A study conducted by Northeastern University has found that many new cars share data with external companies, often without the owner's knowledge or consent. The study tested 30 applications from car manufacturers and 21 new cars from Consumer Reports' fleet between October 2024 and August 2025. The results showed that 19 cars sent data to at least one external company via Wi-Fi, while seven applications shared identifiers such as Vehicle Identification Numbers (VINs) and email addresses with advertising and analytics companies.
The study found that General Motors' applications, including myCadillac, myChevrolet, myBuick, and myGMC, sent VINs to 10 companies, including Microsoft and Adobe. Similarly, Honda's HondaLink application shared VINs and location data with analytics company Amplitude. Other car manufacturers, such as Lincoln and Nissan, also shared data with external companies. The study's findings raise concerns about the potential for this data to be used for targeted advertising or other purposes.
The study's authors noted that VINs are unique identifiers that cannot be reset, making it possible for companies to link owners to their online activities. According to Consumer Reports, 10 cars out of 21 did not connect to any advertising or tracking domains directly. However, some cars, such as the Buick Envista and Nissan Ariya, exposed owners to data being transferred to 23 and 25 advertising and tracking companies, respectively, through their applications.
Tesla's Model 3 connected directly with 22 companies, while its accompanying application added two more. The study's authors believe that the actual number of companies receiving data may be higher, as they were unable to decipher the car's data transmission. Most cars' exposure to advertising technologies was due to the applications, with 28 out of 30 applications communicating with at least one advertising or analytics company.
Car manufacturers have responded to the study's findings, stating that they only disclose data to contractually bound service providers who are prohibited from selling or using it for their own purposes. General Motors, for example, noted that it is subject to a 20-year privacy order from the Federal Trade Commission (FTC) and has taken steps to ensure compliance. Other manufacturers, such as Honda, have also responded to the study's findings by making changes to their data collection practices.
The study's authors believe that regulatory bodies need to intervene to address the issue of car manufacturers sharing data with external companies. David Choffnes, a professor at Northeastern University and one of the study's participants, stated that the current situation requires regulatory attention to protect consumers' privacy. The study's findings highlight the need for greater transparency and control over data collection and sharing in the automotive industry.
The study's results have implications for car owners and policymakers. As the automotive industry continues to evolve, it is essential to ensure that car manufacturers prioritize data protection and transparency. By understanding the scope of data sharing and the potential risks involved, consumers can make informed decisions about their vehicles and data. Ultimately, the study's findings emphasize the need for a more comprehensive approach to data protection in the automotive industry.
Key points
- Car manufacturers often share data with external companies, raising concerns about privacy.
- The study found that 19 cars sent data to at least one external company via Wi-Fi.
- Regulatory bodies may need to intervene to address the issue of car manufacturers sharing data with external companies.
