Connected car study: 28 of 30 car apps share driver data

Most apps that car makers give their customers send data to advertising and analytics companies, a study from Northeastern University and Consumer Reports found. The researchers tested 30 automaker apps, and 28 sent data to at least one outside ad or analytics firm. Seven sent personal details, such as a car's VIN, the owner's name or the car's precise location. That puts the car in the same tracking system as phones and websites, with fewer ways for owners to switch it off.

A VIN, or vehicle identification number, is the code that identifies one specific car. Linked to a name or location, it can tie driving data to a real person.

What the researchers tested

The team studied 21 vehicles from 19 brands, with model years 2022 to 2025, according to the study's project site. They also tested 30 companion apps, the phone apps owners use to unlock, locate or start their cars. The work ran from October 2024 to August 2025 at Consumer Reports' Auto Test Center in Connecticut.

Brands in the test included Tesla, Ford, Toyota, Honda, Nissan, BMW, Mercedes-Benz, Rivian, Lucid, Cadillac, Buick, Lincoln and Land Rover, Auto Connected Car News reports.

The paper is titled "Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem." It is peer reviewed. Nine Northeastern researchers will present it at the ACM Internet Measurement Conference in Karlsruhe, Germany, on October 12-16, 2026.

What the cars and apps sent

The researchers watched the network traffic leaving each car and app to see where it went. The headline results:

Finding	Result
Apps sending data to an ad or analytics company	28 of 30
Apps sending personal details to an outside company	7 of 30
Cars contacting at least one third party over Wi-Fi	19 of 21
Personal data seen	VINs, names, email addresses, phone numbers, precise locations

The cars themselves leaked too. Nineteen of the 21 vehicles contacted at least one third party over Wi-Fi, including known advertising and tracking domains, the project site says.

The data went to familiar names. Consumer Reports lists Amazon, Google, Meta, Microsoft, Pinterest, Snap, Yahoo and Reddit among the recipients. Auto Connected Car News adds Adobe, ContentSquare, LexisNexis Risk Solutions and Verisk Analytics.

Tesla stood out. Its Model 3 and Cybertruck sent data to the most advertising and analytics domains, Consumer Reports found.

How the car makers responded

Several companies said the data they share is limited. General Motors, Honda, Nissan and Stellantis told Consumer Reports that the companies receiving it face restrictions on how they use it.

Honda went further. After the researchers shared their findings, it told its analytics vendor, Amplitude, to delete the location data it had received, Consumer Reports reports.

How the data leaks out

Most of this traffic comes from software development kits, or SDKs. These are ready-made code libraries that app makers add to measure usage, track crashes or show ads. Each kit reports back to the company that made it.

An app developer may add one kit for a single feature. That kit can still collect far more than the feature needs, including identifiers that link back to a person.

What this means for developers

Audit every SDK in your app. List each third-party kit, what it collects and where it sends data. Remove any kit whose job no longer justifies what it collects.

Never send identifiers to analytics. VINs, names, emails and precise locations do not belong in a usage event. Hash or drop them before any third-party code sees them, and round locations to a city or region.

Test your own traffic. The researchers found these leaks by watching what left each device. Run the same check on your app before each release, and compare the destinations with your privacy policy.

Expect more scrutiny of connected cars. A peer-reviewed study with Consumer Reports behind it gives regulators and lawyers named brands and counts. Teams building car, fleet or insurance software should be ready to explain every data flow.

Fleet buyers should ask questions too. Companies running vehicle fleets can ask car makers which outside firms receive data from the car and its app, and how to turn that sharing off.