Study Finds Most Cars and Automaker Apps Share Driver Data With Ad Firms

A Northeastern University study found that 19 of 21 late-model cars it tested sent data to at least one third-party company over Wi-Fi, and 28 of the 30 automaker apps it examined contacted at least one advertising or analytics company. The testing ran from October 2024 to August 2025, according to Engadget.

Seven of the 30 apps passed identifiers such as vehicle identification numbers (VINs), email addresses and precise locations to advertising and analytics companies. Four of those seven belong to General Motors: myCadillac, myChevrolet, myBuick and myGMC. Each of the four GM apps sent VINs to 10 companies, including Microsoft and Adobe.

HondaLink sent VINs and location data to the analytics firm Amplitude. After the researchers contacted Honda, the automaker asked Amplitude to delete the location data and updated HondaLink to stop sending it, making Honda the only automaker in the study to change its data-sharing practice in response.

The researchers approached 17 manufacturers with their findings and heard back from 14.

Regulatory context

Since January, General Motors has been under a 20-year FTC privacy order. In January, the FTC finalized an order barring GM from selling driver data for five years to consumer reporting agencies and requiring express consent before collecting or sharing connected vehicle data. Northeastern's testing predates the FTC order, and the researchers have not alleged a breach of it.