Study finds popular cars and apps quietly feed data to outside firms

Connected vehicles and their apps are sending personal and location data to third parties, raising legal and privacy pressure on automakers and vendors.

Northeastern University and Consumer Reports researchers instrumented 21 late‑model cars and 30 companion apps and found that every vehicle sent data to at least one third‑party domain, with more than half contacting advertising, tracking, or analytics firms. Vehicles running feature‑rich infotainment platforms such as Android Automotive OS with Google Automotive Services hit the largest number of external domains, showing that an automaker’s software stack sharply affects the scale of data sharing. Seven popular companion apps, including HondaLink and several GM and Nissan apps, were observed sending VINs, phone numbers, and precise location data directly to advertising networks, enabling detailed driver profiles to be built. The study follows recent FTC enforcement actions, including penalties against General Motors for selling precise location and driving‑behavior data without proper consent, underscoring mounting legal risk around opaque data collection in connected cars. After being confronted with the findings, Honda asked its analytics vendor Amplitude to delete collected location data and changed its HondaLink app to stop transmitting geolocation, highlighting that vendors may already be moving to tighten data flows once exposed.