TL;DR
Get garage and car supplies delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A study by Northeastern University and Consumer Reports examined 21 vehicles and 30 companion apps, finding that many apps contacted multiple advertising, tracking and analytics domains. Seven apps transmitted personal information to third parties, with vehicle identification numbers among the data reported; the researchers say a VIN can help link a person to other information and cannot be reset like a phone advertising ID.
A study by Northeastern University and Consumer Reports found that companion apps for many of 21 tested vehicles contacted advertising, tracking and analytics companies, and that seven apps sent personal information to third parties. The findings raise questions about who receives drivers’ data and how easily people can limit sharing tied to connected car features.
The researchers examined 21 vehicles from 19 brands and 30 companion mobile apps. They found that 70% of the apps contacted more than five distinct advertising, tracking and analytics domains, commonly transmitting location, timing and other data. For most tested vehicles, counting the automaker or third-party app at least doubled the number of such companies exposed to data. The myCadillac app contacted 51 domains, according to the report.
Seven apps associated with 19 of the 21 cars transmitted personal information to third-party advertising, tracking or analytics domains: apps for the four tested GM vehicles, HondaLink, Lincoln and MyNissan. The report says vehicle identification numbers (VINs) were the most common personal information sent, with Google, Microsoft and Meta among recipients. The researchers warn that a VIN combined with an email address, phone number or location could help a company associate a specific person with browsing or purchase history.
Vehicle connections also varied. Over Wi-Fi, the cars contacted up to four domains operated by their manufacturers and averaged about nine integrated third parties. The Tesla Model 3 contacted 34 advertising, tracking and analytics domains and the Cybertruck 23; the Mercedes EQS and Buick Envista contacted none in the vehicle-only tests. Once apps were included, the Envista and Nissan Ariya each reached more than 20 such domains, the report says.
VINs Can Connect Car Data to Drivers
The findings matter because a vehicle identifier can persist in ways a phone advertising ID does not. The researchers say a VIN cannot be reset like a smartphone advertising ID, and that combining it with contact details or location could make data easier to associate with an individual. That creates a potential link between driving-related information and a person’s activity elsewhere, though the study does not establish how each recipient used the data.
Limiting data collection may also affect features. The source report says Tesla warned that opting out could reduce functionality or make services inoperable, while Rivian warned that navigation and over-the-air updates could be disabled. That leaves drivers weighing privacy choices against features that manufacturers connect to data collection.
Apps Expand the Data Flow
Connected cars use internet services for features such as navigation, remote access and software updates. The study focused on both vehicles’ direct network activity and data flows through companion apps, which can change what parties receive information. The researchers found that some apps opened a phone browser, shifting parts of the data flow to the browser and its settings.
The research covered vehicles including the Buick Envista, Cadillac Lyriq, Chevrolet Blazer, Ford F-150 Lightning, Honda Prologue, Toyota Corolla Cross, Nissan Ariya, Rivian R1S and Tesla Model 3 and Cybertruck. Results differed across vehicles, including models from the same manufacturer. The tests therefore describe the examined vehicles and app behavior, not every car or every owner’s experience.
“The study found that 70% of companion apps contacted more than five unique advertising, tracking and analytics domains.”
— Northeastern University and Consumer Reports study, as summarized by The Drive
Recipients and Uses Remain Unclear
The study’s findings identify domains contacted and information transmitted in the tested setups, but they do not establish how every third party stored, combined or used the data. The researchers also reported that manufacturers’ privacy policies disclosed possible sharing without consistently identifying which companies received data or why.
The source report does not provide a complete, standardized account of what each company retained or whether the tested flows occur for every driver. App versions, settings and use of connected services may affect what data is transmitted. The study’s results should be read as observations from its tested vehicles and apps.
More Clarity Depends on Disclosures
The researchers’ findings put pressure on automakers to explain data flows through both vehicle systems and companion apps, including the vendors that receive information. The source report describes manufacturer responses to researchers’ inquiries; it does not set out a common disclosure timetable or a broader industry commitment.
For drivers, the immediate practical question is what data a chosen vehicle and its app send under their settings, and what features may change if sharing is limited. The study does not provide a single opt-out that applies across brands, so the available controls and their effects remain specific to each manufacturer and service.
Key Questions
How many vehicles and apps did researchers test?
The study examined 21 vehicles from 19 brands and 30 companion mobile apps.
What personal information did some apps transmit?
The report says seven apps sent personal information to third-party advertising, tracking and analytics domains. VINs were the most common type reported, and Google, Microsoft and Meta were among the recipients.
Why did researchers flag VIN sharing?
The researchers say a VIN cannot be reset like a phone advertising ID. Paired with details such as an email address, phone number or location, it could help link data to a specific person.
Did every tested vehicle contact the same trackers?
No. The report found substantial variation. The Mercedes EQS and Buick Envista contacted no third parties in vehicle-only tests, while the Tesla Model 3 contacted 34 advertising, tracking and analytics domains.
Can drivers opt out without losing features?
That depends on the manufacturer and service. The source report says Tesla warned of reduced functionality or inoperability, and Rivian warned that navigation and over-the-air updates could be disabled.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
