← Back to Feed

Your car’s app could be telling Big Tech who you are and where you go

September 30, 2026 · Malwarebytes · Severity: MEDIUM

This article reports on a study by Northeastern University and Consumer Reports that tested 21 cars and their companion apps, revealing widespread connections to advertising and tracking companies. The research found that some apps shared sensitive personal data, highlighting the privacy costs of modern vehicle connectivity and the difficulty drivers face in opting out. 📌 **Analyst Note:** This study underscores the urgent need for regulatory oversight of automotive data practices, as consumers unknowingly surrender vast amounts of personal information. Security teams should monitor for data leakage from connected vehicle ecosystems and advocate for stronger privacy protections in aut

A study testing 21 cars from 19 brands and 30 companion apps found connections to advertising and tracking companies, and evidence that some apps shared sensitive personal data.

Modern cars can unlock remotely, route around traffic, stream entertainment, summon roadside help, and cool or heat the cabin before you get in. But those conveniences come with a privacy cost that drivers may struggle to see and are unable to refuse.

We’ve covered cars and privacy a few times before, especially after Mozilla researchers described cars as a “privacy nightmare.”

Texas Attorney General Ken Paxton investigated car manufacturers seeking details of their data collection and sharing practices, and sued General Motors over allegations that it sold customer driving data to third parties.

Researchers from Northeastern University, working with Consumer Reports, tested vehicles from model years 2022 through 2025 and companion apps, observing network traffic while cars were stationary, driven, and used through their apps. The results reinforce an uncomfortable reality: connected vehicles are data-collection platforms on wheels.

The results in a nutshell:

  • Both vehicles and companion apps contacted third-party domains, including those associated with advertising and tracking.
  • 19 of 21 vehicles contacted at least one third party over Wi-Fi.
  • 7 of 30 apps transmitted sensitive identifiers to third parties associated with advertising and tracking.

The troubling part is not that a car talks to its manufacturer. After all, a connected vehicle needs some network access for safety alerts, navigation, account functions, and maintenance. The bigger issue is the potential combination of identifiers. A vehicle identification number (VIN) can link a particular vehicle to its owner, while precise location can reveal highly sensitive patterns: where someone sleeps, works, worships, seeks medical care, spends time with friends, or travels. Add an email address or a name, and that information can be easier to connect to the detailed consumer profiles held by advertisers and data brokers.

And that’s before considering the privacy concerns around cameras that monitor drivers’ faces for signs of distraction or impairment.

Consent is a weak safeguard when drivers have to accept extensive terms to use functions advertised as part of the vehicle. Several manufacturers said their connected services were opt-in, but declining can mean losing useful functionality. For example, Consumer Reports noted a Tesla warning that refusing its agreement may result in:

“reduced functionality, serious damage, or inoperability.”

That hardly sounds like freely given, informed consent.

There was one sign that scrutiny can matter: after researchers presented their findings, Honda told Consumer Reports it had directed vendor Amplitude to delete location data it received and stopped sending it going forward. But consumers should not need an academic study to discover who their car or its app is sharing data with.

Especially when Amazon, Google, Meta, and Microsoft—companies that already know plenty about us—were among the leading recipients of the driver data.

Until automakers collect less data and provide clear privacy settings, meaningful opt-outs, and deletion controls, drivers should treat a connected car, and especially its companion app, as another privacy-sensitive device. Review app permissions, turn off optional data-sharing settings, avoid linking unnecessary accounts, and ask manufacturers what data they retain, share, and delete.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Key Takeaways

  • A study of 21 vehicles from 19 brands found that both cars and their companion apps routinely connect to third-party domains associated with advertising and tracking, raising serious privacy concerns for drivers.
  • Researchers observed that some companion apps shared sensitive personal data, including location and driving habits, with data brokers and advertising networks without clear user consent or transparency.
  • The findings reinforce that modern connected vehicles function as data-collection platforms, and drivers face significant challenges in understanding and controlling how their personal information is collected and shared.
☕ Buy a Coffee