ProductIndependently confirmed2 publishers2 min readPublished
Seven automaker apps sent identifiers such as VINs and emails to ad firms, Northeastern found
Northeastern University researchers found 19 of 21 tested cars sent data to at least one third-party company over Wi-Fi. Teams that review only the vehicle miss most of it, since for most cars the ad-tech traffic came from the phone app.
The Product Desk
Bar chart of ad and tracking companies reached. Buick Envista via its app: 23. Nissan Ariya via its app: 25. Tesla Model 3 from the car: 22. Tesla Model 3 via its app: 2. The Envista and Ariya contacted no ad domains on their own.
Ad and tracking companies reached, Consumer Reports per-vehicle summary In companies
| Item | Value | Claim |
|---|---|---|
| Buick Envista, via app | 23 companies | 18 |
| Nissan Ariya, via app | 25 companies | 18 |
| Tesla Model 3, from car | 22 companies | 19 |
| Tesla Model 3, via app | 2 companies | 19 |
What happened
- Four of the seven apps are GM's, and each sent vehicle identification numbers to 10 companies including Microsoft and Adobe.
- HondaLink sent VINs and location to the analytics firm Amplitude, and the Lincoln and MyNISSAN apps make up the rest of the seven.
- Consumer Reports' summary shows 28 of the 30 apps contacted at least one advertising or analytics company.
- The researchers approached 17 manufacturers. Of the 14 that responded, each said the data flows were consistent with its contracts with vendors.
- Honda asked Amplitude to delete the location data and updated HondaLink to stop sending it, a spokesperson confirmed to Northeastern Global News.
Why it matters
- exposure Owners can reset a phone's advertising ID but not a VIN. An ad firm holding a VIN and an email address has a stable way to tie that owner to activity on other apps and websites.
- contradiction Automakers point to contracts and owner consent, yet the seven privacy policies the researchers read say only that data may go to unnamed third parties.
- constraint Declining has a stated price. Tesla warns of "reduced functionality, serious damage, or interoperability," and Rivian says navigation and over-the-air updates would be limited or disabled.
- precedent The FTC's January order against GM requires express consent before sharing connected vehicle data. It is the nearest reference for what a regulator would ask of any other maker's app.
The recipients of GM's VINs in the study included Pinterest, Snap, Yahoo, Meta, Google and the data broker Acxiom [5]. Across most of the cars tested, the phone app was the main source of ad-tech exposure [21].
Of the 21 cars, 11 contacted ad or tracking domains on their own [25], and 10 did not [17]. The Buick Envista and Nissan Ariya were among the 10, and pairing their apps exposed owners to 23 and 25 ad and tracking companies [18]. The Model 3 went the other way. It reached 22 such companies from the car, its app added two, and that makes 24 [19][26]. The Ariya's app figure is already above that. The researchers could not decrypt vehicle traffic and captured only cellular data from the Model 3, so the real totals are likely higher [20].
The automakers' replies describe a different product. Of the 17 manufacturers approached, three did not reply [24]. Seven said owners are ultimately responsible for reading and accepting the terms of each third-party service in the vehicle, pre-installed software included, and five attributed the tracking to web pages opened inside their apps [12]. GM told Northeastern Global News that it discloses data only to service providers that are contractually barred from selling it or using it for their own purposes [22]. Northeastern's testing predates the FTC order, and the researchers have not alleged a breach of it [10]. David Choffnes, a Northeastern professor and co-author of the study, told the outlet regulators should intervene [23].
For the team rolling out a connected-vehicle app on Monday, we'd sort every outbound call from the app into a two-by-two. One axis is whether the user can reset the identifier being sent. The other is whether the recipient also gets an email address or a precise location. The seven apps in the study sit in the corner with both: a fixed identifier plus contact or location data [3]. For each call in that corner, someone should be able to write one sentence on what the owner gets back, and we'd cut any call where that sentence cannot be written. The tradeoff is concrete: the vendor loses its join key, and the team loses whatever cross-app reporting depended on it. A call that sends only a resettable ID can wait for the next review.
What to watch
- Whether any maker besides Honda changes its app after the findings; Honda is the only one reported to have done so.
- Whether a retest of GM's apps after the January FTC order shows the same VIN flows, since Northeastern's capture predates it.
