Modern cars increasingly behave like connected devices: they pair with phones, offer remote controls, receive over-the-air updates and support navigation services. A new study of 21 late-model vehicles and 30 automaker mobile apps suggests that this convenience can also create a substantial privacy burden—particularly through the companion app rather than the vehicle alone.

Researchers examined network traffic from vehicles in a fleet between October 2024 and August 2025. Nineteen of the 21 cars sent data to at least one third party over Wi-Fi. More notably, seven apps transmitted identifiers including vehicle identification numbers (VINs), email addresses or precise location data to advertising and analytics companies. Across the app sample, 28 of 30 apps contacted at least one advertising or analytics company.

The findings do not establish that every recipient misused information, or that every third-party connection was unlawful. They do, however, underline a core problem of connected products: consumers may be able to see a carmaker’s logo when they install an app, but the data path behind that app can involve analytics vendors, advertising technology firms, embedded web pages and other service providers that are much less visible.

Why a VIN is more sensitive than an ordinary app identifier

A VIN is the unique identifier assigned to a vehicle. It is not equivalent to a phone’s advertising ID, which can generally be reset by the user. A VIN is designed to remain linked to the car. When it is paired with information such as an owner’s email address, the combination can make it easier to associate a particular person with a vehicle and potentially connect that person to activity elsewhere online.

That distinction is crucial. “Analytics” can sound benign, often referring to measurement of app reliability, feature usage or crashes. But an identifier that persists and can be connected with personal details gives data considerably more value for profiling than an aggregate count of button presses or anonymous performance telemetry.

Precise location adds another layer of sensitivity. Location information can reveal routines, places visited and patterns of movement. The study found that HondaLink sent VINs and location information to analytics firm Amplitude. Honda subsequently asked Amplitude to delete the location data and updated HondaLink so it would no longer send it.

That response matters because it demonstrates that data flows are not always inevitable technical requirements of a connected-car service. They can be changed when a manufacturer decides a transfer is not appropriate.

GM apps were among those transmitting VINs

Four of the seven apps identified as sharing personal identifiers were General Motors apps: myCadillac, myChevrolet, myBuick and myGMC. Each sent VINs to 10 companies, including Microsoft and Adobe. The reported recipients also included companies such as Pinterest, Snap, Yahoo, Meta, Google and data broker Acxiom.

Related coverage includes Study Examines Third-Party Data Flows From Cars and Automaker Apps.

General Motors is already subject to a 20-year Federal Trade Commission privacy order finalized in January. The order bars GM from selling driver data to consumer reporting agencies for five years and requires express consent before the company collects or shares connected-vehicle data.

There is an important timing limitation: the research examined traffic before that order was finalized, and the researchers did not allege that the observed flows violated it. GM’s position was that it discloses data only to service providers bound by contracts that prevent them from selling the data or using it for their own purposes.

That is a meaningful distinction in legal and contractual terms, but it does not necessarily resolve the user-facing privacy question. A customer deciding whether to use an app is still left to assess whether a long list of third-party transfers is necessary, understandable and proportionate to the features being requested.

The app was often the larger exposure point

One of the study’s most useful observations is that a car’s network behavior and its app’s network behavior can look very different. Ten of the 21 cars did not contact advertising or tracking domains on their own. Yet the associated apps could introduce many more third-party contacts.

The Buick Envista and Nissan Ariya were examples: neither vehicle contacted advertising or tracking domains in the vehicle-level results, but their apps exposed users to 23 and 25 advertising and tracking companies respectively. For most vehicles in the study, the phone app accounted for the majority of advertising-technology exposure.

The Tesla Model 3 went the other direction. The vehicle contacted 22 such companies, while its app added two. The study’s authors cautioned that the total may be higher because they could not decrypt vehicle traffic, and because they could capture only cellular traffic from the Model 3. In plain terms, encrypted traffic prevented the researchers from seeing all of the information that may have been transmitted, so the study should not be read as a complete inventory of every data flow.

That limitation cuts in an important direction: the figures are useful evidence of observed contacts, not a final scorecard of every company’s tracking practices. Still, the scale of app-related connections—28 of 30 apps contacting at least one advertising or analytics company—makes companion apps an obvious place for owners to focus their attention.

