Study finds car data sent to advertisers can identify owners
A Northeastern University study found that many cars and automaker apps sent information to advertising and analytics companies, raising concerns about how easily vehicle data can be linked to individual owners. The researchers say identifiers such as VINs, email addresses and precise locations can reveal activity across apps and websites, and a VIN cannot be reset like a phone advertising ID.
The study monitored 21 late-model cars and 30 automaker apps from October 2024 to August 2025. Nineteen cars contacted at least one third party over Wi-Fi, while 28 apps contacted an advertising or analytics company; seven apps shared identifiers, including four GM apps that sent VINs to 10 companies. The testing took place before the FTC’s January order concerning GM, and the researchers did not allege a breach; Honda later asked its analytics provider to delete location data and updated its app.
- 19 of 21 tested cars sent data to third parties.
- Seven automaker apps passed identifiers such as VINs or locations.
- Honda asked its analytics provider to delete location data.
New here? Start with this
Modern vehicles and their mobile apps continuously collect and transmit data to advertising companies and analytics firms. This includes sensitive identifiers such as Vehicle Identification Numbers, email addresses and precise location data that reveals where vehicles travel and how they are used.
Unlike other forms of digital tracking, vehicle data is particularly effective at pinpointing individuals. A VIN is permanent and registered to a specific owner, meaning that combined with location information and other data points, it can create a permanent link between a person's identity and their movements and behaviours.
Car owners often have minimal visibility into this data collection and little control over where information flows. As vehicles become increasingly connected, questions have been raised about whether drivers fully understand what data is collected and whether existing privacy protections are adequate.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Connected vehicle data collection requires stricter regulation because VINs are permanent, unchangeable identifiers that enable tracking across services when combined with location data, unlike phone IDs that reset. Consumers cannot meaningfully refuse data collection without losing essential features, preventing genuine consent to this tracking. Stronger legal protections are necessary to prevent detailed surveillance of individuals' movements and activities.
The case against
Connected vehicle data collection enables genuine consumer benefits—improved safety, navigation, and personalised features—and the advertising-supported model makes these services affordable. The industry already operates under FTC oversight, companies are demonstrably responding to privacy concerns, and consumers can review terms of service before using connected features. This suggests current accountability mechanisms work effectively rather than requiring new restrictions.
Read the full article at the source →
Originally published by Engadget as “Study finds many new cars share your data with third-party companies”.