Car App Data Sharing Investigation

A new study found that most late-model cars contacted outside companies over Wi-Fi, and that several automaker apps sent vehicle identification numbers to advertising and analytics firms. Contact our data privacy lawyers to learn more about auto data tracking and about your legal options.

About the Car App Data Sharing Study

Northeastern University researchers tested 21 vehicles and 30 companion apps with Consumer Reports, which published the findings on September 29, 2026. The team connected each vehicle to a custom Wi-Fi access point and logged outgoing traffic.

They drove the cars, simulated hard braking, and used every app feature, including locating the vehicle. They also parked cars inside a Faraday tent to block cellular signals. The models ranged from 2022 to 2025. Because encryption hid the contents of vehicle traffic, researchers could see which companies a car contacted but not always what it sent.

What Did the Study Find?

Nineteen of the 21 vehicles contacted at least one third party. Twenty-eight of the 30 apps contacted at least one advertising or analytics company. Seven apps went further and sent personal identifiers, according to the report.

• The myCadillac, myChevrolet, myBuick and myGMC apps sent VINs to multiple outside companies.
• HondaLink sent a VIN and precise location to the analytics firm Amplitude.
• The MyNISSAN and Lincoln apps also shared VINs.

Researchers say when a company receives a VIN with an email address or location, it may be able to link an owner to activity on other apps and websites. The researchers called that pairing their most worrisome finding.

How Automakers Responded

Several automakers describe their services as opt-in, but consumers may still ask whether the disclosures were clear and whether consent was meaningful. Consumer Reports reported that Tesla shows owners who decline data sharing a warning of reduced functionality.

Depending on the facts and the state, these questions can implicate consumer protection and privacy statutes. Each case turns on what a company collected and shared.

The research team contacted 17 manufacturers, and 14 responded. All 14 said the data flows matched their vendor contracts. Seven said owners must read and accept the terms of third-party services, and five blamed web pages that open inside their apps.

General Motors told Northeastern Global News that it discloses data only to service providers whose contracts bar them from selling it or using it for their own purposes. Honda asked Amplitude to delete the location data and updated its app.

These findings are reported months after the Federal Trade Commission finalized an order against General Motors over its driver data practices. The January 2026 order bars GM from sharing certain data with consumer reporting agencies for five years and requires express consent before it collects or shares connected vehicle data. Northeastern’s testing predates that order, and the researchers have not alleged a breach.

Why hire The Lyon Firm

The Lyon Firm handles a range of data misuse and privacy cases for clients nationwide. Joseph Lyon has represented consumers for more than two decades, and courts have appointed the firm to leadership roles in large class actions. The firm investigates how car companies collect and share personal data, and it reviews each case on its own facts.

Owners who suspect a company shared their data without clear consent can document what they see before they speak with an attorney.

• Take screenshots of consent screens, privacy settings, and app permissions.
• Note when you installed each app and which accounts you linked.
• Save emails or notices from the automaker about data practices.

If you use a connected car or a manufacturer’s app and believe a company mishandled your information, contact The Lyon Firm for a free and confidential consultation. Call (513) 381-2333 for a free consultation.

This article is reporting findings from published studies and does not allege that any named company acted unlawfully. Companies named have not been found liable in connection with the study.