What Did the Study Actually Find?
Researchers at Northeastern University, in partnership with Consumer Reports, investigated 21 modern vehicles and 30 of their companion smartphone apps. The findings were alarming: 19 of the cars transmitted data over Wi-Fi to at least one third-party
company. More concerningly, seven of the 30 apps sent sensitive personal information—like Vehicle Identification Numbers (VINs), email addresses, phone numbers, and even precise locations—directly to advertising, tracking, and analytics companies. The study highlights that once you pair your phone's app with your car, your exposure to data trackers can double on average. This means companies that have nothing to do with your car's operation could be receiving information about you.
What Kind of Data Are We Talking About?
The data collected is extensive. It includes basic identifiers like your name and email, but also granular details about your driving habits such as acceleration patterns, braking, speed, and the routes you take. Some car apps were found sharing a driver’s VIN, a unique identifier for a car that, unlike a phone's advertising ID, cannot be reset. When a VIN is paired with personal details like an email address, it allows data brokers and advertisers to build a detailed and permanent profile of a car owner, linking their driving habits with their online behaviour and purchase history. The study identified four General Motors apps (myCadillac, myChevrolet, myBuick, and myGMC), along with HondaLink and MyNISSAN, among those sharing VINs with other companies.
Who Are These 'Third Parties'?
The data isn't just going back to the car manufacturer. The study found information being sent to a wide array of third parties, including major tech giants like Google, Meta (Facebook), Microsoft, and Amazon. It also includes lesser-known but powerful data brokers like Acxiom and analytics firms such as Adobe Analytics and ContentSquare. While automakers often state in their privacy policies that they may share data, they rarely specify with whom or for what purpose, leaving consumers in the dark. Many manufacturers defended the practice by stating the data flows were in line with their vendor contracts and that it's the user's responsibility to accept the terms of service for all third-party software in the car.
The Real-World Risks for Indian Drivers
While the Northeastern study was conducted in the US, its implications are global and highly relevant for India, one of the world's largest automotive markets. The number of connected cars from brands like Hyundai, Kia, and MG is rapidly growing across the country. These vehicles, often marketed for their convenience and tech features, function as rolling data ecosystems. The data they collect—from real-time location and driving patterns to in-cabin information—is considered personal data under India's Digital Personal Data Protection Act (DPDP Act). This law requires companies to obtain clear consent before collecting and processing such information. The risk is that this data could be used for more than just navigation; it could be sold to data brokers or influence your car insurance premiums, sometimes without your explicit knowledge.
What Can You Do to Protect Your Privacy?
Complete privacy in a modern car is difficult, but you can take steps to manage your data. Start by reviewing the privacy settings in both your car's infotainment system and its companion app. Look for any options related to data sharing, telematics, or marketing and opt out where possible. Be cautious about the permissions you grant the car's app on your smartphone. Under India's DPDP Act, you have the right to access, correct, and erase your data. You can file a privacy request with the car manufacturer to see what information they have collected. Ultimately, the most powerful tool is awareness. Understanding that your car is a data collection device allows you to make more informed decisions about how you use its connected features, balancing convenience with your right to privacy.
