TL;DR
Get business pricing on garage and car supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A study by Northeastern University and Consumer Reports examined 21 vehicles and 30 companion apps, finding that many apps contacted numerous advertising, tracking and analytics domains. Researchers also found that seven apps sent personal information, including vehicle identification numbers, to third parties. The study does not establish that every automaker or app shared the same data or that every recipient used it for advertising.
A study by Northeastern University and Consumer Reports found that many of the 30 car companion apps it tested contacted advertising, tracking and analytics companies, and that seven apps sent personal information to third parties. The findings, based on tests of 21 vehicles from 19 brands, raise questions about who can link vehicle data to individual drivers and what choices owners have if they decline connected features.
Researchers found that 70% of the companion apps contacted more than five unique advertising, tracking and analytics domains. The data observed included location and timing information. For most vehicles in the study, counting the automaker or pre-installed third-party app at least doubled the number of such companies exposed to the owner’s data. The myCadillac app contacted 51 domains, while the Buick Envista and Nissan Ariya each reached more than 20 when their apps were included, despite being nearly silent in the vehicle-only tests.
The researchers also reported substantial differences between vehicles. Over Wi-Fi, vehicles contacted no more than four first-party domains, while the average number of integrated third-party domains was about nine. The Tesla Model 3 contacted 34 advertising, tracking and analytics domains and the Cybertruck contacted 23; the Mercedes-Benz EQS and Buick Envista contacted none. Thirteen vehicles contacted Google domains, including doubleclick.net. The report says vehicles with Android Automotive and Google services contacted more trackers, though results differed even among vehicles from the same manufacturer.
Seven apps associated with 19 of the 21 vehicles transmitted personal information to third parties: four General Motors apps, HondaLink, Lincoln and MyNissan. Vehicle identification numbers were the most common information reported, with recipients including Google, Microsoft and Meta. Researchers said a VIN combined with details such as an email address, phone number or location could help link a person to browsing or purchase history. A VIN cannot be reset like a phone advertising identifier.
Why a VIN Can Follow a Driver
A vehicle identification number is tied to a specific car and generally persists for its life. If a vendor receives a VIN alongside contact details or location, researchers say those records could help connect vehicle use with a named person. The study documents data flows and potential links; it does not show that every recipient built such a profile or explain how each company used the information.
The findings also put a practical limit on privacy choices. Automakers’ policies disclosed that data could go to third parties, but the report says they did not identify all recipients or explain each transfer. Some connected services are bundled with functions owners may value. According to the source report, Tesla warned that opting out could reduce functionality or make features inoperable, while Rivian warned of disabled navigation and over-the-air updates. That can make avoiding data collection a tradeoff rather than a simple setting change.
How Researchers Traced Car Data
The study covered 21 vehicles from 19 brands and 30 companion mobile apps. Its test list ranged from a 2022 Ford F-150 Lightning and 2023 Toyota Corolla Cross to 2024 models including the Tesla Cybertruck, Buick Envista and Honda Prologue. The researchers examined communications from vehicles and apps, allowing them to compare what happened with and without companion software.
The distinction matters because a car’s app can create data paths beyond the vehicle itself. The source report says some official apps connect to a phone and open its browser. Once that happens, browser cookies and settings may affect the flow of information. The study’s findings therefore cover tested configurations and observed network activity; they should not be read as proof that every owner, vehicle setup or app session behaves identically.
Researchers contacted 17 manufacturers, and 14 responded, according to the report. All said their vendor contracts covered data flows. Five cited embedded browsers in their apps, and seven said consumers were responsible for reviewing third-party terms. Honda was the only manufacturer the report said changed course: it asked Amplitude to delete location data it had received and stopped the app from sending it.
What the Tests Cannot Establish
The source material does not give the study’s publication date, full methodology or a complete account of how each domain used data it received. Contact with an advertising or analytics domain does not by itself establish that a person was identified, targeted or sold data. The reported tests also cannot determine whether every car of a listed model sends the same information under different settings, software versions or usage patterns.
It remains unclear from the report how long each recipient retained the observed information, whether it was combined with other records, and what protections applied to each transfer. The automakers’ responses, as summarized by The Drive, described vendor contracts and consumer responsibility but did not resolve those questions for every company.
Questions for Automakers and Vendors
The next step is for manufacturers and app providers to explain, in specific terms, which data each service collects, which vendors receive it, how long it is retained and what happens when an owner opts out. The source material does not identify a planned regulatory action or a scheduled follow-up study. Owners can review their vehicle and app privacy settings and policies, while recognizing that the report says some opt-outs may affect connected services.
Further testing across software updates, settings and additional vehicles could show whether the observed patterns persist. For now, the researchers’ results describe the vehicles and apps they examined, while broader claims about all cars or all drivers remain unestablished.
Key Questions
How many vehicles and apps did the study examine?
Researchers tested 21 vehicles from 19 brands and 30 companion apps, according to The Drive’s account.
What information did the apps send to third parties?
The report says seven apps transmitted personal information, most commonly vehicle identification numbers. Researchers also observed location and timing information among data shared by apps.
Does the study prove that companies sold drivers’ data?
No. The reported tests found communications with third-party domains and some transmissions of personal information. The source material does not establish that every recipient sold data, identified drivers or used the information for advertising.
Can owners opt out of connected data sharing?
Options vary by service. The report says Tesla warned that opting out could reduce functionality or cause inoperability, and Rivian warned that navigation and over-the-air updates could be disabled.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
