General Motors apps sent vehicle identification numbers to advertising and analytics companies, a Northeastern University study found, while seven automaker apps shared identifiers including emails and precise locations.
Researchers tested 21 late-model vehicles and 30 automaker apps in Consumer Reports’ fleet between October 2024 and August 2025. Nineteen vehicles sent data to at least one third-party company through Wi-Fi.
GM’s myCadillac, myChevrolet, myBuick and myGMC each sent VINs to 10 companies. Recipients included Pinterest, Snap, Yahoo, Meta, Google, Acxiom, Microsoft and Adobe, the study found.
HondaLink sent VINs and location data to analytics firm Amplitude. Lincoln and MyNISSAN completed the list of seven apps sharing identifiers with advertising or analytics companies.
Unlike a phone advertising ID, a VIN cannot be reset. Paired with an email address, it allows advertising companies to connect an owner to activity across other apps and websites.
Consumer Reports’ per-vehicle summary showed that 10 vehicles independently contacted no advertising or tracking domains. These included the Buick Envista and Nissan Ariya, but pairing them with their apps exposed owners to 23 and 25 advertising and tracking companies, respectively.
Tesla’s Model 3 contacted 22 such companies directly, while its app contacted two more. For most tested vehicles, most advertising-technology exposure came through the phone app; 28 of 30 apps contacted at least one advertising or analytics company, according to Consumer Reports.
Researchers could not decrypt vehicle traffic and could capture cellular data only from the Model 3. Actual totals may therefore be higher.
The Federal Trade Commission finalized a 20-year privacy order against GM in January over its driver-data sharing. It prohibits sales of driver data to consumer reporting agencies for five years and requires express consent before collecting or sharing connected-vehicle data.
The testing preceded the order, and researchers did not allege a violation. GM told Northeastern Global News it discloses data only to service providers contractually barred from selling it or using it for their own purposes.
Fourteen of 17 manufacturers approached responded, all saying the data flows matched vendor contracts. Seven said owners were responsible for accepting every third-party service’s terms, including preinstalled software; five attributed tracking to web pages opened within apps.
Researchers found that all seven identifier-sharing apps’ privacy policies disclosed possible personal-data sharing with third parties, without identifying recipients or explaining why.
Tesla warns owners declining its data-sharing agreement of “reduced functionality, serious damage, or interoperability.” Rivian says disabling collection will limit or disable navigation and over-the-air updates, among other features.
Honda asked Amplitude to delete location data and updated HondaLink to stop sending it, a spokesperson confirmed to Northeastern Global News.
Northeastern professor and study co-author David Choffnes told Northeastern Global News that regulators should intervene.
Featured image credit
