Study: Most New Cars Share Driver Data With Third-Party Companies

What the Study Found

A cybersecurity study from Northeastern University analyzed network traffic from 21 late-model cars and 30 automaker apps on Consumer Reports' fleet between October 2024 and August 2025. Nineteen of the 21 vehicles sent data to at least one third-party company over Wi-Fi, and 28 of the 30 apps contacted at least one advertising or analytics company.

Seven apps passed identifiers such as VINs, email addresses, and precise locations to advertising and analytics firms. Four of them belong to General Motors: myCadillac, myChevrolet, myBuick, and myGMC, each of which sent VINs to 10 companies, including Microsoft and Adobe. The GM apps also transmitted VINs to Pinterest, Snap, Yahoo, Meta, Google, and the data broker Acxiom. HondaLink sent VINs and location data to the analytics firm Amplitude, while the Lincoln and MyNISSAN apps rounded out the list.

Why VINs Are Harder to Hide Than Phone IDs

Unlike a phone's advertising ID, a VIN cannot be reset, so pairing one with an email address lets advertising companies tie a vehicle owner to activity across other apps and websites. According to Consumer Reports' per-vehicle summary, 10 of the 21 cars contacted no advertising or tracking domains on their own. The Buick Envista and Nissan Ariya were among them, yet pairing their apps exposed owners to 23 and 25 ad and tracking companies respectively. Tesla went the opposite direction: the Model 3 reached 22 such companies from the car itself, while its app added two more.

The researchers noted they could not decrypt vehicle traffic and could only capture cellular data from the Model 3, so the real totals are likely higher. For most of the cars tested, the bulk of the ad-tech exposure came from the phone app rather than the vehicle.

Automakers Point to Contracts and Policies

GM has been under a 20-year FTC privacy order since January, when the agency finalized its punishment over the company's driver data sharing scandal. The order bans GM from selling driver data to consumer reporting agencies for five years and requires express consent before it collects or shares connected vehicle data. Northeastern's testing predates that order, and the researchers have not alleged a breach of it.

GM told Northeastern Global News that it only discloses data to service providers that are contractually barred from selling or using it for their own purposes. The researchers approached 17 manufacturers with their findings and heard back from 14, all of which said the data flows matched their vendor contracts. Seven said it is ultimately the owner's responsibility to read and accept the terms for every third-party service in the car, including pre-installed software, while five attributed the tracking to web pages opened inside their apps.

The researchers also reviewed the privacy policies of the seven apps that shared identifiers and found that each disclosed it may pass personal data to third parties, without saying which ones or why. Owners who decline Tesla's data sharing agreement are warned of "reduced functionality, serious damage, or interoperability," while Rivian says switching off data collection will limit or disable features such as navigation and over-the-air updates. Honda appears to be the only manufacturer willing to change anything, asking Amplitude to delete the location data and updating HondaLink to stop sending it, which a Honda spokesperson confirmed.

Researchers Call for Regulators to Step In

Northeastern professor and study co-author David Choffnes told Northeastern Global News that regulators should step in.

Sources: Engadget