TL;DR
Get garage and car supplies delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A study by Northeastern University and Consumer Reports tested 21 vehicles and 30 companion apps and found that many connected to advertising, tracking and analytics domains. Researchers also found that several apps sent personal information, including vehicle identification numbers, to third parties; the scope and purpose of data sharing vary by vehicle and app.
A study by Northeastern University and Consumer Reports found that companion apps for tested vehicles often connected to multiple advertising, tracking and analytics (ATA) domains, and that some apps sent personal information such as vehicle identification numbers to third parties. The research examined 21 vehicles from 19 brands and 30 apps and assessed the data connections the researchers observed and the disclosures provided by automakers.
Researchers found that 70% of the companion apps contacted more than five unique ATA domains. They said adding an automaker’s app or a third-party app could at least double the number of ATA companies exposed to an owner’s data for most tested vehicles. The Buick Envista and Nissan Ariya, which had few connections in vehicle-only testing, each reached more than 20 ATA companies when the app was included. Cadillac’s myCadillac app contacted 51 ATA domains.
Vehicle connections varied. Over Wi-Fi, the cars contacted no more than four first-party domains and an average of about nine integrated third parties, according to the study. The Tesla Model 3 contacted 34 ATA domains and the Cybertruck 23; the Mercedes EQS and Buick Envista contacted no third parties in that test. Thirteen of the 21 vehicles contacted Google ATA domains, including DoubleClick, which the report said was not needed for core services.
The researchers also reported that seven apps associated with 19 of the 21 cars sent personal information to ATA third parties. Those apps included four GM apps, HondaLink, Lincoln’s app and MyNissan. Vehicle identification numbers were the most common personal information identified among the data sent, with recipients including Google, Microsoft and Meta. The report says a VIN combined with details such as an email address, phone number or location could potentially help link a person to other records or activity.
Why Vehicle Data Is Relevant to Privacy
Connected vehicles and their companion apps can transmit location, timing and identifying information to automakers and outside companies, according to the study. The researchers reported that these data flows were not always clearly identified in the privacy disclosures they reviewed.
A vehicle identification number is tied to a specific vehicle and cannot be reset in the way a smartphone advertising ID can. The researchers say combining a VIN with contact details or location could make it easier to associate a vehicle with an individual. The study identifies this as a potential privacy risk; it does not establish that every recipient used the information for that purpose.
The report says Tesla warned that opting out of data collection could reduce functionality or make features inoperable, while Rivian warned that navigation and over-the-air updates could be disabled. The effects of opting out therefore depend on the automaker and the services involved.
As an affiliate, we earn on qualifying purchases.
How Researchers Tested Connected Cars
The study combined testing of 21 vehicles from model years 2022 to 2025 with analysis of 30 companion mobile apps. Researchers monitored connections made by vehicles and apps, including contacts with advertising, tracking and analytics domains. The report notes that the app can change the picture: an app may use a phone browser, bringing browser cookies and browsing data into the flow in ways that are not apparent from vehicle-only testing.
Researchers contacted 17 manufacturers, and 14 responded. According to the report, all respondents said their vendor contracts covered data flows. Five pointed to embedded browsers in their apps, and seven said consumers were responsible for reviewing third-party terms. The report says privacy policies disclosed that data might be shared but generally did not identify the specific recipients or reasons.
Honda was the sole manufacturer the report said changed its practices after the researchers raised concerns: it asked Amplitude to delete location data it had received and stopped the app from sending that data. The study’s vehicle list included models from Buick, Cadillac, Chevrolet, Dodge, Fiat, Ford, Honda, Land Rover, Lexus, Toyota, Subaru, Lucid, Mercedes-Benz, Nissan, Rivian, Tesla and Volvo.
“70% of companion apps contacted more than five unique advertising, tracking and analytics domains.”
— Northeastern University and Consumer Reports study
car data blocker for connected cars
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Data Tests Cannot Show
The findings describe connections recorded in a defined set of vehicles and apps; they do not establish that every car from a brand behaves the same way or that every data transfer is used for advertising. The study reports which domains were contacted and identifies some information sent, but the full purpose, retention period and onward use of each data transfer are not clear from the supplied findings.
Automakers’ privacy policies and vendor agreements may cover data sharing, but the report says they often did not specify which third parties received information or why. It is also unclear how widely the researchers’ results apply to other model years, software versions, regions or app settings. The report describes Honda’s response, but does not establish whether other manufacturers will change their practices.
As an affiliate, we earn on qualifying purchases.
Questions for Automakers and Drivers
The report describes Honda changing one data flow after researchers raised concerns. It does not confirm broader policy changes or establish whether other manufacturers will alter their data practices.
Drivers can review the privacy settings and terms for their vehicle and companion app, and check whether connected features can be disabled individually. The researchers reported that disclosures often did not specify all vendors or data uses. The report raises questions about how clearly automakers explain what information leaves the vehicle, who receives it and how it is used.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the study examine?
It tested 21 vehicles from 19 brands and examined 30 companion apps, tracking connections to advertising, tracking and analytics domains.
Which personal information did researchers say apps shared?
The report says vehicle identification numbers were the most common personal information sent to third parties. It names Google, Microsoft and Meta among recipients, but does not establish how each used the data.
Can drivers opt out of vehicle data sharing?
Controls vary. The study reports that some manufacturers warned opting out could reduce functionality or disable services such as navigation or over-the-air updates. It does not provide one universal opt-out process.
Did any automaker change its practices after the research?
According to the report, Honda asked Amplitude to delete location data it had received and stopped the app from sending that data. The supplied material does not confirm similar changes by other manufacturers.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
