TL;DR
Get garage and car supplies delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A study by Northeastern University and Consumer Reports examined 21 vehicles and 30 companion apps, finding that many apps contacted multiple advertising, tracking and analytics domains. Researchers also found that seven apps transmitted personal information, including vehicle identification numbers, to third parties. The findings describe tested vehicles and apps; they do not establish that every car or app shares the same data.
A study by Northeastern University and Consumer Reports found that companion apps for many of the 21 vehicles tested contacted multiple advertising, tracking and analytics domains, and that seven apps transmitted personal information such as vehicle identification numbers to third parties. The findings matter because a VIN can connect a vehicle to an owner in ways that are difficult to change, while the researchers said privacy policies often did not identify specific recipients or explain why data was shared.
The research covered 21 vehicles from 19 brands and 30 companion mobile apps. According to the study’s reported findings, 70% of the apps contacted more than five unique advertising, tracking and analytics domains. For most test vehicles, researchers found that including the automaker’s or a third-party app at least doubled the number of such companies exposed to data from the owner. The Buick Envista and Nissan Ariya, which had few connections when considered on their own, each reached more than 20 such domains once an app was included. Cadillac’s myCadillac app contacted 51.
Connections varied widely between vehicles. Over Wi-Fi, cars contacted no more than four first-party domains but averaged about nine integrated third parties, according to the report. The Tesla Model 3 contacted 34 advertising, tracking and analytics domains and the Cybertruck contacted 23; the Mercedes EQS and Buick Envista contacted none. Thirteen vehicles contacted Google domains, including DoubleClick. The researchers said vehicles using Android Automotive and Google services contacted more trackers, while some vehicles from the same manufacturer behaved differently.
The study said seven apps associated with 19 of the 21 cars transmitted personal information to third-party advertising, tracking or analytics companies: four General Motors apps, HondaLink, Lincoln’s app and MyNissan. VINs were the most common personal identifier reported, with recipients including Google, Microsoft and Meta. The concern raised by the researchers is that a VIN combined with an email address, phone number or location could help link a person to browsing or purchasing activity. Unlike a phone’s advertising ID, a vehicle’s VIN cannot simply be reset.
How VIN Sharing Can Link Drivers
The findings point to a privacy issue that can reach beyond driving functions. A car’s location and usage data can be sensitive on their own; when connected to a persistent vehicle identification number and contact details, they may make it easier for outside companies to associate activity with a particular owner. The study describes potential linkage, not proof that every recipient built a profile or used the information for a particular purpose.
For drivers, avoiding the connected app may limit access to features such as remote controls, navigation or vehicle updates. The report says Tesla warned that opting out could reduce functionality or make some features inoperable, while Rivian warned that navigation and over-the-air updates could be disabled. That creates a practical trade-off: consumers may have to choose between connected convenience and limiting some data flows. The study’s app and vehicle tests also show why checking only a car’s dashboard privacy settings may not reveal every connection made through a phone app or embedded browser.
As an affiliate, we earn on qualifying purchases.
What Researchers Tested
The research examined vehicles spanning model years 2022 through 2025, including electric, hybrid and gasoline models. The list included cars and trucks from Buick, Cadillac, Chevrolet, Dodge, Fiat, Ford, Honda, Land Rover, Lexus, Toyota, Subaru, Lucid, Mercedes-Benz, Nissan, Rivian, Tesla and Volvo. Researchers examined both vehicle connections over Wi-Fi and the behavior of companion applications, since the two channels can expose data to different parties.
Researchers contacted 17 manufacturers; 14 responded, according to the report summarized by The Drive. All said contracts with vendors covered data flows. Five pointed to embedded browsers in their apps, and seven said consumers were responsible for reviewing third-party terms. The report also describes a complication in testing: an app can open a phone’s browser, bringing browser settings, cookies and browsing data into the flow. Honda was the only manufacturer reported to have changed its practices in response: it asked analytics company Amplitude to delete location data it had received and stopped the app from sending it.
“70% of companion apps contacted more than five unique advertising, tracking and analytics domains.”
— Northeastern University and Consumer Reports study, as summarized by The Drive
As an affiliate, we earn on qualifying purchases.
What the Tests Cannot Establish
The research covers a defined sample of 21 vehicles and 30 apps; it does not establish how every model, software version or driver’s settings behave. The reported domain counts show contacts to advertising, tracking and analytics services, but do not by themselves reveal what data each company retained, how long it kept it, or whether it used the data to identify individual drivers.
The available summary also does not provide a complete recipient-by-recipient account of every data field or the exact circumstances in which each app sent it. Manufacturers’ statements about vendor contracts do not independently verify how all recipients handled information. It remains unclear how broadly the findings apply to vehicles outside the sample and whether other manufacturers will follow Honda’s reported decision to stop a particular location-data flow.
As an affiliate, we earn on qualifying purchases.
Privacy Changes and Driver Choices
Drivers can review the privacy settings and data-sharing terms for both their vehicle and its companion app, while recognizing that disabling features may affect convenience or functionality. The study’s findings also put pressure on automakers to identify the companies receiving data and explain the purposes of sharing in terms consumers can understand. The reported responses offer one example of a change: Honda asked Amplitude to delete location data and stopped the app from transmitting it.
No broader policy change or additional manufacturer action is confirmed in the source material. The next developments to watch are whether automakers disclose more specific recipient lists, alter app data flows, or clarify what drivers lose when they opt out. Until those details are available, the study should be read as evidence of varied data connections in the tested sample, not a complete account of every car’s data practices.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the study examine?
Researchers examined 21 vehicles from 19 brands and 30 companion apps, looking at connections to advertising, tracking and analytics domains as well as some personal information flows.
Did every tested car share a VIN with third parties?
No. The report says seven apps associated with 19 of the 21 cars transmitted personal information to third-party domains. VINs were the most common personal identifier reported, but the findings do not mean every vehicle or app transmitted one.
Who received information in the reported tests?
The report names Google, Microsoft and Meta among recipients of VINs. It also reports that many apps contacted advertising, tracking and analytics domains, but the available summary does not list every recipient or data field.
Can drivers opt out of data sharing?
Some data flows may be limited by changing settings or not using connected features, but the report says manufacturers warned that opting out could reduce functionality. Tesla cited possible loss of functionality, and Rivian cited navigation and over-the-air updates.
Does this prove that every car tracks its owner?
No. The study documents behavior among its tested vehicles and apps. It does not establish that every car tracks every owner, or show how all third parties used or retained the data they received.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
