Study Finds Most Car Apps Leak Sensitive Data to Data Brokers and Big Tech

The study examined connected car apps and vehicles. It found 28 of 30 connected mobile apps sent data to at least one outside advertising and/or analytics company. Seven sent at least one piece of personally identifiable information—the owner's name, the car's VIN, or its precise geographic location—to at least one outside company. Consumer Reports said nearly every automaker sent data to outside companies, and almost a quarter of vehicle apps sent personally identifiable information including names, VINs and precise locations.

The top recipients of driver data were some of the largest U.S. tech companies, including Amazon, Google, Meta, Microsoft, Pinterest, Snap and Yahoo, Consumer Reports said. The report said these firms are often providers of connected apps in car infotainment systems and also operate advertising auction platforms used by third-party marketers. Data sent with VINs and another identifier, such as an email address or full name, can allow advertising firms to link drivers to commercially available consumer profiles that often include online behavior and shopping history.

Consumer Reports warned that the data could be sold to brokers and linked to other information, creating risks of stalking, identity theft, medical fraud and other crimes if leaked or hacked. Sarah Elizabeth Gillespie, a co-author of the study, said, "It does not appear that a customer can buy a new car that does not track you."

Some automakers said their data-sharing terms could be opted out of, but Consumer Reports noted that doing so could severely restrict use of the vehicle. Tesla's data-sharing agreement says opting out "may result in your vehicle suffering from reduced functionality, serious damage, or inoperability." Tesla was among the worst offenders: the Tesla Model 3 connected to 34 advertising, tracking or analytics domains, while the Cybertruck connected to 23, the researchers found.

Several carmakers have been fined for carrying out these practices without clearly informing users, according to the report. Consumer Reports said the findings underscore the immense personal data ecosystem that American consumers are unwittingly drawn into when they buy and use everyday products, including automobiles.