Northeastern study: 19 of 21 cars shared data

A Northeastern University study found that 19 of 21 late-model cars sent data to outside companies. In most cases, the car was not the main source. The phone app was.

**Reported:** Engadget reports that researchers tested 21 cars and 30 automaker apps from Consumer Reports' fleet between October 2024 and August 2025. Nineteen of the cars passed data to at least one outside company over Wi-Fi. Seven apps sent identifiers such as VINs, email addresses and precise locations to advertising and analytics firms.

Four of those seven belong to GM: myCadillac, myChevrolet, myBuick and myGMC. Engadget reports each sent VINs to 10 companies, Microsoft and Adobe among them. HondaLink sent VINs and location data to the analytics firm Amplitude. The Lincoln and MyNISSAN apps complete the list.

Why the VIN matters

A phone's advertising ID can be reset. A VIN can't. Put a VIN next to an email address and an ad company can connect an owner to activity in other apps and on websites, permanently. That's the mechanism, and it's why this is worse than the usual app-tracking story.

The app does more than the car

Consumer Reports' per-vehicle summary found that 10 of the 21 cars made no contact with advertising or tracking domains themselves. The Buick Envista and Nissan Ariya were among them. Add their apps and owners were exposed to 23 and 25 ad and tracking companies respectively.

Tesla went the other way. The Model 3 reached 22 such companies from the car; its app added two. Engadget reports that for most of the cars tested, the phone app did most of the tracking, and that 28 of the 30 apps contacted at least one advertising or analytics company.

Our take: buying a different car fixes less than you'd think. If you use the maker's app, you inherit the app's data trail, and every maker on this list ran the same play. The car is the hardware. The app is where the data goes.

Two things to keep in mind. The researchers couldn't decrypt vehicle traffic and could only pull cellular data from the Model 3, so the real numbers are probably higher. And the January FTC order against GM, which bars selling driver data to consumer reporting agencies for five years and requires express consent before collecting or sharing connected vehicle data, came after this testing. Engadget notes the researchers haven't alleged GM broke it.

GM told Northeastern Global News it discloses data only to service providers that are contractually blocked from selling it or using it for their own ends.

What the makers said

The researchers took their findings to 17 manufacturers and heard back from 14. All 14 said the flows matched their vendor contracts. Seven said owners are responsible for reading and accepting the terms of every third-party service in the car, pre-installed software included. Five blamed web pages opened inside their apps.

The researchers also read the privacy policies for the seven apps that shared identifiers. Each said it may hand personal data to third parties. None said which ones, or why.

Honda is the only maker that changed anything. It asked Amplitude to delete the location data and updated HondaLink to stop sending it, a change a Honda spokesperson confirmed to Northeastern Global News. David Choffnes, a Northeastern professor and a co-author of the study, told the outlet that regulators should step in.

What to do today

Start with the terms. If your car's app lists third-party services, you agreed to them somewhere, probably at a dealership.

Expect a trade-off if you turn collection off. Tesla warns owners who decline its data sharing agreement about "reduced functionality, serious damage, or interoperability." Rivian says switching collection off can limit or disable features such as navigation and over-the-air updates.

And you can skip the idea that a newer car is a cleaner one. Nineteen of 21 cars here sent something to somebody. The model year wasn't the variable. Whether you installed the app was.

• cars
• Consumer Reports
• GM
• Honda
• Northeastern University
• privacy