For years, experts have known that newer cars track driving habits and share the data with outside companies. Those companies may use it for marketing, insurance rates, or loan offers. Regulators have fined automakers for not disclosing this clearly, and some have been sued.
The team from Northeastern University tested 21 vehicles and 30 automaker apps. Nearly every automaker sent data to outside companies. Almost a quarter of the apps sent personal details, including owners’ names, vehicle identification numbers, and exact locations. This lets companies match driving habits to personal profiles sold by data brokers to banks, insurers, and retailers.
Top recipients included Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo.
Researchers placed the cars inside a Faraday tent, which blocks electromagnetic signals, to isolate data traffic. Most test cars were electric, spanning mainstream and luxury brands from model years 2022 through 2025.
Several automakers said some data recipients are barred from using or selling what they receive. But researchers found those rules do not always hold. After seeing the findings, Honda told its vendor Amplitude to delete all location data it had collected and stopped sending more.
Automakers also said many apps and services are opt-in. However, some features will not work without agreeing, and some cars cannot be driven at all. Tesla owners who decline the data-sharing agreement see this warning: “This may result in your vehicle suffering from reduced functionality, serious damage, or inoperability.”
Researchers note most people accept terms without reading them.
Of the vehicles tested, 28 of 30 connected apps sent data to at least one outside advertising or analytics company. Seven sent personal information such as a name, VIN, or exact location. Four GM apps, myCadillac, myChevrolet, myBuick, and myGMC, plus HondaLink, MyNissan, and Lincoln, shared VINs with email addresses or location data.
Many large US tech firms received driver data, including Alphabet, Amazon, Meta, Microsoft, Pinterest, and Reddit. These companies often supply software, like Android Automotive, and run ad auction platforms.
The cars that sent data to the most outside companies were the Cadillac Lyriq, Chevrolet Blazer, Lucid Air, Tesla Model 3, and Tesla Cybertruck. Apps from BMW, GM brands, and Toyota contacted the most outside companies.
The most alarming finding, researchers say, is that some cars and apps shared both a VIN and another identifier, like a name or email. With those two pieces, a large ad or tech company can link an owner to commercial profiles sold by data brokers.