Drivers who sync their car to a smartphone app may be handing over more than trip times and tire pressure. New testing on 21 vehicles found that 28 of 30 companion apps sent data to at least one outside advertising or analytics company, and seven apps leaked personally identifiable information such as an owner's name, VIN, or precise location to those outside firms.
The testing, conducted by Northeastern University researchers at Consumer Reports' auto testing facility in Connecticut, examined 21 vehicles and their companion mobile apps. According to Consumer Reports, the top recipients of that driver data included some of the country's largest tech companies: Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo. As News4JAX reports, that kind of vehicle data can be assembled into a detailed dossier about a person — one that could potentially inform decisions made by banks, insurance companies, and pharmaceutical companies.
Four General Motors companion apps, along with HondaLink, MyNissan, and Lincoln's app, were found sharing vehicle identification numbers paired with either email addresses or location data, the testing showed. Several automakers told Consumer Reports that drivers opt in to this kind of sharing and that some apps simply direct users to external websites that can independently collect data.
Honda Moved to Delete Location Records After Being Confronted
After Consumer Reports shared its findings with Honda, the automaker instructed one of its vendors to delete the location data it had received and said it stopped sending that data going forward, per the outlet's report. GM, Honda, Nissan, and Stellantis each told Consumer Reports that some of the outside recipients of driver data are barred from independently using or selling the information they're given.
Not every vehicle behaved the same way in testing. The Cadillac Lyriq, Chevrolet Blazer, Lucid Air, and Tesla's Model 3 and Cybertruck sent data to the largest number of outside advertising and analytics companies among the vehicles tested, the same report notes. Connected apps from BMW, General Motors brands, and Toyota contacted the largest number of outside companies overall, according to Scripps News. On the other end, the Mercedes-Benz EQS, Land Rover Range Rover, and Buick Envista generated no advertising or tracking traffic at all during the test, though they still reached out to other outside domains, per AutoConnectedCar.com.
Companion Apps Roughly Double a Car's Exposure
Northeastern's research team, which posted its own project findings online, found that pairing a companion app roughly doubled a vehicle's average exposure to advertising and tracking companies, and in some cases added more than 20 new ones. The Northeastern University research team also reported that 19 of 21 vehicles contacted at least one third party over Wi-Fi, including known advertising networks.
The Verge also found that more than 70 percent of the tested companion apps contacted at least five unique advertising, tracking, or analytics domains. The Northeastern researchers were careful to frame their work as a limited sample rather than a verdict on the entire auto industry, cautioning that the results should be interpreted as a snapshot in time that may not generalize to vehicles outside the tested group or outside the U.S.
What Drivers Can Actually Do About It
Surveys cited in the reporting show many consumers tend to accept terms and conditions without reading them closely, which Consumer Reports says makes it easy to miss what a car's app is set up to share. The organization advises reading those terms before agreeing, turning off location sharing in the app when possible, and checking the automaker's website or connected app for an option to opt out of data sharing or delete stored data.
Those fixes come with tradeoffs. Opting out of data sharing could mean losing connected features such as roadside assistance, and some automakers only accept opt-out requests from drivers in states that have passed privacy laws. California passed the first such law, and more than a dozen other states have since followed with privacy statutes of their own. Consumer Reports, a nonprofit that refuses traditional advertising, says the gap in state laws leaves many drivers elsewhere with fewer formal tools to push back.
