Car Data Sharing Exposed: Apps Feed Driver Info to Tech Giants

March 19, 2025 — Your car knows a lot more about you than you realize. And new reporting from Consumer Reports and Northeastern University confirms that much of that information isn’t staying inside your vehicle.

The two groups teamed up to analyze 30 companion apps used by late-model cars from 19 brands. They found that 28 of those apps sent personal data to outside companies. Seven even handed over sensitive details like names, vehicle identification numbers, and exact locations.

That means a routine drive to work, school, or a doctor's office is being silently logged and transmitted to names you’ve never heard of. And in many cases, the companies receiving that data are big tech platforms you probably deal with every day.

What the study actually found

The research put 21 late-model vehicles from a wide range of automakers through a privacy stress test. Every single car they checked transmitted data to at least one third-party domain. More than half of the vehicles contacted domains that specialize in advertising, audience tracking, or analytics.

Among the companies collecting data were Amazon, Google, Meta, and Microsoft. Tesla and General Motors vehicles stood out as the models linked to the largest number of outside firms.

David Choffnes, the project lead and former director of Northeastern's Cybersecurity and Privacy Institute, didn't sugarcoat the results.

"There's a lot to be worried about," Choffnes said. "Owners have very little control over what happens with the data their cars generate."

That lack of control is exactly the problem. You may have bought your car for its safety features, blind-spot monitoring, or built-in navigation. But the same technology that makes those features work is also feeding a data pipeline that’s nearly invisible to the average driver.

The apps are just as bad as the cars

It’s not just the vehicles themselves. The mobile apps that connect to your car often serve as a second leak source.

The study found that apps like HondaLink and myChevrolet were passing sensitive information straight to advertising networks. More than 70 percent of the apps tested contacted at least five separate analytics domains.

What can a company do with that data? A lot.

Location history can reveal where you live, where your kids go to school, where you go to church, which clinics you visit, and what stores you shop at. When that information gets bundled and resold, it helps data brokers build detailed profiles of individual drivers. You never get a say in that exchange.

Automakers have different reactions

The automaker response to the study has been far from uniform. Honda, for example, took the findings seriously. The company asked its analytics provider, Amplitude, to delete collected location data. It also updated the HondaLink app so it no longer sends geolocation data.

Other brands were more defensive. Several argued that their data-sharing practices are allowed under current laws and that users consent through long, hard-to-read terms-of-service agreements.

That’s a weak argument in Choffnes’ view. Saying someone “agreed” to data sharing because they clicked past a 4,000-word privacy policy isn’t informed consent. It’s a paperwork exercise.

Why this matters more than ever

Connected car data has become a bigger concern outside academic circles too. The Federal Trade Commission has been cracking down on data brokers that buy and sell precise location data without meaningful consumer notice. State legislatures are starting to introduce bills that would put brakes on the unrestricted sale of driving and vehicle data.

But regulations haven’t caught up with the industry yet. And automakers are still building more connectivity into every new model, including subscriptions, over-the-air updates, and in-car voice assistants. That means the amount of data flowing out of your vehicle will only grow.

How to reduce your exposure today

You don’t have to throw away your keys and start riding a bike to protect your privacy. There are a few practical moves that can limit how much data your car sends out.

• Check if your car has a privacy dashboard or data settings menu. Many new vehicles let you turn off data collection for diagnostics, driving behavior, and personalized services.
• Review the permissions you’ve given to your car's companion app. On your phone, look for the app's location and background data settings, and shut off anything that isn’t necessary.
• If your car supports guest or valet mode, use it. The less your personal profile is connected to the car's cloud account, the less data gets tied back to your name.
• Look for a “do not sell” or “share my data” option on your automaker’s website. Federal and state laws sometimes require those links to be easy to find.

Choffnes believes consumers should be given a real choice, not just hidden checkboxes. He says automakers need to come clean about what’s being recorded and let owners opt in rather than forcing them to opt out.

Until that happens, the burden sits with the person holding the steering wheel. Knowing what your car is doing with your data is the first step to keeping the ride private.