Study finds many new cars share data with third-party companies
A Northeastern University study of 21 late-model cars and 30 automaker apps found 19 cars sent data to at least one third-party company and 28 apps contacted an advertising or analytics company, with some sharing VINs, email addresses and precise locations. Four GM apps sent VINs to 10 companies, and Honda later asked Amplitude to delete location data.
Nineteen of the 21 cars sent data to at least one third-party company over Wi-Fi. Seven of the 30 apps passed identifiers such as VINs, email addresses and precise locations to advertising and analytics companies. Four of those seven apps belong to General Motors: myCadillac, myChevrolet, myBuick and myGMC. Each sent VINs to 10 companies, including Microsoft and Adobe, and GM apps were also sending VINs to Pinterest, Snap, Yahoo, Meta, Google and the data broker Acxiom, the study found. HondaLink sent VINs and location data to the analytics firm Amplitude. The Lincoln and MyNISSAN apps made up the rest of the group. A VIN cannot be reset like a phone advertising ID, so pairing it with an email address can allow ad companies to tie an owner to activity on other apps and websites.
Consumer Reports' per-vehicle summary found that 10 of the 21 cars contacted no advertising or tracking domains on their own. The Buick Envista and Nissan Ariya were among them, but pairing those cars with their apps exposed owners to 23 and 25 ad and tracking companies, respectively. Tesla moved in the opposite direction: the Model 3 reached 22 such companies from the car, while its app added two. Because the team could not decrypt vehicle traffic and could only capture cellular data from the Model 3, the real totals for these cars are likely higher. For most of the cars tested, the bulk of ad-tech exposure came from the phone app. Twenty-eight of the 30 apps contacted at least one advertising or analytics company, according to Consumer Reports.
Automakers pointed to vendor contracts and privacy policies. GM has been under a 20-year FTC privacy order since January. In January, the FTC finalized GM's punishment over its driver data sharing scandal. The order bans GM from selling driver data for five years to consumer reporting agencies and requires GM to receive express consent before it collects or shares connected vehicle data. Northeastern's testing predates that order, and the researchers have not alleged a breach of it. GM told Northeastern Global News that it only discloses data to service providers that are contractually barred from selling or using it for their own purposes.
The researchers approached 17 manufacturers with their findings and heard back from 14. All 14 said the data flows matched their vendor contracts. Seven said it is ultimately the owner's responsibility to read and accept the terms for every third-party service in the car, including pre-installed software. Five attributed the tracking to web pages opened inside their apps. The researchers also read the privacy policies of the seven apps that shared identifiers. Each policy disclosed that the app may pass personal data to third parties, without saying which companies or why.
Owners who decline Tesla's data sharing agreement are warned of reduced functionality, serious damage, or interoperability, according to the report. Rivian says that switching off data collection will limit or disable features such as navigation and over-the-air updates. Honda appears to be the only automaker willing to change anything: it asked Amplitude to delete the location data and updated HondaLink to stop sending it, a Honda spokesperson confirmed to Northeastern Global News. Northeastern professor and study co-author David Choffnes told the outlet that regulators should step in.