Modern Cars Are Sharing Your Personal Data With Third Parties

Ender Öztürk

October 12, 2026

A comprehensive study conducted by Northeastern University between October 2024 and August 2025 has exposed significant privacy risks regarding how modern automobiles and their associated mobile applications handle user data. By analyzing 21 vehicles and 30 proprietary apps, researchers discovered that 19 of the tested cars transmit sensitive information to third-party entities via Wi-Fi connections. This investigation highlights that personal identifiers, such as Vehicle Identification Numbers (VINs), email addresses, and precise geolocation data, are frequently harvested by advertising and analytics firms, posing a substantial threat to the digital security of vehicle owners across the globe.

Data Sharing Practices Involve Major Automotive Manufacturers

The investigation revealed that General Motors applications, including myCadillac, myChevrolet, myBuick, and myGMC, transmit VIN data to at least 10 different companies, such as Microsoft and Adobe. Furthermore, the HondaLink application has been identified as sharing both VIN and precise location data with the analytics firm Amplitude. Unlike mobile advertising identifiers that can be reset by users, VINs are permanent and immutable. This makes them highly valuable for long-term tracking purposes, allowing advertising networks to create persistent profiles by linking user activities across various platforms and websites.

Mobile Applications Drive Most Data Collection Activities

Consumer Reports data indicates that 28 out of 30 analyzed automotive applications actively engage with at least one external advertising or data analytics firm. The study clarifies that the majority of this data exfiltration occurs through the mobile applications installed on smartphones rather than originating directly from the car’s internal hardware. While many users believe their vehicle’s infotainment system is the primary point of data collection, the mobile app ecosystem serves as the primary conduit for sharing sensitive information with the broader data broker market.

Automotive Manufacturers Defend Their Privacy Policies

In response to the findings shared by researchers, 14 out of 17 contacted manufacturers provided statements. Most companies argue that their data-sharing activities are fully compliant with existing supplier contracts. They maintain that users bear the responsibility for reviewing and accepting the terms and conditions associated with third-party services integrated into their vehicles. Some manufacturers have attempted to deflect the blame by citing that data collection often stems from web pages accessed through in-app browsers.

Regulatory Oversight Is Becoming Necessary

The industry response to these findings varies significantly. For instance, Tesla has warned users that declining data-sharing agreements may lead to a loss of vehicle functionality, while Rivian has indicated that disabling data collection could restrict access to critical navigation features. In a positive development, Honda confirmed an update to its HondaLink app, which included a request for Amplitude to delete previously collected location data. David Choffnes, a professor at Northeastern University, emphasizes that these systemic issues require immediate intervention from regulatory bodies to protect consumer rights. As the intensity of data traffic between vehicle apps and advertising technology firms continues to grow, it is evident that current self-regulation is insufficient.

Given the increasing reliance on connected technology in modern vehicles, how do you feel about your car sharing personal data with third-party advertisers? We invite you to share your thoughts and privacy concerns in the comments section below.