Study: Modern Cars and Apps Leak Driver Data to Ad Tech

A study from Northeastern University reveals that late-model vehicles and their companion apps are frequently transmitting driver data to third-party companies, as Engadget first reported. Analyzing 21 vehicles and 30 automaker apps from Consumer Reports' fleet between October 2024 and August 2025, researchers found that 19 cars sent data to third parties via Wi-Fi, while 28 of the 30 apps contacted at least one analytics or advertising firm.

Seven apps specifically passed identifiers—including email addresses, precise locations, and Vehicle Identification Numbers (VINs)—to advertising and analytics companies. Four of these belonged to General Motors: myCadillac, myChevrolet, myBuick, and myGMC. Engadget reports these GM apps sent VINs to 10 companies, including Google, Meta, Snap, Yahoo, Microsoft, Adobe, and data broker Acxiom. Other apps identified in the study include HondaLink, which sent location and VIN data to Amplitude, as well as the MyNISSAN and Lincoln apps.

While some vehicles, such as the Nissan Ariya and Buick Envista, did not contact tracking domains on their own, their respective apps exposed owners to 25 and 23 ad and tracking companies. Conversely, the Tesla Model 3 contacted 22 such companies directly from the car, with its app adding two more.

Automakers defended the practice, telling researchers that data flows matched vendor contracts. Seven manufacturers stated that owners are responsible for accepting third-party service terms, while five attributed tracking to in-app web pages. Honda has since updated HondaLink to stop sending location data and asked Amplitude to delete existing data, according to a company spokesperson. Meanwhile, Rivian and Tesla warned that disabling data collection could result in reduced functionality or the loss of over-the-air updates.