling driver data for five years</a> to consumer reporting agencies while also requiring express consent before collecting or sharing connected vehicle data.
Further context on these institutional investigations and ongoing privacy discussions can be found through updates reported by <a href="https://news.northeastern.edu/2026/09/29/connected-car-privacy-violation-research/">Northeastern Global News</a>. It is important to note that the academic testing conducted by Northeastern University predates the finalization of the FTC order, and researchers have not alleged a breach of that specific ruling.
Automaker Responses and Privacy Policies
When approached by researchers with their findings, 14 out of 17 contacted manufacturers responded. Every responding automaker stated that their data flows matched their established vendor contracts. Furthermore, seven manufacturers asserted that it is ultimately the responsibility of the vehicle owner to read and accept the terms and conditions for every third-party service integrated into the car, including pre-installed software.
General Motors informed researchers that it only discloses information to service providers who are contractually barred from selling the data or using it for their own independent purposes. Meanwhile, five other automakers attributed third-party tracking activity to web pages opened directly inside their proprietary mobile applications.
An examination of the privacy policies belonging to the seven apps that shared personal identifiers revealed that each policy broadly disclosed the possibility of passing personal data to third parties, though none specified which companies received the data or why.
Consumer Choices and Industry Changes
Car owners who attempt to opt out of data sharing often face steep functional penalties. Owners who decline Tesla's data sharing agreement are explicitly warned about reduced vehicle functionality, serious damage, or interoperability issues. Similarly, Rivian notes that disabling data collection will significantly limit or completely disable features like navigation and over-the-air software updates.
Despite widespread resistance to modifying data collection practices across the sector, some changes have occurred. Honda emerged as an exception by asking analytics firm Amplitude to delete collected location data and updating the HondaLink app to stop transmitting it altogether, a move confirmed by a company spokesperson.
Academic experts involved in the study continue to advocate for stronger safeguards. David Choffnes, a Northeastern professor and study co-author, emphasized that regulatory bodies should step in to protect consumers from pervasive tracking in modern connected vehicles.
Sources
- EngadgetStudy finds many new cars share your data with third-party companies
Continue chronologically
Related stories
US Regulators Propose Cyan Lights for Autonomous Vehicles
The NHTSA has proposed new cyan lighting requirements to signal when a vehicle operates autonomously, as automakers and tech firms advance self-driving tech.
Why Your Electric Vehicle Battery Loses Charge While Parked
Discover why electric vehicle batteries lose charge while parked, from system checks and connected services to cold weather and surveillance features.
GM Product Chief Details Tech Roadmap and AI Strategy
General Motors Chief Product Officer Sterling Anderson discusses the automaker's ambitious shift toward artificial intelligence, centralized computing, and software-driven vehicle development.
GM Agrees to $220 Million Data Privacy Settlement
General Motors has agreed to a $220 million settlement with 35 states and the District of Columbia over its controversial Smart Driver tracking program.
