A new study from Northeastern University, conducted on Consumer Reports' fleet between October 2024 and August 2025, found that most modern cars and their companion apps transmit personal data to third-party companies. Of the 21 vehicles and 30 apps tested, 19 cars sent data to at least one third party over Wi-Fi, and 28 of the apps contacted at least one advertising or analytics firm.
Seven apps shared persistent identifiers such as VINs, email addresses, and precise locations. Four of those belong to General Motors — myCadillac, myChevrolet, myBuick, and myGMC — each sending VINs to 10 companies including Microsoft and Adobe. HondaLink sent VINs and location to analytics firm Amplitude, with Lincoln and MyNISSAN apps also on the list. Because a VIN cannot be reset like an advertising ID, linking it to an email lets ad companies track owners across other apps and websites.
The study found that 10 of the 21 cars contacted no advertising or tracking domains on their own, but pairing them with apps often changed that. The Buick Envista and Nissan Ariya, for example, were clean on their own, yet their apps exposed owners to 23 and 25 ad and tracking companies respectively. Tesla went the opposite way: the Model 3 reached 22 companies directly from the car, while its app added two. The researchers note that real totals are likely higher because vehicle traffic was encrypted. Automakers generally said the data flows matched vendor contracts, and seven said owners are responsible for reading terms of third-party services. Honda was the only one to act, asking Amplitude to delete location data and updating HondaLink to stop sending it.
The study predates the FTC's January order banning GM from selling driver data for five years and requiring express consent, and the researchers have not alleged a breach. Still, the study's co-author, David Choffnes, told Northeastern Global News that regulators should step in. The findings highlight a growing business concern: as cars become more connected, the data they generate may be feeding advertising ecosystems with little transparency.