Study finds many new cars share data with third parties

A new study of connected cars found that most of the vehicles tested sent data to at least one advertising or analytics company, with some automaker apps passing identifiers including vehicle identification numbers (VINs), email addresses and precise locations.¹

Researchers from Northeastern University tested traffic from 21 late-model vehicles and 30 automaker apps between October 2024 and August 2025, using cars from Consumer Reports’ fleet.² Nineteen vehicles contacted at least one third party through Wi-Fi, while seven apps shared identifiers with advertising or analytics companies.

What the study found

The results varied sharply between cars and apps. Four General Motors apps — myCadillac, myChevrolet, myBuick and myGMC — sent VINs to 10 companies, including Microsoft and Adobe. HondaLink sent VINs and location data to Amplitude, while apps connected to Lincoln and Nissan also appeared in the study’s list of data-sharing services.¹

A VIN is more persistent than the advertising identifiers used by phones. When paired with an email address, it can help companies connect a vehicle owner with activity across other apps and websites. Consumer Reports said 28 of the 30 automaker apps contacted at least one advertising or analytics company.²

The researchers noted that the totals may be higher because they could not decrypt vehicle traffic, and cellular traffic was captured only from the Tesla Model 3. In some cases, the car itself contacted relatively few tracking domains while its companion phone app created much more exposure.

Automakers point to contracts and privacy policies

The researchers approached 17 manufacturers and heard back from 14. The companies said the data flows matched their vendor contracts, while several argued that owners accept responsibility for reading the terms attached to third-party services and pre-installed software.¹

GM told Northeastern Global News that its disclosures go to service providers contractually barred from selling or using the information for their own purposes. Honda, meanwhile, asked Amplitude to delete location data and updated HondaLink to stop sending it, according to a Honda spokesperson.¹

The testing predates the Federal Trade Commission’s January order concerning GM, and the researchers have not alleged that the findings breach that order. The study’s co-author David Choffnes said regulators should take a closer look at connected-car data flows.¹

Our opinion

A car is increasingly a rolling computer, but its privacy controls are still far harder to understand than those on a phone. Owners should not have to reverse-engineer which pre-installed app is sharing a permanent vehicle identifier before they can make an informed choice. The study does not show that every data transfer is unlawful, but it does show why clearer consent and more useful in-car privacy controls are needed.

The findings are a warning rather than a verdict on every automaker. They cover a limited sample and predate some policy changes, so the next step should be repeatable testing across newer vehicles — with results published in a form ordinary drivers can actually use.