A study conducted by Northeastern University and Consumer Reports found that most of the modern cars and manufacturer apps tested communicated with third-party advertising and analytics companies, sometimes by sending identifiers that could be directly linked to the car owner and their digital activity.
Researchers analyzed data traffic from 21 modern cars and 30 manufacturer apps during the period from October 2024 to August 2025. Nineteen cars sent data to at least one third-party company over wireless connections, while seven apps passed identifiers such as vehicle identification numbers (VINs), email addresses, and precise locations to advertising and analytics companies.
The VIN Cannot Be Changed
Four of the seven apps belonged to General Motors: myCadillac, myChevrolet, myBuick, and myGMC. According to the study, these apps sent VINs to 10 companies, including Microsoft, Adobe, Snap, Yahoo, Meta, Google, and the data broker Acxiom. The HondaLink app also sent VINs and location data to the analytics company Amplitude, while the remaining cases involved the Lincoln and MyNISSAN apps.
The sensitivity of this data lies in the fact that, unlike a phone’s advertising identifier, a VIN cannot be reset by the user. When linked to an email address, advertising companies can connect the identity of the car owner to their activity on other apps and websites, making the car and its app part of a broader digital profile.
Apps Are the Greatest Source of Exposure
Consumer Reports summaries showed that 10 of the 21 cars did not connect directly to advertising or tracking domains, but their apps exposed owners’ data to numerous companies. The Buick Envista app was linked to 23 advertising and tracking companies, while the Nissan Ariya app was linked to 25 companies. By contrast, the Tesla Model 3 itself connected to 22 entities, and its app added two more.
According to the findings, 28 of the 30 apps communicated with at least one advertising or analytics company. The team was unable to decrypt data traffic inside the vehicles, and cellular data capture was limited to the Model 3 case, so the researchers believe the actual figures are likely higher.
Why Does This Matter?
The findings show that the source of the risk or privacy loss is not necessarily the car’s own system; in most of the vehicles tested, the largest share of exposure to advertising and tracking technologies came through the phone app. This means that reviewing the app’s settings and the terms of service associated with it is no less important than reviewing the car’s settings.
The study also found that the privacy policies for the seven apps that shared identifiers disclosed the possibility of passing data to third parties, but did not always identify the recipients or the purpose of the sharing. Tesla warns users who reject its data-sharing agreement that functionality may be reduced and that serious damage or compatibility problems may occur, while Rivian says that stopping data collection may limit features such as navigation and over-the-air updates.
Company Responses and Regulatory Limitations
The researchers contacted 17 manufacturers, and 14 responded that the data flows complied with their supplier contracts. Seven companies said that responsibility for reading the terms of each external service rests with the car owner, while five companies attributed the tracking to web pages opened within their apps.
The findings come in the context of an order by the U.S. Federal Trade Commission against GM, which barred the company from selling driver data to consumer reporting agencies for five years and required express consent before collecting or sharing connected-vehicle data. However, the study’s testing preceded the order, and the researchers did not accuse GM of violating it. GM said that data is disclosed only to service providers whose contracts prohibit them from selling it or using it for their own purposes.
According to the source, Honda asked Amplitude to delete location data and updated HondaLink to stop sending it. David Choffnes, a professor at Northeastern and one of the study’s authors, called on regulators to intervene. One important question remains open: how clear the consent obtained from users actually is, and whether essential functions will remain available to those who refuse to share their data.