Popular cars have been sending sensitive information about their customers via invasive companion apps. Some major names on the list include GM, Honda, Nissan, and several others.
A new study found that some automaker apps sent sensitive identifiers such as VINs, email addresses, and precise location data to advertising and analytics companies.
Researchers from Northeastern University tested 21 late-model vehicles and 30 automaker apps using Consumer Reports’ fleet between October 2024 and August 2025.
Honda Says It Made Changes
Honda appears to have taken the clearest action after being contacted by researchers.
The company asked Amplitude to delete the location data it had received and updated HondaLink to stop sending it.
Other manufacturers largely defended the existing arrangements by pointing to contractual restrictions on how vendors are allowed to use the information.
Data Sent to Microsoft and Adobe
Seven apps were found sending identifiers to advertising or analytics firms.
Four of those belonged to General Motors: myCadillac, myChevrolet, myBuick and myGMC.
According to the study, each of those GM apps sent vehicle identification numbers to 10 companies, including firms such as Microsoft and Adobe.
Other apps flagged in the study included HondaLink, Lincoln and MyNISSAN.
HondaLink reportedly sent both VIN and location data to analytics company Amplitude.
VINs Are More Sensitive Than Advertising IDs
A major concern is that a VIN cannot simply be reset like a phone’s advertising identifier.
When a VIN is combined with an email address or other personal information, it can potentially allow advertising companies to link a specific vehicle owner with activity across other apps and websites.
That makes vehicle identifiers particularly sensitive from a privacy perspective.
Apps Were Often the Bigger Source of Tracking
Consumer Reports’ vehicle-level summary found that 10 of the 21 cars contacted no advertising or tracking domains on their own.
However, companion apps still exposed users to a large number of third parties.
For example, the Buick Envista and Nissan Ariya reportedly contacted no ad or tracking domains directly from the vehicle, but their associated apps connected to 23 and 25 companies, respectively.
Tesla showed the opposite pattern. The Model 3 contacted 22 advertising or tracking companies from the vehicle itself, while its app added another two.
Researchers also noted that the true numbers could be higher because they could not decrypt all vehicle traffic, and cellular data could only be captured from the Model 3.
Overall, 28 of the 30 apps tested contacted at least one advertising or analytics company.
Automakers Point to Privacy Policies
Researchers contacted 17 manufacturers and received responses from 14. All 14 said the observed data flows were consistent with existing vendor agreements.
Seven manufacturers said owners are responsible for reviewing and accepting the terms of third-party services included in their vehicles, while five said some tracking originated from web pages opened inside their apps.
Researchers also reviewed the privacy policies of the seven apps that shared identifiers.
All of them disclosed that personal information could be shared with third parties, but the policies generally did not clearly identify which companies would receive the data or why.
GM’s FTC Order Came Later
The study period is important. Most of the testing took place before the FTC finalized a 20-year privacy order against GM in January, following a separate controversy over driver-data sharing.
That order includes restrictions on selling driver data to consumer reporting agencies and requires GM to obtain consent before collecting or sharing certain connected-vehicle information.
The Northeastern researchers did not allege that GM violated that order, because their testing largely predates it.
The findings nevertheless add to growing concerns over how much personal data modern vehicles and their companion apps collect, where that information goes, and whether drivers fully understand what they are agreeing to.
The post These Popular Cars Were Exposing Your Sensitive Data With Companion Apps appeared first on ProPakistani.
