Browse
Log in / Register
Share
Smart cars are always online, but a growing body of research suggests that connection has a hidden cost for drivers. A study released Monday, April 27, 2026, by privacy researchers at Northeastern University shows that the apps people install when they buy a new car are quietly sending data to a wide web of advertising and analytics companies.
Working with Consumer Reports' vehicles and its Auto Test Center in Connecticut, the researchers tested 30 connected mobile apps associated with late-model vehicles. Their findings were stark: 28 of those 30 apps contacted at least one outside advertising or analytics company. Seven of them went further and shared at least one piece of personally identifiable information, such as the owner's name, the car's VIN, or its precise GPS location, with a third party.
The data was not being used only for routine diagnostics or navigation. Some of it was flowing toward marketing platforms, data broker matching systems, and ad-targeting infrastructure controlled by some of the largest tech companies in America.
The study offers a rare, real-world look at how vehicle data moves after a driver pairs a phone with a car. It documents the difference between what the automaker says it collects and what the owner's companion app actually sends to outside servers.
The apps found to be transmitting VINs along with another identifying detail included four General Motors companion apps — myCadillac, myChevrolet, myBuick, and myGMC — as well as HondaLink, MyNissan, and the Lincoln app. In each of these cases, the VIN was paired with either an email address or location data, making it possible to tie the car to a specific person.
The vehicles that sent data to the largest number of outside advertising and analytics companies were the Cadillac Lyriq, Chevrolet Blazer, Lucid Air, Tesla Model 3, and Tesla Cybertruck. Meanwhile, the companion apps that contacted the most outside companies came from BMW, General Motors brands (including Buick, Cadillac, and GMC), and Toyota.
These are not minor players on the receiving end. The study identified Alphabet, Amazon, Meta, Microsoft, Pinterest, and Reddit among the frequent destinations for vehicle data. Many of these companies have a dual role in the ecosystem. They supply the embedded operating system, app development tools, or analytics software used inside the car. At the same time, they also operate advertising auction platforms that target consumers based on their behavior. That means the same company collecting the data often has a financial interest in how that data is used.
Privacy researchers say the most worrying finding is the combination of a VIN with another identifier. A VIN, on its own, is a vehicle serial number and can be hard to link to a person. But when it travels alongside an email address or the owner's name, it becomes a key that can unlock commercially available consumer profiles.
Those profiles are built by data brokers and marketing firms, and they typically include online browsing history, shopping habits, location patterns, and estimated income. Once a tech or advertising company can match a VIN to one of those profiles, it can enrich its understanding of a driver beyond what the car reveals.
The researchers point out that this is not a theoretical risk. Data brokers routinely sell such profiles, and companies that buy them may use them to set everything from insurance premiums to auto loan rates. A driver's acceleration, braking, and late-night driving patterns could already be relevant to auto insurers, even if the driver has no relationship with that insurer.
The study also highlights an uncomfortable contradiction in modern car design. Automakers say data sharing supports useful features such as remote locking, traffic alerts, and maintenance reminders. But the volume of data leaving the vehicle goes well beyond what those features require. In many cases, the data is being sent to advertising and analytics companies at frequent intervals, often while the driver is simply sitting in traffic.
This is not the first time regulators have pushed back on automotive data practices. Several automakers have been fined or formally rebuked for failing to make their data disclosure policies clear enough for consumers. Some have also faced lawsuits from car owners who said the collection and sharing occurred without meaningful consent.
What is new here is the degree of detail. The Northeastern study gives concrete names, numbers, and examples of what is being sent and to whom. That level of transparency is rare in the auto industry, where privacy policies are often filled with broad references to "service providers" and "business partners."
For consumers, the takeaway is that vehicle privacy settings are not a hidden technical topic. They are a practical issue that affects everyday financial decisions. A single data point by itself may seem harmless. But in combination, the data flowing from a car can be used to build a surprisingly complete picture of a person's life.
The study includes practical advice for car owners who want to limit what their vehicle shares. Some of these steps can be done in the car itself, while others require checking the companion app.
First, look for a privacy or data-collection menu inside the vehicle's infotainment system. Many newer models have an option to turn off data collection, analytics, or vehicle health reports. Turning those off can reduce the amount of information leaving the car, though not all of it.
Second, avoid using a personal account to log into the vehicle's infotainment system. If the car offers a guest mode, a temporary driver profile, or the ability to use the system without an account, that is generally the more private option. Car-specific accounts can be useful, but they are also another way of linking driving behavior to a named individual.
Third, review the companion app installed on your phone. Apps such as myChevrolet, HondaLink, MyNissan, and the Lincoln app often have their own privacy settings. Look for options that let you delete telematics data, stop sharing vehicle health information, or revoke marketing permissions. In some apps, these choices are inside the "settings" or "privacy" menu.
Fourth, if the automaker appears to have no clear privacy controls, send a privacy request through its website. Many automakers have a "Do Not Sell or Share My Personal Information" page, and some state privacy laws give consumers the right to ask for their data to be deleted.
Finally, remember that app updates can change what data is collected. After the software updates, it is wise to re-check the privacy settings rather than assume your previous choices remain in place.
The research reinforces a point that privacy advocates have made for years: the modern car is a sensor platform. It knows where you drive, how fast you go, whether you brake hard, and what your daily routine looks like. That information has real value, and many technology companies are positioned to monetize it.
The Northeastern study is part of a growing movement to make those data flows visible to the public. For now, drivers who want to protect their privacy have limited tools. But just as with smartphones, the first step is knowing that the connection is not as simple as it appears. Your car is not just listening to you. In many cases, it is also telling someone else what it hears.
