Study finds car apps share drivers’ data with advertising and analytics firms

Researchers at Northeastern University tested data traffic from 21 cars and 30 automaker apps between October 2024 and August 2025.

They found that 19 cars sent data to at least one outside company, and 28 apps contacted an advertising or analytics company.

Seven apps sent identifiers such as vehicle identification numbers, email addresses or precise locations to those companies.

The study found that phone apps were the main source of advertising-related data sharing for most cars tested.

A vehicle identification number cannot be reset, so linking it to an email address could help companies connect a car owner’s identity with activity on other apps and websites.

The researchers could not decrypt vehicle traffic, and they captured cellular data only from the Tesla Model 3, so the amounts of data shared may be higher than their findings show.

The testing took place before a January FTC order requiring GM to get express consent before collecting or sharing connected-vehicle data, and the researchers did not allege that GM broke the order; Honda said it asked its analytics provider to delete location data and updated its app to stop sending it.