Connected cars and manufacturer mobile applications have reignited the debate over the transfer of personal data to third-party companies.
An investigation by researchers at Northeastern University revealed that 19 out of 21 new car models tested shared data with at least one third-party company via Wi-Fi.
The research was conducted between October 2024 and August 2025 using vehicles from Consumer Reports' test fleet and 30 automotive manufacturer applications. The study examined which advertising, analytics, or tracking companies the vehicles' connected services and mobile applications communicated with.
According to the findings, while 90 percent of the cars sent data to third parties, 28 out of the 30 manufacturer applications established connections with at least one advertising or analytics company. The researchers determined that manufacturer applications, in particular, play a decisive role in data sharing.
VIN AND LOCATION SHARING IN APPLICATIONS
It was determined that seven of the examined applications transmitted information that could identify the user, such as vehicle identification numbers (VIN), email addresses, and precise location, to advertising and analytics companies. It was reported that General Motors' myCadillac, myChevrolet, myBuick, and myGMC applications sent vehicle VINs to 10 companies, including Microsoft and Adobe.
Other companies mentioned in the research included Pinterest, Snap, Yahoo, Meta, Google, and the data broker Acxiom. It was stated that the HondaLink application shared VIN and location information with the analytics company Amplitude, and that the Lincoln and MyNISSAN applications also transferred identifying data to third parties.
Tesla was also one of the prominent examples in the study. It was noted that the Model 3 and Cybertruck models shared a wide set of data, ranging from driving habits to in-vehicle digital activities, with advertising, tracking, and analytics servers. According to the research, while the Model 3 vehicle itself communicated with 22 advertising and tracking companies, the Tesla application added two more companies to this count.
According to Consumer Reports' vehicle-based investigation, 10 of the 21 cars did not communicate with any advertising or tracking domain on their own. However, when the same vehicles were evaluated together with manufacturer applications, it was observed that data sharing increased significantly.
The researchers emphasized that not all vehicle traffic could be decrypted due to encryption, and that the actual level of data sharing might be higher than what was detected. It was also noted that for the Model 3, only data traffic occurring over cellular connection could be captured.
The findings were shared with a total of 17 car manufacturers; 14 companies responded. All of the companies argued that the detected data flows were in accordance with contracts made with suppliers. Seven manufacturers stated that it is the user's responsibility to read and accept the terms of third-party services, including pre-installed software.
Honda was one of the companies that took concrete steps in the research. The company requested the deletion of location data from Amplitude and updated the HondaLink application to stop sending this data. It was reported that Tesla warns users who do not accept the data sharing agreement about loss of functionality or interoperability issues, while Rivian stated that turning off data collection could limit features such as navigation and over-the-air updates.
News Source: 12punto
