Your car is sharing data with some of the biggest technology companies in the world, and your phone is helping it do so. A study by Northeastern University and Consumer Reports tested 21 late-model vehicles and 30 companion apps and found that 19 of the cars sent data to outside companies. Twenty-eight of the 30 apps contacted at least one advertising or analytics firm. The findings show how much car data now flows out of the driveway and into the hands of firms the driver never chose to deal with.
Car data reaches advertisers and brokers
The car data sent by seven of the apps can identify a person: a name, a vehicle identification number or a precise location. Four of those seven belong to General Motors: myCadillac, myChevrolet, myBuick and myGMC. Each of the four sent vehicle identification numbers to 10 companies, including Microsoft and Adobe. HondaLink sent vehicle identification numbers and location data to the analytics firm Amplitude. The Lincoln and MyNissan apps made up the rest of the list.
The car data reached Amazon, Google, Meta, Microsoft, Pinterest, Snap and Yahoo, along with the data broker Acxiom. More than 70 percent of the apps tested contacted at least five separate analytics domains. For most of the cars, the bulk of the exposure came through the phone app rather than the vehicle itself. Ten of the 21 cars contacted no advertising or tracking domains on their own, according to a per-vehicle summary from Consumer Reports, which means the app was often the wider leak.
Car data rules remain thin
General Motors is already under a 20-year privacy order from the Federal Trade Commission, in place since January. The order bans the company from selling driver data for five years to consumer reporting agencies and requires express consent before it collects or shares connected vehicle data. The researchers tested the cars before the order took effect, and they have not alleged a breach of it. General Motors told Northeastern that it only discloses data to service providers that are contractually barred from selling it or using it for their own purposes. The case shows how slowly the rules around car data have moved.
Tesla’s cars showed the widest reach. The Model 3 sent car data to 22 advertising and tracking companies from the car itself, and its app added two more. The researchers could not decrypt all of the vehicle traffic and could only capture cellular data from the Model 3, so the real totals for Tesla are likely to be higher. Some vehicle traffic is encrypted, so the researchers could not see every data stream. Honda acted after the researchers flagged the problem. The company told a vendor that had received location data to delete the information and stopped sending it.
Car data and the limits of consent
David Choffnes, the project lead and a former director of Northeastern’s Cybersecurity and Privacy Institute, said the car data flowing from modern vehicles is extensive. The team tested the cars between October 2024 and August 2025, running them while parked, while driving and, for electric models, sealed inside a Faraday tent that forced data through Wi-Fi. Every vehicle sent data to at least one outside domain. Several apps sent vehicle identification numbers together with an email address or location, which makes it easier to match a car to profiles held by data brokers. The vehicles came from 19 brands, and the apps covered 30 companion programs.
The study leaves drivers with little they can do on their own. The sharing happens inside apps and systems that come with the car, and the settings that might stop it are buried or absent. Consumer Reports published the findings in October, and the groups behind the work say the fix has to come from the car makers and from rules with real teeth. Until then, the car keeps talking, and the companies listening are not the ones that built it.