TL;DR
Get garage and car supplies delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A study by Northeastern University and Consumer Reports tested 21 vehicles and 30 companion apps and found that many apps contacted multiple advertising, tracking and analytics domains. Some apps sent vehicle identification numbers to third parties, while the study found that automakers’ privacy disclosures often did not identify recipients or explain specific data flows. The results describe the tested cars and apps, not every vehicle or service.
A study by Northeastern University and Consumer Reports found that companion apps for many of 21 tested vehicles contacted multiple advertising, tracking and analytics companies, and that some apps sent vehicle identification numbers (VINs) to third parties. The findings raise questions about who can connect information generated by a car to an identifiable owner, though the study covers a limited sample rather than the entire auto industry.
The researchers examined 21 vehicles from 19 brands and 30 companion mobile apps. According to the report, 70% of the apps contacted more than five distinct advertising, tracking and analytics domains. For most test vehicles, including the app in the analysis at least doubled the number of such companies exposed to owner data. The Buick Envista and Nissan Ariya systems were relatively quiet when tested without their apps, but reached more than 20 domains once the apps were included. Cadillac’s myCadillac app contacted 51.
Vehicle connections varied as well. Over Wi-Fi, tested vehicles contacted no more than four automaker-controlled domains, while contacting an average of about nine integrated third-party domains, according to the study. The Tesla Model 3 contacted 34 advertising, tracking and analytics domains and the Cybertruck 23; the Mercedes-Benz EQS and Buick Envista contacted none in that category. These counts describe the researchers’ tests and should not be read as a measure of how many companies receive data from every owner’s car in normal use.
The report says seven apps associated with 19 of the 21 vehicles transmitted personal information to third-party domains. The apps named were those from all four tested General Motors brands, Honda, Lincoln and Nissan. VINs were the most common personal information identified, with recipients including Google, Microsoft and Meta. The researchers’ concern is that a VIN combined with information such as an email address, phone number or location could help link a vehicle to a person and their online activity.
Why VIN Sharing Raises Privacy Risks
A vehicle’s data can reveal more than where it has been. Connected services may handle location and usage information, while an app or browser interaction can introduce data unrelated to driving. The study says VINs matter because they are tied to a specific vehicle and, unlike a phone advertising identifier, cannot simply be reset by the owner. If a VIN is combined with identifying details, companies may be able to associate car-related activity with a person’s other records or interests.
The findings also point to a practical trade-off for drivers. Automakers’ privacy policies may disclose that data can go to third parties without naming each recipient or explaining the purpose of every transfer, the report says. Turning off data-sharing settings or declining connected features may limit functionality: the source reports Tesla warned of reduced functionality or inoperability, while Rivian warned that navigation and over-the-air updates could be disabled. The study does not establish that every listed company uses every data item for advertising, nor does it document a specific harm to an individual driver.
As an affiliate, we earn on qualifying purchases.
What Researchers Tested
The research covered a varied group of vehicles, including electric cars, hybrids and gasoline models from manufacturers such as Toyota, Ford, Tesla, General Motors, Honda, Nissan and Mercedes-Benz. Researchers considered both vehicle network activity and companion apps, an important distinction because the app can connect to more third-party services than the car itself.
The report also describes a technical complication: some vehicle apps can open or interact with a phone’s browser. In those cases, cookies and browser data may become part of the data flow, and the phone’s browser settings may affect what is shared. This makes the path from car to app to phone less straightforward than a simple list of vehicle connections.
Of 17 manufacturers contacted by the researchers, 14 responded. The report says manufacturers generally pointed to vendor contracts governing data flows; five cited embedded browsers in their apps, and seven said consumers were responsible for reviewing third-party terms. Honda was the only company the source says changed its handling after being contacted: it asked analytics provider Amplitude to delete location data and stopped the app from sending it.
“70% of companion apps contacted more than five unique advertising, tracking and analytics domains.”
— Northeastern University and Consumer Reports study, as summarized by The Drive
As an affiliate, we earn on qualifying purchases.
Limits of the Data-Sharing Findings
The findings are based on 21 specific vehicles and 30 apps, so they do not establish how every model, software version or owner’s settings behave. The source does not provide a full account of which exact data each recipient received in every test, how each recipient used it, or whether the transfers resulted in targeted advertising or other consequences. The number of domains contacted is not itself proof that each domain received identifiable personal information.
It is also unclear from the source how representative the tested app behavior is across different regions, phone settings, account choices and software updates. The report describes privacy policies as often lacking detail about recipients and purposes, but the article does not reproduce every policy or every manufacturer response. Claims about what data is shared should therefore be understood as findings from the researchers’ tests, not as a universal description of every connected car.
As an affiliate, we earn on qualifying purchases.
Owner Choices and Company Responses
The source does not identify a regulatory action, recall or industry-wide change scheduled in response to the study. For now, owners can review the privacy and connected-services settings in their vehicle and companion app, check what features may stop working if they opt out, and read the app’s permissions and privacy terms. Those steps may not reveal every third-party data flow, particularly where vendor disclosures are incomplete.
Further clarity would depend on automakers and app providers identifying the data they collect, naming recipients and explaining why information is shared. The study’s account of Honda’s response offers one example of a company changing a data practice after researchers raised concerns. Whether other manufacturers will make similar changes, or whether updated testing will find different behavior in newer software, remains unknown.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the study examine?
Researchers tested 21 vehicles from 19 brands and 30 companion apps, examining connections to advertising, tracking and analytics domains.
Did every tested car send a VIN to third parties?
No. The report says seven apps associated with 19 of the 21 vehicles transmitted personal information to third-party domains, and VINs were the most common information identified. The source does not say every tested vehicle or app sent a VIN.
What is a VIN, and why does the report flag it?
A vehicle identification number identifies a specific vehicle. The researchers said a VIN combined with an email address, phone number or location could help link the vehicle to a person and other information; unlike a phone advertising ID, a VIN cannot be reset by its owner.
Can drivers opt out of connected-car data sharing?
Some sharing may be controlled through vehicle or app settings, but the source says opting out can reduce functionality. Tesla warned of reduced functionality or inoperability, and Rivian warned that navigation and over-the-air updates could be disabled.
Does contacting a tracking domain prove a company misused data?
No. A domain count shows that a tested system contacted a service; it does not by itself establish what personal data that service received or how it used the information.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
