Some connected-car companion apps in a U.S. study sent data to outside advertising or analytics companies, and seven of the 30 tested apps sent at least one identifying detail. That does not show that every car shares personal data, or that every recipient sold or misused it. Researchers could inspect phone-app traffic more directly than the cars’ own encrypted network traffic, so the findings illuminate one part of connected-car data flows—not everything a vehicle may transmit.
What did the study find?
Researchers from Northeastern University and Consumer Reports examined 21 late-model vehicles from 19 brands and 30 automaker companion apps. Consumer Reports described the tested vehicles as model years 2022–2025. The U.S. sample is not a census of cars on the road, and it does not establish that every model, app, or owner has the same experience.
As an Amazon Associate I earn from qualifying purchases.
Consumer Reports reported that 28 of the 30 tested apps sent data to at least one outside advertising or analytics company. Seven apps sent at least one personally identifying detail—such as an owner’s name, a vehicle identification number (VIN), or precise location—to an outside company. The study’s figures are app-level findings; they should not be read as a count of automakers or a finding that all 28 apps sent identifying details. Consumer Reports’ account of the study has the reported counts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Calling this “spying” captures the concern, but the measured conduct is more specific: connected-car systems and companion apps can transmit vehicle or user information to automakers and outside service, analytics, or advertising companies. Transmission to a recipient does not, by itself, prove what that recipient did with the information afterward.
#1 Best Overall
- TRACK ALL VEHICLE MAINTENANCE IN ONE PLACE -Easily record essential services including oil changes, tire rotation/balance, tire replacement, wheel alignment, air and fuel filter changes, brake servicing, spark plugs, transmission checks, wiper blades, batteries, radiator, belts and hoses, and mileage.
- IDEAL A5 SIZE — PORTABLE & PRACTICAL -Convenient 5.8 × 8.3 inch A5 size makes it perfect for glove compartments, toolboxes, or keeping in your vehicle for quick updates after each service.
- DETAILED SERVICE & REPAIR LOG PAGES - Includes structured pages for Date, Time, Mileage, Service Type, and Notes, plus separate sections for "Other Maintenance / Repairs" with space for descriptions and additional work done.
- IMPROVE VEHICLE LONGEVITY & RESALE VALUE - Keeping a written history of maintenance helps prevent costly problems, ensures timely servicing, and increases buyer confidence when selling your vehicle.
- EASY TO USE FOR ALL VEHICLE TYPES - Ideal for cars, trucks, SUVs, motorcycles, and commercial vehicles. Great for personal use, mechanics, fleet owners, and anyone wanting organized service records.
What data was visible, and what could researchers not see?
Companion-app traffic
Researchers decrypted traffic from companion apps on phones they controlled. In some app traffic, they observed VINs, email addresses, names, phone numbers, and location information being sent to outside companies. Northeastern named Adobe Analytics, Axiom, and ContentSquare among frequently contacted entities that received personal information in the study. These are destinations contacted in the test, not proof that any named company independently sold or misused the data.
The researchers said automakers’ privacy policies generally disclosed third-party sharing but did not identify the companies contacted or clearly explain the purposes. A VIN is a stable vehicle identifier; researchers said linking identifiers with information from other websites or apps could enable cross-context tracking or connections to behavioral data and purchase history. That is a stated risk, not a demonstrated outcome for every person whose information was in the tested traffic. Northeastern’s account describes the methods, recipients, and researchers’ concerns.
Vehicle network traffic
The team intercepted or rerouted network traffic from vehicles, but the contents were encrypted and could not be inspected. As a result, the researchers could not establish from that traffic exactly what the vehicles themselves transmitted. The clearest direct findings about personal information in this work concern companion-app traffic, not decrypted contents of the cars’ own transmissions.
Why can car data raise privacy concerns?
Connected features can involve more than vehicle diagnostics. An app or service may handle account details and location alongside information associated with a particular car. Location can reveal routines or visits to sensitive places; how much is collected and who can access it depends on the vehicle, service, settings, and data practices involved.