What “third party” can mean in a connected-car app

Third-party traffic is not automatically proof that an app is selling data or running an ad campaign. Connected services commonly rely on outside providers for cloud hosting, mapping, error reporting, customer communications, web analytics and software measurement. The concern is less the mere existence of a vendor than the combination of three factors:

  • The type of data: persistent identifiers, email addresses and precise locations are more sensitive than basic diagnostic data.
  • The number of recipients: a larger vendor chain creates more points where data handling matters.
  • The clarity of the disclosure: people need enough specificity to understand what is transferred, to whom and for what purpose.

The researchers reviewed the privacy policies for the seven apps sharing identifiers. All seven said that personal information could be shared with third parties, but none identified precisely which companies would receive it or why. Broad disclosure may satisfy a policy’s general warning function, yet it makes informed choices difficult when an owner cannot tell whether a given transfer supports remote locking, maps, crash diagnosis, audience measurement or something else.

Manufacturers that responded to the researchers said the observed flows matched their vendor contracts. Seven said owners were ultimately responsible for reading and agreeing to terms for third-party services, including pre-installed software. Five attributed the tracking to web pages opened inside their apps.

That explanation points to another practical complication. An app can contain an in-app web view: effectively a web page displayed inside the app interface. Tracking connected to that page may feel indistinguishable from the automaker’s own app to the user, even when it is technically web-based. For an owner, the distinction offers little help unless the app clearly identifies what has opened, what data will be shared and whether the service is optional.

Privacy settings can involve a real feature trade-off

Drivers cannot assume that declining data collection will leave every digital feature intact. Tesla warns that refusing its data-sharing agreement can result in reduced functionality, serious damage or interoperability issues. Rivian says switching off data collection may limit or disable navigation and over-the-air updates.

This is the connected-car privacy dilemma in its clearest form. Data settings may not be a simple choice between “private” and “not private”; they can also determine whether features remain usable. Navigation depends on data, and software updates require a connection. The harder question is whether a manufacturer can separate data genuinely necessary to provide those functions from tracking, measurement or sharing that is not essential to the customer’s requested service.

It is also why consent deserves more scrutiny than a single acceptance screen. If refusing a broad data agreement meaningfully limits important functions, a customer’s choice may be constrained even if a button technically exists.

Practical steps owners can take now

The study is not a reason to panic or to assume a specific car has shared every kind of personal information. It is a reason to treat a vehicle app with the same care as any other connected account—perhaps more care, since it may connect identity, location and a durable vehicle identifier.

  1. Review the car app’s permissions. Check whether precise location access is enabled and consider whether it is needed all the time. Also look for settings related to analytics, personalized services, marketing communications and data sharing.
  2. Read settings as well as the privacy policy. Policies may be broad. In-app menus can sometimes offer more immediate choices about connected services, location, driving data or communications.
  3. Separate essential features from optional ones. Remote climate control, navigation and update delivery may have different data requirements. Disable optional services where the app permits it, but recognize that some opt-outs may limit features.
  4. Be cautious with links and embedded pages in the app. Several manufacturers attributed observed tracking to web pages opened within their applications. Treat an in-app browser page as a web page, not automatically as a purely vehicle-control function.
  5. Ask specific questions before accepting terms. Owners can ask which vendors receive VINs, email addresses or precise location; whether data is used only to operate the requested service; and whether those transfers can be disabled without losing core functions.

The same basic skepticism applies across connected devices. For example, users navigating game-related promotions should be careful about who receives account details and other identifiers; our guide to GTA VI beta scams and fake early-access offers explains why official-looking digital experiences still warrant verification.

What the findings suggest for automakers and regulators

The study’s co-author David Choffnes argued that regulators should intervene. The case for oversight is strengthened by the imbalance between the complexity of modern data systems and the typical buyer’s ability to evaluate them. Few drivers can inspect network traffic, identify embedded trackers or interpret a chain of vendor agreements before using a dashboard app.

At minimum, the results make a case for more specific and accessible disclosure. If a mobile app sends a VIN, email address or precise location to an outside company, owners should be able to learn the recipient, the stated purpose and whether the transfer is required for a selected feature. Clearer controls would also help distinguish service-critical data processing from advertising and analytics activity.

For consumers, the central lesson is simple: the privacy profile of a connected car does not end at the vehicle. The companion app may be the more active participant in third-party data flows, and the identifiers involved can be considerably harder to change than those attached to an ordinary smartphone app.