Cars and companion apps may regularly send detailed data to major tech firms, Northeastern researchers find

A study by researchers at Northeastern University, conducted in partnership with Consumer Reports, has found that connected cars and their companion mobile apps routinely share driver data with third-party advertising, tracking, and analytics companies, including several major technology corporations .

Key Findings

Vehicles Tested: Researchers examined 21 late-model vehicles from 17 automakers, including GM brands (Cadillac, Chevrolet), Ford, Lucid, Rivian, Tesla, Toyota, and others. They also analyzed 30 companion mobile apps .

Vehicle Data Sharing: Of the 21 vehicles tested, 19 sent data to at least one third party. More than half contacted domains associated with advertising, tracking, or analytics services .

App Data Sharing: 28 of the 30 companion apps shared data with at least one third-party advertising or analytics firm . Seven apps transmitted sensitive personally identifiable information, including vehicle identification numbers (VINs), email addresses, phone numbers, and precise location data, to outside companies .

Major Tech Recipients: According to Consumer Reports, data was shared with dozens of technology giants, including Google's Alphabet, Amazon, Microsoft, Meta, Reddit, and Pinterest. Other third parties contacted included Adobe, Contentsquare, Snap, Yahoo, and Acxiom .

Method and Impact

Researchers routed vehicle internet traffic through networks they controlled using a Raspberry Pi Wi-Fi access point to identify the domains contacted by the cars. Because much of the vehicle traffic was encrypted, they could generally identify where communications were sent but not the contents of those transmissions. The companion apps provided more detailed traffic that could be analyzed .

The study notes that connecting a car to its app roughly doubled the vehicle's exposure to advertising and tracking companies. Combining a persistent identifier like a VIN with location or email data allows advertisers and data brokers to build detailed profiles of consumers, which can then be sold to insurers, banks, and other companies .

Manufacturer Responses

Researchers contacted 17 manufacturers about the findings. Most shifted blame to third-party service contracts or to consumers, claiming users have a responsibility to review terms. Of the 14 manufacturers that responded, all claimed the data flows aligned with contractual agreements .

Honda was the notable exception. After being notified, Honda directed its analytics vendor Amplitude to delete all ingested location data and updated the HondaLink app to stop transmitting precise geolocation . A Honda spokesperson confirmed the VIN and location data shared with Amplitude had not been available for independent use or sale due to contractual prohibitions .

Broader Context

The study adds to recent regulatory scrutiny. In January 2026, the FTC finalized an order against General Motors and OnStar over the collection and sale of precise geolocation and driving behavior data without adequate notice or consent. In May, California authorities announced a $12.75 million settlement with GM over the sale of location and driving data to third parties .

The researchers concluded there is a "need for better transparency to ensure increased visibility into the entire ecosystem to identify and address corresponding harms" .