In a separate matter, the Federal Trade Commission described precise geolocation and driving-behavior information as sensitive in its action involving General Motors and OnStar. That proceeding is distinct from the Northeastern–Consumer Reports study: it concerns allegations and an order specific to GM, not a finding about every automaker or every app.
What did Honda and GM say about data handling?
Northeastern reported that, after researchers presented their findings, Honda asked Amplitude to delete location and VIN data and updated its app to stop sending geolocation data to the company. Honda spokesperson Andrew Quillin said the data was not available for independent use or sale under contract and that using the app was voluntary. Northeastern also quoted a GM spokesperson saying GM’s providers were contractually restricted from selling, sharing, or using information for their own purposes.
Those statements describe the companies’ positions and contractual limits; they do not erase the transfers researchers measured. Settings, app behavior, and company policies may also change, so check the current terms and controls for the particular vehicle and service.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What does the FTC’s GM/OnStar order require?
In January 2026, the FTC finalized an order following allegations that GM used a misleading enrollment process for OnStar and Smart Driver and collected and sold precise location and driving-behavior information without adequate notice and affirmative consent. The order is specific to GM and has defined obligations; it is not a blanket ban on automakers sharing all vehicle data. The FTC’s order announcement describes its terms.
Best Value
- Official Record Book: This hardcover log book is designed to record the purchase, sale, or exchange of new and used motor vehicles.
- Comprehensive Tracking: With 975 vehicle record entries, it allows for meticulous documentation of automotive transactions.
- Durable Construction: The sturdy hardcover binding ensures long-lasting use and protection of important records.
- Convenient Size: Measuring 11.5 x 9.5 inches, this book offers ample space for detailed vehicle information.
- Essential Tool: An indispensable resource for car dealers, ensuring proper documentation and compliance with regulations.
- Five-year restriction: GM is barred from sharing consumers’ geolocation and driver-behavior data with consumer reporting agencies.
- Twenty-year consent requirement: For covered collection, use, or sharing, GM must obtain affirmative express consent, subject to exceptions.
- Consumer controls: The order requires a way for U.S. consumers to request and seek deletion of data, an ability to disable precise location where vehicle technology permits, and an opt-out for geolocation and driving-behavior data subject to limited exceptions.
How can you limit your car’s data collection and sharing?
There is no universal setting that turns off every vehicle-side transmission. Choices and their effects vary by brand, model, app, and service; disabling a connected feature may also affect its functionality. Northeastern’s researchers called for opt-outs that do not substantially reduce vehicle functionality. Consumer Reports offers guidance on limiting car data collection and sharing.
- Review your automaker account and companion app. Look for privacy, data-sharing, location, analytics, and advertising controls. Read what each choice covers rather than assuming it applies to vehicle systems as well as the app.
- Check enrollment and permissions. Review connected-service and driver-monitoring subscriptions, app permissions, and any optional programs you accepted during purchase or setup. Turn off services you do not want where the manufacturer provides that option.
- Ask the manufacturer specific questions. Ask what data is collected from your vehicle and app, which outside recipients receive it, how it is used, whether you can access or delete it, and how to opt out. Ask whether opting out affects particular connected features.
- Recheck after updates or changes. A vehicle software update, app update, new service enrollment, or changed privacy policy can alter available controls or data practices. Confirm the current choices for your own model and account.
How to compare privacy practices across cars
The study does not provide a complete ranked comparison of every vehicle or automaker, so it cannot support a definitive “worst brands” list. When comparing a specific model and model year, use the same questions for each option:
Quick Recap
- What information is collected, and does the claim concern the vehicle, the companion app, or both?
- Which outside recipients receive it, and what purpose does the manufacturer state?
- What contractual limits does the manufacturer say apply to those recipients?
- Can the owner access or request deletion of the data?
- Are controls opt-in or opt-out, and do privacy choices reduce connected features?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
