Researchers at Northeastern University analyzed 21 vehicles from 19 brands and 30 companion smartphone apps between October 2024 and August 2025. The study revealed that 19 of the tested cars and 28 of the apps transmitted data to third-party advertising and analytics firms, often without explicit user awareness.
The data collection involves both vehicle telemetry and personal information. Approximately one-quarter of the examined apps shared personally identifiable data, including owner names, vehicle identification numbers, and precise location history. Specific apps from General Motors, such as myCadillac and myChevrolet, were noted for linking VINs with email addresses or location data.
Vehicles identified as sharing data with a wide range of third parties include the Cadillac Lyriq, Chevrolet Blazer, Lucid Air, Tesla Model 3, and Tesla Cybertruck. Tests conducted in a Faraday enclosure confirmed that some vehicles rerouted data traffic over Wi-Fi when cellular signals were blocked, indicating persistent connectivity.
Data recipients identified in the study include major technology and advertising platforms such as Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo. While some automakers claim contracts prohibit third parties from reselling this information, researchers noted that these contractual limitations are difficult to verify or enforce.
