Connected vehicles and apps share driver data with third parties

A study conducted by Northeastern University and Consumer Reports has revealed that connected vehicles and their official mobile applications are transmitting significant amounts of personal data to third-party companies. Analyzing 21 vehicle models and 30 manufacturer apps, researchers found that 19 of the 21 cars sent data to external companies via wireless connections, while 28 of the 30 apps contacted advertising or analytics firms.

Specific personal information shared includes geographic location, email addresses, and unique vehicle identification numbers (VIN). Because a VIN cannot be reset like a smartphone identifier, researchers warn that data brokers and advertisers can use it to link drivers to their activities across other websites and services. Major technology companies and advertising agencies, including Google, Meta, and Microsoft, were identified among the potential recipients of this data.

The study highlighted several specific apps involved in transferring personal information, including HondaLink, Lincoln, and Nissan apps, as well as four General Motors applications: myCadillac, myChevrolet, myBuick, and myGMC. General Motors has previously faced a restraining order from the U.S. Federal Trade Commission prohibiting the sale of driver data for five years.

In response to the findings, 14 of the 17 manufacturers contacted stated that their data flows comply with existing partner contracts. Some manufacturers argued that responsibility lies with the owners to read terms of use, while others attributed tracking to third-party websites accessed within the apps.