Seven car companion apps sent sensitive information to advertising networks, according to a Northeastern University study conducted in partnership with Consumer Reports. Researchers tested 21 vehicles and 30 apps, uncovering car data privacy concerns that extend beyond the dashboard.
Checking a vehicle’s privacy settings is a reasonable start. The phone app that comes with it deserves the same attention.
What did the researchers uncover
The seven apps were HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC. Every tested vehicle contacted a third-party internet domain over Wi-Fi, though researchers couldn’t read the encrypted contents.
Honda stopped HondaLink’s geolocation transmissions and asked analytics provider Amplitude to delete previously collected location data. That request doesn’t confirm deletion.
A connection alone also doesn’t prove personal information was sold. Keeping that distinction clear helps separate what researchers observed from what remains unknown.
Why does driving data have value
An earlier Consumer Reports investigation, published in March 2025, found widespread collection and sharing of driving behavior data. It reviewed privacy policies and questioned 15 automakers.
Information about braking and acceleration can inform insurance pricing. An ordinary drive can therefore generate records with financial consequences, even when the owner has little visibility into where those records go.
Manufacturers also use driving data to improve safety, complicating the decision to switch collection off. Drivers have to weigh useful functions against uses of their information they’re less comfortable with.
Several automakers told Consumer Reports they sought consent or shared data without identifying details. Most declined to name specific recipients. Reading the privacy policy still might not reveal which companies are getting the information.
What can drivers actually switch off
Start with the automaker’s privacy portal or connected app settings. Consumer Reports distinguishes requests to stop sales or sharing from requests to restrict sensitive information use or delete existing records. Options vary by manufacturer and location.
Check what each setting covers. Stopping future collection doesn’t necessarily erase information already stored, so deletion can require a separate request.
Restricting collection can also affect connected services, including remote locking or roadside assistance. Before confirming a change, check which functions the manufacturer says will stop working. That’s a trade-off worth understanding before discovering it beside a locked car.
