Cars and automaker apps found sharing driver data with ad firms
A Northeastern University study tested 21 late-model cars and 30 automaker apps between October 2024 and August 2025. Nineteen cars sent data to at least one third party, and seven apps shared identifiers such as vehicle identification numbers, email addresses, and exact location data with advertising or analytics firms; four GM apps sent VINs to 10 companies. Because VINs cannot be reset, pairing them with email addresses can let ad companies link owners to activity across other apps and websites, and GM is under an FTC privacy order.
Between October 2024 and August 2025, a Northeastern team examined 21 recent vehicles and 30 manufacturer apps. Nineteen vehicles transmitted information to at least one outside company over Wi-Fi, while seven apps passed identifiers such as VINs, email addresses, and precise locations to marketing and measurement companies.
Four GM apps—myCadillac, myChevrolet, myBuick, and myGMC—sent VINs to ten firms, including Microsoft and Adobe. HondaLink shared VINs and location with Amplitude. Because a VIN cannot be reset, pairing it with an email address may let ad companies link owners to activity elsewhere. GM is subject to a 20-year FTC privacy order; the testing predates that order.
Drivers of connected cars and app users could face persistent profiling because VINs cannot be reset, making it harder to escape targeted advertising or data linkage. Automakers and ad-tech vendors may face greater scrutiny from regulators and consumers, while privacy policies that lack specifics could leave owners unable to give meaningful consent. The findings may push some companies to adjust data flows, but broad change could depend on enforcement and whether buyers prioritize privacy when choosing vehicles.