Study finds many new cars share your data with third-party companies

Researchers captured network traffic from 21 late‑model vehicles and their companion apps between October 2024 and August 2025. Nineteen cars sent data to at least one third‑party via Wi‑Fi, and seven apps—including GM’s myCadillac, myChevrolet, myBuick and myGMC—forwarded immutable VINs, email addresses and location data to as many as ten external companies such as Microsoft, Adobe, Snap, Yahoo, Meta, Google and data broker Acxiom. HondaLink disclosed VINs and GPS coordinates to Amplitude, while Lincoln and MyNISSAN apps also shared identifiers. Even when a vehicle’s own telematics stayed silent—e.g., the Buick Envista and Nissan Ariya—its smartphone app linked the owner to 23‑25 ad‑tech firms. Tesla’s Model 3 generated contact with 22 trackers from the car itself, plus two more from its app, suggesting the true exposure could be higher because the study could not decrypt in‑vehicle traffic. Overall, 28 of the 30 apps reached at least one advertising or analytics domain, underscoring how the mobile interface, rather than the car’s built‑in systems, becomes the primary conduit for data leakage.

These findings sit at the intersection of two accelerating trends: automakers treating connected services as a revenue stream and regulators tightening privacy oversight. GM is already operating under a 20‑year FTC consent order that bars it from selling driver data for five years and requires explicit permission before any sharing. The study’s data were collected before that order took effect, and GM insists its service partners are contractually prohibited from resale. Nonetheless, the company’s four apps still dispatched VINs to a broad set of third parties, a practice mirrored by most OEMs who point to vendor contracts and privacy policies that vaguely acknowledge “possible sharing” without naming recipients. Honda is the only brand that responded by pulling location data from Amplitude and updating HondaLink, while Tesla and Rivian warn that opting out could cripple navigation, over‑the‑air updates, or even vehicle safety functions. The pattern reveals a market where the line between essential vehicle operation and ancillary advertising is blurred, and where consumer consent is often reduced to a checkbox buried in a lengthy terms‑of‑service agreement.

Regulators may soon move beyond consent orders to enforce stricter transparency and data‑minimization rules, especially as VINs cannot be reset and can be fused with online identifiers to build persistent profiles. Watch for FTC or state‑level actions that could compel OEMs to disclose exact third‑party recipients and to provide a genuine opt‑out that does not degrade core functionality. Automakers may also redesign app architectures to route telemetry through first‑party servers or to anonymize identifiers before external handoff. Consumers, meanwhile, should scrutinize app permissions and consider using firewalls or VPNs on their phones to block unwanted outbound calls.