- Whether regulators act on David Choffnes's call to step in.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap−10
- Incentives55
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Northeastern University's study tested 21 late-model cars and 30 automaker apps on Consumer Reports' fleet between October 2024 and August 2025.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [2]
Nineteen of the 21 cars sent data to at least one third-party company via Wi-Fi.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [3]
Seven of the apps passed identifiers like VINs, email addresses and precise locations to advertising and analytics companies.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [4]
Four of the seven apps belong to GM (myCadillac, myChevrolet, myBuick and myGMC), and each sent VINs to 10 companies including Microsoft and Adobe.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [5]
GM's apps sent VINs to Pinterest, Snap, Yahoo, Meta, Google and the data broker Acxiom.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [6]
HondaLink sent VINs and location to the analytics firm Amplitude, with the Lincoln and MyNISSAN apps making up the remainder of the seven.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [7]
Unlike a phone's advertising ID, a VIN cannot be reset, so pairing one with an email address lets ad companies tie an owner to activity on other apps and websites.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [8]
According to Consumer Reports, 28 of the 30 apps contacted at least one advertising or analytics company.
ReportedSupportedSource: Consumer Reports, via Engadget2 sources— create a free account to open themView cited source - [9]
The FTC finalized its order against GM in January, a 20-year privacy order that bans GM from selling driver data to consumer reporting agencies for five years and requires express consent before it collects or shares connected vehicle data.
ReportedSupportedSource: Engadget, reporting on the FTC order2 sources— create a free account to open themView cited source - [10]
Northeastern's testing predates the FTC order against GM, and the researchers have not alleged a breach of it.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [11]
The researchers approached 17 manufacturers with their findings and heard back from 14, all of which said the data flows matched their vendor contracts.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [12]
Seven manufacturers said it is ultimately the owner's responsibility to read and accept the terms for every third-party service in the car, including pre-installed software, while five attributed the tracking to web pages opened inside their apps.
ReportedSupportedSource: Engadget, reporting on the manufacturers' replies to the researchers2 sources— create a free account to open themView cited source - [13]
The researchers read the privacy policies of the seven apps that shared identifiers and found that each disclosed it may pass personal data to third parties, without saying which ones or why.
ReportedSupportedSource: Engadget, reporting on the Northeastern University study2 sources— create a free account to open themView cited source - [14]
Owners who decline Tesla's data sharing agreement are warned of "reduced functionality, serious damage, or interoperability."
ReportedSupportedSource: Engadget, quoting the Tesla warning2 sources— create a free account to open themView cited source - [15]
Rivian says that switching off data collection will limit or disable features like navigation and over-the-air updates.
ReportedSupportedSource: Engadget, reporting on Rivian's stated policy2 sources— create a free account to open themView cited source - [16]
Honda asked Amplitude to delete the location data and updated HondaLink to stop sending it, which a Honda spokesperson confirmed to Northeastern Global News; Engadget describes Honda as the only maker that seems willing to change anything.
ReportedSupportedSource: Honda spokesperson to Northeastern Global News, via Engadget2 sources— create a free account to open themView cited source - [17]
According to Consumer Reports' per-vehicle summary, 10 of the 21 cars contacted no advertising or tracking domains on their own.
- [18]
The Buick Envista and Nissan Ariya were among the 10 cars that contacted no ad domains themselves, yet pairing their apps exposed owners to 23 and 25 ad and tracking companies respectively.
- [19]
The Tesla Model 3 reached 22 ad and tracking companies from the car while its app added two.
- [20]
The team could not decrypt vehicle traffic and could only capture cellular data from the Model 3, so the cars' real totals are likely to be higher.
- [21]
For most of the cars tested, the bulk of the ad-tech exposure came from the phone app.
- [22]
GM told Northeastern Global News that it only discloses data to service providers that are contractually barred from selling or using it for their own purposes.
- [23]
Northeastern professor and study co-author David Choffnes told Northeastern Global News that regulators should step in.
- [24]
Three of the 17 manufacturers approached did not reply.
- [25]
Eleven of the 21 cars contacted advertising or tracking domains on their own.
- [26]
The Model 3's combined car-plus-app total is at least 24 ad and tracking companies.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toCars and their apps are sending drivers' personal data to advertising companies
1 article · October 11, 2026
- engadget.comStudy finds many new cars share your data with third-party companies
1 article · October 11, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.