Study Reveals How Many New Cars Share Drivers’ Personal Data…

A study examining 21 late-model vehicles and 30 automaker apps has found that many connected cars and their companion smartphone apps communicate with advertising and analytics companies. General Motors apps were among those sharing vehicle identification numbers (VINs), according to research conducted by Northeastern University between October 2024 and August 2025.

The research, conducted using vehicles in Consumer Reports’ fleet, found that 19 of the 21 cars transmitted data to at least one third-party company over Wi-Fi. Seven automaker apps also sent identifiers, including VINs, email addresses, and precise location information, to advertising and analytics firms.

Four of the seven apps belonged to General Motors (GM), which has been subject to a 20-year Federal Trade Commission (FTC) privacy order since January. The findings also identified data sharing involving Honda, Lincoln, and Nissan apps.

GM Apps Shared Vehicle Identification Numbers With Third Parties

The four GM apps identified in the study were myCadillac, myChevrolet, myBuick, and myGMC. Each reportedly sent VINs to 10 companies, including Microsoft and Adobe.

HondaLink also transmitted VINs and location data to Amplitude, an analytics company. The Lincoln and MyNISSAN apps accounted for the other two apps identified as sharing personal identifiers with third parties.

Unlike advertising identifiers used by smartphones, a VIN cannot simply be reset. When combined with an email address, it can help advertising companies connect a vehicle owner to activity across other apps and websites.

The findings suggest that the extent of tracking associated with a vehicle may not be apparent from examining the car alone. According to Consumer Reports' per-vehicle summary, 10 of the 21 vehicles did not independently contact advertising or tracking domains.

However, the companion apps for the Buick Envista and Nissan Ariya connected to 23 and 25 advertising and tracking companies, respectively. The Tesla Model 3 showed a different pattern: the vehicle itself contacted 22 such companies, while its app added two more.

The researchers noted that their measurements were incomplete because they could not decrypt vehicle network traffic. They also could capture cellular data only from the Tesla Model 3, meaning the actual number of third-party connections could be higher.

For most vehicles in the study, the researchers found that the majority of advertising technology exposure came through smartphone apps. Consumer Reports also reported that 28 of the 30 automaker apps contacted at least one advertising or analytics company.

FTC Privacy Order Restricts GM's Driver Data Practices

The findings come after the FTC finalized an order against GM in January over its handling of driver data. The order prohibits the automaker from selling driver data to consumer reporting agencies for five years and requires express consent before collecting or sharing connected vehicle data.

However, the Northeastern University testing took place before the order was finalized. The researchers have not alleged that GM violated the order.

GM told Northeastern Global News that it only discloses data to service providers that are contractually prohibited from selling the information or using it for their own purposes.

The study also examined how automakers explained their data-sharing practices. Researchers contacted 17 manufacturers about their findings and received responses from 14. All 14 said the observed data flows were consistent with their agreements with vendors.

Seven manufacturers said vehicle owners were ultimately responsible for reviewing and accepting the terms governing third-party services, including pre-installed software. Another five attributed the tracking activity to web pages opened within their apps.

Automaker Privacy Policies Disclose Third-Party Data Sharing

The researchers reviewed the privacy policies of the seven apps that transmitted identifiers. Each policy disclosed that personal information could be shared with third parties, but none specified which companies would receive the information or why.

Some automakers also warn customers that disabling data sharing can affect vehicle features.

Tesla warns owners who decline its data-sharing agreement of "reduced functionality, serious damage, or interoperability." Rivian, meanwhile, states that turning off data collection can limit or disable features such as navigation and over-the-air software updates.

These disclosures illustrate the potential trade-off owners face when deciding whether to allow connected vehicle data collection. Depending on the automaker, restricting data sharing may affect certain services available through a vehicle or its companion app.

Honda Responds to Findings by Changing HondaLink Data Sharing

Honda was the only manufacturer identified in the report as making a specific change in response to the findings.

The company asked Amplitude to delete the location data it had received and updated HondaLink to stop sending that information. A Honda spokesperson confirmed the changes to Northeastern Global News.

Northeastern professor and study co-author David Choffnes told the outlet that regulators should intervene.

The research highlights the complexity of automotive data privacy, particularly as vehicles increasingly rely on connected services and smartphone apps. It also demonstrates that understanding a car's data-sharing practices may require examining both the vehicle's network activity and the software used to access its connected features.

For drivers, reviewing privacy settings and the terms governing connected services can help clarify what information may be collected and shared. However, the study's findings indicate that privacy policies may not always identify every third-party recipient or explain the specific purpose of each data transfer.