Connected Cars and Apps Share Driver Data With Tech Companies
A Northeastern and Consumer Reports study finds 19 of 21 connected cars sent third-party traffic, while paired apps roughly doubled tracking exposure to advertisers.
Summary
WiFi and GPS enabled vehicles collect extensive owner data that consumers can avoid only by forgoing the vehicle or features such as remote start and unlock. Northeastern University and Consumer Reports tested 21 late-model vehicles from 17 automakers, including GM brands Cadillac and Chevrolet, Ford, Lucid, Rivian, Tesla and Toyota, plus 30 companion apps. The peer-reviewed study was scheduled for publication during the week of September 29, 2026.
Nineteen vehicles contacted at least one third party, while seven apps gave VINs, emails, phone numbers or precise locations to tracking and advertising companies, including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo. Sending multiple identifiers to one recipient helps advertisers and data brokers create durable profiles sold to companies including insurers and banks. Pairing an app with a vehicle roughly doubled exposure to advertising and tracking companies.
After researchers notified manufacturers, all except Honda shifted responsibility elsewhere, often toward consumers. Honda improved its collection practices and ordered vendor Amplitude to delete all geolocation data it had received. Several automakers said app links opened external webpages that might use data-collecting cookies, but drivers were not informed regardless of how collection occurred.
Positives
- Honda improved its data collection practices and ordered Amplitude to delete all geolocation data it had received.
- 21 vehicles and 30 companion apps underwent testing across 17 automakers, providing broad evidence about connected-car privacy.
- The peer-reviewed study was scheduled for publication during the week of September 29, 2026.
- Researchers shared their findings with every tested manufacturer, prompting at least one concrete remediation.
Risks & concerns
- 19 of 21 tested vehicles sent traffic to at least one third party.
- Seven of 30 apps shared VINs, emails, phone numbers or precise locations with tracking and advertising companies.
- Pairing a companion app with its vehicle roughly doubled exposure to advertising and tracking companies.
- Multiple identifiers sent to one company can support durable profiles sold to insurers, banks and other businesses.
- Every manufacturer except Honda shifted responsibility elsewhere, often toward consumers, after receiving the findings.
- Drivers were not informed when external webpages and possible cookies collected data through companion-app links.