Widespread Data Sharing Across the Automotive Industry
New research from Northeastern University academics and the nonprofit Consumer Reports shows that 19 out of 21 major automobile manufacturers studied collect and broadly disseminate personal data gathered from connected vehicles. The findings, unveiled on Tuesday, highlight how data flows from cars to companion apps and then to third-party companies involved in advertising and analytics.
While concerns about connected car privacy have been raised before — including a 2024 warning from the Federal Trade Commission — this study provides detailed evidence of how personal information moves through a complex ecosystem of corporations.
Apps Transmit Data to Dozens of Third Parties
According to the report, 28 out of 30 connected car apps examined shared data with at least one third-party advertising or analytics firm. More troublingly, seven of those apps transmitted at least one piece of personally identifiable information — such as the vehicle owner’s name, email address, or precise geolocation — to external companies.
Specific examples include companion apps from General Motors (myCadillac, myChevrolet, myBuick, and myGMC), as well as apps from Honda, Nissan, and Lincoln, which were found to share Vehicle Identification Numbers (VINs) combined with location data or email addresses. This combination allows data brokers to easily track individual driving patterns and sell that information.
Regulatory Action and Industry Response
In May, California Attorney General Rob Bonta and the California Privacy Protection Agency (CPPA), together with four local prosecutors, fined General Motors over $12 million and ordered the company to cease sharing driver data with credit reporting agencies and data brokers for five years.
The data shared by automakers extends to dozens of major technology companies, including Google’s parent company Alphabet, Amazon, Microsoft, Meta, Reddit, and Pinterest. Consumer Reports noted that many of these firms operate both as software providers and as operators of advertising auction platforms used by marketers to target consumers.
"As such, the companies that collect driver data are often the first node in a vast personal data ecosystem."
Following notification of the findings by Consumer Reports, Honda instructed a digital data analytics and tracking vendor it works with to delete all previously ingested location data and cease sharing it with third parties.
Data Flow Through Embedded Links and Opt-In Claims
Several automakers told Consumer Reports that links embedded in their connected apps lead to external webpages, enabling third-party firms to place cookies and tracking pixels on those pages. As a result, these websites can collect consumer data without the driver’s knowledge or explicit consent.
While automakers often defend data sharing practices by stating they are opt-in only, Consumer Reports argues that drivers frequently do not understand what they are agreeing to. Some manufacturers have reportedly warned customers that opting out could render certain vehicle functions inoperable.
The organization also noted that many automakers claimed the third parties receiving the data are contractually barred from independently using or selling it — though enforcement and transparency of such restrictions remain unclear.
"The findings underscore the immense personal data ecosystem that American consumers are unwittingly drawn into when they purchase and use everyday consumer products, including autos."
As of the report’s release, none of the automakers named in the study had immediately responded to requests for comment.
Source: The Record