Study Finds Connected Cars and Their Apps Funnel Driver Data to Ad and Tracking Firms

The conclusion that driving data is collected and shared is not new. Numerous investigations and lawsuits have already documented how such data reaches third parties, including insurance companies. What the new study adds is a measure of scale and of how difficult the practice is for a consumer to avoid without giving up the vehicle or features such as remote start and remote unlock.

The researchers tested 21 late-model vehicles from 17 automakers, among them General Motors brands Cadillac and Chevrolet, plus Ford, Lucid, Rivian, Tesla and Toyota. They also examined 30 companion mobile apps to assess what the study describes as the privacy implications of the connected vehicle ecosystem. TechCrunch reported that the peer-reviewed study will be published this week.

Data flowed to companies including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo. Seven of the 30 apps passed on sensitive information, including vehicle identification numbers, email addresses, phone numbers and precise location, to third-party companies associated with tracking and advertising.

In many cases more than one form of information went to the same third party, an arrangement the researchers say lets advertisers and data brokers assemble detailed consumer profiles. Those profiles are difficult for consumers to escape because they are sold to a range of businesses, including insurers and banks. Pairing a companion app to a vehicle roughly doubled the exposure to advertising and tracking companies, the study found.

The researchers shared the findings with the automakers involved. According to the researchers, all of the manufacturers except Honda deflected responsibility elsewhere, often toward consumers. Honda responded by changing its data collection practices after being told of the results and directed its vendor Amplitude to delete all geolocation data it had received. Consumer Reports said several automakers told it that some links inside their companion apps open outside webpages, which may carry cookies that collect customer data. The study states that however the data was gathered, drivers were not informed.

【Editor's Summary】A Northeastern University study conducted with Consumer Reports found that 19 of 21 late-model vehicles sent data to at least one third party and that seven of 30 companion apps shared VINs, emails, phone numbers and precise location with tracking and advertising companies. Most automakers contacted about the findings shifted responsibility to other parties or to consumers, while Honda changed its collection practices and told vendor Amplitude to delete geolocation data it had received. The study adds detail on how widely connected-vehicle data is distributed and how little drivers are told about it.