New cars pass VINs to ad firms, and owners cannot reset them
Une étude de Northeastern University sur 21 voitures et 30 applications constructeur montre que VIN, e-mails et positions atteignent des régies publicitaires.
By
Declan Moriarty
In brief
- Northeastern University tested 21 late-model cars and 30 automaker apps on Consumer Reports’ fleet.
- Seven apps passed VINs, emails or precise locations to advertising and analytics companies.
- Honda has asked Amplitude to delete location data and has updated HondaLink.
- General Motors says it shares data only with contractually restricted service providers.
Yes, a new car can hand your data to advertising companies, and in most cases the leak runs through the automaker’s phone app rather than the vehicle itself. That is the picture from a Northeastern University study, which Engadget reported in October 2026.
What the researchers tested
Researchers looked at 21 recent-model vehicles plus 30 manufacturer apps drawn from the Consumer Reports fleet, and the tests ran between October 2024 and August 2025. Over Wi-Fi, 19 of the vehicles transmitted information to a minimum of one outside firm. Seven apps handed over identifiers, among them VINs, email addresses and exact locations, to advertising and analytics businesses.
The per-vehicle summary from Consumer Reports adds a nuance: on their own, 10 of the 21 vehicles never reached out to any advertising or tracking domain. Most of the exposure originated in the apps.
Which brands and apps stood out
Apps from General Motors transmitted VINs to Pinterest, Snap, Yahoo, Meta, Google and Acxiom, a data broker. Four of the seven apps came from GM: myCadillac, myChevrolet, myBuick and myGMC. Each one shared VINs with 10 companies, including Microsoft and Adobe. The analytics company Amplitude received both VINs and location from HondaLink, while the Lincoln and MyNISSAN apps rounded out the seven.
| Vehicle or app | What the testing found |
|---|---|
| Buick Envista (with app) | Car alone contacted no ad domains; pairing its app exposed owners to 23 ad and tracking companies |
| Nissan Ariya (with app) | Car alone contacted none; with the app, 25 companies |
| Tesla Model 3 | 22 ad and tracking companies from the car, two more through the app |
| HondaLink | VINs and location sent to Amplitude |
The Tesla figure is probably a floor. Researchers could not decrypt vehicle traffic and captured only cellular data from the Model 3, so the real totals for such cars are likely higher.
Why a VIN makes the sharing stickier
A phone’s advertising ID can be reset. A vehicle identification number cannot, and once it is paired with an email address, ad companies can tie an owner to activity in other apps and on websites.
Refusing carries a cost. Tesla warns drivers who reject its data sharing agreement about “reduced functionality, serious damage, or interoperability”, and Rivian states that turning off collection will restrict or disable functions like navigation and over-the-air updates. The privacy policy of each of the seven apps states that personal data could be given to outside parties, yet none explains who they are or the reason.
How carmakers and regulators responded
- Manufacturers: the researchers contacted 17 and received replies from 14. Every one of them stated that the data transfers were consistent with their contracts with vendors. Seven added that owners are responsible for reading and agreeing to the terms of each outside service, pre-installed software included, and five pointed to web pages loaded within their apps.
- General Motors: it told Northeastern Global News that it discloses data only to service providers contractually barred from selling it or using it for their own purposes.
- The FTC: in January it completed an order against GM that prohibits the company from selling driver data to consumer reporting agencies for five years and demands explicit consent prior to any collection or sharing of connected vehicle data. Since that point, GM has been bound by an FTC privacy order lasting 20 years. The tests came before the order, and the researchers do not claim any breach occurred.
- Honda: a Honda spokesperson told Northeastern Global News that the company requested Amplitude erase the location data and modified HondaLink so it no longer transmits it.
David Choffnes, a professor at Northeastern and co-author of the study, said to the outlet that regulators ought to intervene. The study documents data arriving at advertising and analytics firms; it does not reveal how those firms used it, and it does not prove any intent on the part of the automakers.
Photo: William Hadley / Pexels
