Companion apps for popular cars transmitted sensitive customer information to advertising and analytics companies during a study by Northeastern University researchers. The research team examined 30 automaker apps and 21 late-model vehicles between October 2024 and August 2025.
Data shared by these apps included precise location information, email addresses, and vehicle identification numbers (VINs). Seven specific apps were identified as sending identifiers to analytics or advertising firms.
Four General Motors (GM) applications, including myCadillac and myChevrolet, sent VINs to 10 different companies. The Buick Envista and Nissan Ariya apps connected to 23 and 25 companies respectively, while the Tesla Model 3 contacted 22 tracking domains directly from the vehicle.
Tesla's mobile app added two more advertising or tracking companies to its connections. Out of the 30 apps tested, 28 contacted at least one analytics or advertising firm.
Ten of the 21 cars examined did not contact any tracking domains on their own. HondaLink reportedly sent both location data and VINs to the analytics firm Amplitude, prompting Honda to request that Amplitude delete the received location data.
Honda subsequently updated HondaLink to cease the transmission of location data. Researchers contacted 17 manufacturers and received responses from 14, all of whom stated that the observed data flows aligned with existing vendor agreements.
Seven manufacturers noted that owners are responsible for reviewing and accepting the terms of third-party services, while five manufacturers stated some tracking originated from web pages opened within their apps. The Federal Trade Commission (FTC) finalized a 20-year privacy order against GM in January, which requires the company to obtain consent before sharing certain connected-vehicle information.
This FTC order also includes restrictions on GM selling driver data to consumer reporting agencies.
