A study analyzing network traffic from 21 connected vehicles and 30 manufacturer apps reveals widespread data transmission to third-party ad-tech companies, exposing how vehicle identifiers and location telemetry are handled.
What data do vehicles and apps collect?
The study, conducted between October 2024 and August 2025, uncovered information-sharing practices from users' vehicles and mobile phones. Specifically, 19 of the 21 cars sent data to at least one external company over a wireless connection. On the other hand, 28 of the 30 apps contacted at least one advertising or analytics company.
Even more concerning was the involvement of seven specific apps that were found to be transferring personal information, such as email addresses, precise locations and unique vehicle identification numbers, to advertising companies. Four of these apps belong to General Motors and include myCadillac, myChevrolet, myBuick and myGMC. General Motors has already faced a restraining order from the United States Federal Trade Commission since January, which bars it from selling driver data for five years.
In addition to General Motors apps, the list includes HondaLink, as well as apps from Lincoln and Nissan. Unlike settings on cell phones, a unique vehicle identification number cannot be reset, meaning advertisers can link the owner to their activity on other apps and websites.
The attitude of the automakers
The researchers contacted 17 manufacturers about the findings and received responses from 14 of them. All companies maintained that the data flow is in accordance with the contracts they have signed with their partners. Seven manufacturers said that the responsibility ultimately lies with the owner, who must read and accept the terms of use of each service, while five attributed the tracking to websites that open within the applications themselves.
The privacy policies of the seven apps that shared personal information said they may transfer data to third parties, but did not specify who those companies were or why they were being transferred. Meanwhile, brands such as Tesla and Rivian warn users that if they refuse to collect data, they will face limitations in the operation or interruption of essential services, such as navigation and system updates.
So far, Honda is the only company to make changes, asking data analytics company Amplitude to delete location data and updating its app to stop sending it.
Top comments (0)