Study finds car data shared with third-party companies — Engadget
A study by Northeastern University and Consumer Reports found that 19 of 21 late-model-year vehicles transmitted data via Wi-Fi to at least one third-party company. Seven of the 30 automakers’ apps tested sent identifiers, including VINs, email addresses and precise location data, to advertising and analytics companies, Engadget reports.
Data from cars and apps
Researchers analyzed network traffic from 21 vehicles and 30 apps from the Consumer Reports fleet between October 2024 and August 2025. For most tested models, the largest share of contacts with advertising technology occurred through mobile apps rather than directly through the vehicles. Twenty-eight of the 30 apps contacted at least one advertising or analytics company.
Four General Motors apps — myCadillac, myChevrolet, myBuick and myGMC — transmitted VINs to 10 companies, including Microsoft and Adobe. According to the study, GM apps also sent VINs to Pinterest, Snap, Yahoo, Meta, Google and data broker Acxiom. HondaLink transmitted a VIN and location data to analytics company Amplitude; Lincoln and MyNISSAN were also among the apps that transmitted identifiers.
More current news is available on the UA.News Telegram channel Telegram.
Unlike a smartphone advertising identifier, a VIN cannot be reset. Combining a VIN with an email address enables advertising companies to link a car owner to their activity in other apps and on websites.
Manufacturers’ responses
Researchers contacted 17 automakers and received responses from 14 of them. All said the identified data flows complied with their contracts with vendors. Seven manufacturers stated that owners must independently review and agree to the terms of every third-party service in the vehicle, including preinstalled software. Another five companies attributed the tracking to webpages opened within their apps.
In January, the Federal Trade Commission finalized an order against General Motors in a case involving the sharing of driver data. The company is subject to a 20-year order that, among other things, prohibits it from selling driver data to consumer reporting agencies for five years and requires it to obtain explicit consent before collecting or transmitting connected-car data. Testing took place before this decision, and the researchers did not allege that it had been violated. Honda, for its part, asked Amplitude to delete location data and updated HondaLink to stop transmitting it.
