Your Car May Be Sending Your Data to Third Parties

Northeastern University research reveals that many new cars transfer user data to third-party companies.

A comprehensive study conducted by Northeastern University reveals that we face a serious privacy problem regarding user data of new cars on the market. The tests, conducted between October 2024 and August 2025, reveal in detail how modern vehicles and automobile manufacturers' mobile applications process personal information.

Examinations conducted on 21 different vehicles and 30 automobile applications within the scope of the research proved that 19 vehicles sent data to at least one third-party company over Wi-Fi connection. Specifically, seven applications; It transfers data such as vehicle identification number (VIN), e-mail address and precise location information to advertising and analysis companies.

Data Sharing by General Motors and Other Manufacturers

It was determined that General Motors' myCadillac, myChevrolet, myBuick and myGMC applications transmitted VIN numbers to 10 different companies, including Microsoft and Adobe. The HondaLink application shares VIN and location information with analysis firm Amplitude.

The fact that VIN numbers, unlike advertising IDs on phones, cannot be reset, allows this data to be used for long-term tracking. This allows advertising companies to match users across different applications and websites.

According to Consumer Reports data, 28 out of 30 apps communicate with at least one advertising or analytics company. It seems that in most vehicles, data transfer to ad technology companies occurs through the installed mobile application rather than the vehicle itself.

Automobile Manufacturers' Defense and Regulations

The researchers shared their findings with 17 automakers and received responses from 14 of them. Manufacturers argue that their data streams are compatible with existing supplier contracts and that users are responsible for agreeing to the terms of third-party services within the tool.

Some manufacturers state that tracking is caused by web pages opened within applications. While some brands, such as Tesla, warn users who refuse the data sharing agreement about loss of functionality, Rivian states that disabling data collection will restrict features such as navigation.

Honda confirmed that it had updated the HondaLink app by requesting Amplitude to delete location data. Northeastern University professor David Choffnes emphasizes that this situation requires the intervention of regulatory agencies.

The research reveals that the interaction of automobile applications with advertising technology companies is more intense than the vehicles' own data traffic. How acceptable do you think it is for automakers to share user data in this way, in terms of personal privacy?