What the Northeastern Study Uncovered
Researchers at Northeastern University, in partnership with Consumer Reports, recently investigated the data practices of 21 late-model cars and 30 associated manufacturer apps. The findings were startling: 19 of the vehicles sent data to at least one
third-party company over Wi-Fi. The study, titled 'Automatic Transmission', found that automakers' companion apps often amplify this data sharing. Seven of the 30 apps tested were found to be transmitting sensitive information like VINs, email addresses, and even precise locations to advertising and analytics firms. For example, four General Motors apps—myCadillac, myChevrolet, myBuick, and myGMC—sent VINs to as many as 10 different companies, including Microsoft, Adobe, and even Pinterest.
Why Your VIN Is a Big Deal
A Vehicle Identification Number, or VIN, is a unique 17-character code for your car, much like an Aadhaar number is for a person. On its own, it identifies the vehicle's make, model, and manufacturing details. However, when your VIN is transmitted alongside other personal data like your email address or location, it creates a powerful link between you and your vehicle that data brokers and advertisers can exploit. Unlike a password or an advertising ID on your phone, a VIN cannot be reset. This makes it a permanent identifier that allows companies to build a detailed, long-term profile of your habits and movements. This data can be used for targeted advertising or sold to other entities, including insurance companies, potentially affecting your premiums based on driving habits you didn't even know were being monitored.
A Flood of Additional Data
Beyond the VIN, modern connected cars collect a vast amount of other information. A single car can generate up to 25 gigabytes of data every hour. This includes everything from your location history and driving style (like hard braking and acceleration) to your in-car entertainment choices and even data from your synced smartphone, such as contacts and call logs. Systems like GM's OnStar, Toyota's Entune, and Ford's FordPass are designed to collect and transmit this information. The Northeastern study found that using a manufacturer's app can double a car's exposure to tracking companies, with some apps adding over 20 third-party contacts. For most cars tested, the phone app was the primary source of exposure to ad-tech companies.
Where Is This Information Going?
The data from your car doesn't just stay with the manufacturer. The study revealed that information is sent to a wide range of well-known third parties, including big tech companies like Google, Meta (Facebook), Amazon, Snap, and Yahoo, as well as lesser-known data brokers. While automakers often state their contracts prohibit these third parties from reselling or reusing the data for their own purposes, the study's authors noted that such limits are difficult to verify externally. This creates a complex web where personal and vehicle data flows from your car to the manufacturer, and then out to an ecosystem of analytics, advertising, and data brokerage firms, often with little direct transparency for the car owner.
What Can Consumers Do?
Unfortunately, for car owners, the options are limited. The data collection is often buried in lengthy terms and conditions that users agree to when they start their car or use a companion app. Some manufacturers argue it is the owner's responsibility to read and accept the terms for every third-party service, including pre-installed software. However, consumers can take some steps. It is crucial to carefully review the privacy settings in both your vehicle’s infotainment system and its companion app. Limit the permissions you grant the app on your smartphone and think twice before syncing personal information like your contacts. As regulatory bodies like the California Privacy Protection Agency begin to scrutinize these practices, greater awareness is the first step toward demanding more control and transparency over our own data.
