More Than Just Location Data
For years, privacy advocates have warned that internet-connected vehicles are becoming data-collection machines on wheels. A recent study by Northeastern University, in partnership with Consumer Reports, has provided concrete evidence, showing just how much
information our cars and their companion apps are broadcasting. Researchers tested 21 vehicles from 19 popular brands and found that many were sharing sensitive data—including location, email addresses, and phone numbers—with third-party companies ranging from data brokers to tech giants like Google, Meta, and Microsoft. The study found that while the data transmitted directly from the cars was often encrypted, the mobile apps that pair with them were a significant source of leakage. In some cases, using an automaker's app nearly doubled a vehicle's exposure to advertising and tracking companies.
What Is a VIN, and Why Does It Matter?
Amidst the flow of location pings and driving habit reports, the transmission of the Vehicle Identification Number (VIN) is a particularly significant finding. A VIN is a unique 17-character code assigned to every vehicle at the factory. Think of it as your car’s fingerprint or social security number. It contains no personal information on its own, but it is a permanent, unchangeable identifier for that specific vehicle. The problem arises when this VIN is transmitted alongside other pieces of data. The Northeastern study found that several automotive apps, including four from General Motors, were bundling the VIN with identifiers like an owner’s email address or precise location data and sending them to analytics and advertising firms.
Connecting the Digital to the Physical
The sharing of a VIN alongside personal data creates a powerful link between a driver's digital and physical life. On its own, anonymous location data is one thing; but when tied to a VIN, it can be easily traced back to a specific car and, by extension, its owner. This allows data brokers and advertising companies to build startlingly detailed profiles. They can connect your driving habits—where you go, how fast you drive, what times you travel—with your online activity, purchase history, and other personal details gathered from different apps and websites. This raises the risk of everything from hyper-targeted advertising to more serious threats like vehicle cloning, targeted theft, and identity fraud. Unlike an advertising ID on a smartphone, a VIN cannot be reset or changed.
Industry Response and Future Outlook
When presented with the findings, automaker responses were mixed. Most stated that their data sharing practices were covered by their vendor contracts and lengthy privacy policies, which customers agree to. However, these policies rarely specify which third parties receive the data or for what purpose. General Motors noted that its contracts prohibit service providers from selling or using the data for their own ends. In a more direct response, Honda instructed its analytics partner to delete the location data it had received and updated its app to stop sending it. Researchers argue that the burden shouldn't be on consumers to decipher vague policies. They advocate for regulators to step in and for an 'opt-in' system for data collection, rather than the current model where opting out can result in losing major vehicle functionality.
