A smartphone displaying a connected-car app beside a car dashboard with GPS and telemetry data visible on screen. Companion apps for connected vehicles transmitted data to outside advertising and analytics companies in a new study by Northeastern University and Consumer Reports.
Accepting the terms on your car’s companion app feels routine, about as consequential as clicking “agree” on a cookie banner. A new study from Northeastern University and Consumer Reports suggests that click may be doing considerably more work than you realize.
Researchers tested 21 late-model vehicles from 19 brands, covering model years 2022 through 2025, along with 30 companion mobile apps. Their goal was to document where connected-car data actually travels, rather than relying on automakers’ privacy disclosures.
What Researchers Actually Found
The study used network-traffic analysis to map data flows between vehicles, companion apps, and outside companies.
Testing used Wi-Fi interception and a Faraday tent to isolate vehicle signals. Researchers then exercised common app functions: remote locking, vehicle locating, and trunk opening.
Most tested vehicles contacted at least one third-party domain over Wi-Fi; more than half contacted domains classified as advertising, tracking, or analytics services. A note on the counts: some summaries report 19 of 21 vehicles contacting third parties; others report all 21. Different reports apply different definitions of third-party domain contact, so the precise figure depends on how researchers classified each communication.
The companion-app findings were more consistent. Twenty-eight of 30 tested apps sent data to at least one outside advertising or analytics company.
Seven apps reportedly transmitted sensitive identifiers, including VINs, email addresses, phone numbers, or precise location data, to third parties associated with advertising or tracking:
- HondaLink
- MyNissan
- Lincoln
- myCadillac, myChevrolet, myBuick, and myGMC
Reported recipients included firms associated with Google, Amazon, Meta, Microsoft, Pinterest, and Reddit, among others. The study also found that pairing a companion app with a vehicle could roughly double your exposure to advertising and tracking companies, according to the researchers.
Why a VIN Plus Your Name Is the Problem
A vehicle identifier becomes a privacy concern when combined with contact details or location data that can link it to a specific person.
A VIN may not identify a person on its own, but it can become personally revealing when combined with an email address, phone number, or precise location. That combination can function like handing someone your loyalty-app ID and your home address at once: each piece is unremarkable alone, but together they connect your vehicle’s activity to existing consumer profiles held by data brokers and marketers. This risk is not unlike what a surveillance app can do when it quietly harvests and shares location data without meaningful user awareness.
Downstream uses, such as insurers setting rates or lenders evaluating risk, are potential outcomes. This study does not establish those consequences on its own.
What researchers did establish is that the data flows exist and that the transmitted identifiers are capable of linking vehicle activity to individual consumers. Honda’s response after reviewing the findings is worth noting: the automaker reportedly instructed analytics vendor Amplitude to delete location data it had received and stopped sending additional location data to that vendor.
What Automakers Say
Automakers acknowledge some third-party data contact but say contractual limits govern what recipients can do with that information.
Automakers told Consumer Reports that external webpages inside companion apps can trigger third-party pixels and cookies. That is a common pattern on the web, but one many drivers would not expect inside a vehicle app.
Several manufacturers said contractual restrictions prevent data recipients from independently selling or using the information. Researchers counter that contractual limits may not prevent unintended collection, pointing to the Amplitude episode as an example.
Automakers describe many connected features as opt-in, but researchers observed that accepting data-sharing terms can be a condition of access to some features. Understanding what “opt-in” actually means in a connected-car context is no longer a niche concern.
Reviewing app permissions before linking a vehicle account is a practical first step to stay safe. The study’s broader implication, attributed to a co-author on the research team, is more sobering: buying a new car with no tracking-related data collection at all may not currently be an option.
