You open your automaker’s app to check whether you locked the car. In the background, that routine tap may be secretly tracking users by contacting advertising servers at Google, Meta, or a data brokerage firm you have never heard of. That is the central finding of a new investigation by Northeastern University and Consumer Reports, which examined 30 companion apps tied to 21 vehicles from 19 brands.
The investigation found that some tested apps transmitted data capable of identifying a specific vehicle or its owner. The VIN at the center of those transmissions cannot be reset the way a cookie can.
What the Researchers Found
Nearly every app tested sent data to outside advertising or analytics companies, and several transmitted information that could identify you or your vehicle.
Twenty-eight of the 30 apps contacted at least one external advertising or analytics company. Seven of those apps went further, sending personally identifying information: a driver’s name, a vehicle identification number, or precise geographic location to outside parties. The apps identified as transmitting that sensitive information were HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC. The four GM-branded apps also shared VINs alongside email addresses or location data.
More than 70% of the tested apps contacted at least five separate tracking or analytics domains, according to Consumer Reports. The recipient list includes major names across the digital advertising industry: Google, Meta, Microsoft, Snap, Adobe, Amazon, Pinterest, Yahoo, and Reddit. The broader pattern mirrors how a surveillance app can be used to covertly harvest data from unsuspecting users.
The investigation documented what left the apps and where network traffic was directed. It does not establish that every named company used the data for a specific advertising campaign or built profiles from it.
Why a VIN Is Not Like a Cookie
This identifier follows the vehicle for life, and you cannot clear it the way you would a browser’s tracking history.
A VIN is a permanent, vehicle-specific number assigned at manufacture. Unlike an advertising ID on your phone, which can typically be reset through your device settings, a VIN stays attached to the car indefinitely. When an app transmits that identifier alongside an email address or precise location, it creates a durable link between a specific vehicle and an identifiable person.
Researchers noted that the combination can allow data brokers to construct detailed profiles. Those profiles may include where a vehicle is parked overnight, where it travels during work hours, and which destinations appear repeatedly. That is an implication of the data combination the investigation documented, not a confirmed outcome for every named recipient.
What You Can Actually Do About It
Deleting the app is a start, but it is not a complete solution.
Removing an automaker’s app from your phone may reduce some phone-based transmissions. It does not address data collected by the vehicle itself, dealership systems, usage-based insurance programs, or other connected services. Controls vary significantly by brand and by jurisdiction.
Reviewing your automaker’s privacy settings and connected-services account options is the practical first step. Look specifically for data-sharing preferences, location permissions, and any opt-out mechanisms tied to your account. Readers looking to stay safe from adjacent device-level risks may find additional guidance useful as well.
The connected-car ecosystem now operates inside the same advertising and data infrastructure that governs websites and smartphones. The critical difference is the identifier at the center of it. You can delete an app, reset an ad ID, or clear your cookies. You cannot reset your VIN.
