Automakers routinely share personally identifiable connected-car data with third parties, report says

New research shows that most vehicle manufacturers share personal data collected by connected cars with advertisers, several big tech companies and data brokers, revealing fresh details about how consumers are exposed to a web of large corporations participating in the advertising ecosystem.

Northeastern University academics and the nonprofit Consumer Reports unveiled the findings Tuesday, revealing that 19 of 21 major auto manufacturers studied collect and broadly disseminate customers’ private data. 

While it has long been known that connected cars’ are privacy invasive — the Federal Trade Commission warned automakers to step carefully in 2024 — the study provides new evidence documenting how data moves from individuals’ cars to vehicle apps they download at point of sale and from there to third-party companies.

Twenty-eight of 30 car connected apps shared data with at least one third-party advertising or analytics firm, the report said. 

Seven of 30 apps sent at least one piece of personally identifiable data — car owners’ names, email addresses and precise geolocations — to at least one outside company, Consumer Reports said in an online post.

Additionally, researchers said, four General Motors’ (GM) companion apps — myCadillac, myChevrolet, myBuick, and myGMC — along with Honda, Nissan and Lincoln apps, share VINs packaged with either location data or email addresses, allowing data brokers to easily identify individuals’ driving patterns and sell it.

In May, California Attorney General Rob Bonta and the California Privacy Protection Agency (CPPA), alongside four local prosecutors, fined GM more than $12 million and ordered it to stop sharing driver data with credit reporting agencies and data brokers for five years.

The automakers shared the data with advertisers and analytics firms as well as dozens of tech giants, including Google’s Alphabet, Amazon, Microsoft, Meta, Reddit and Pinterest, Consumer Reports said.

“Many of these companies play two roles in the driver data ecosystem, as both providers of software … and as operators of advertising ‘auction’ platforms that marketers use to target specific types of customers,” the press release said. “As such, the companies that collect driver data are often the first node in a vast personal data ecosystem.”

None of the automakers named here immediately responded to a request for comment. 

However, after being notified about the findings by Consumer Reports, the press release said, Honda directed a digital data analytics and tracking vendor it works with to wipe all ingested location data and no longer share it with third parties.

Several car manufacturers told Consumer Reports that links embedded in their connected apps lead to external webpages, allowing third-party firms to place cookies and pixels, according to the press release. As a result, the release said, the web pages can collect consumer data, typically without the driver knowing.

Many automakers also told Consumer Reports that some of the third-party companies the data is fed to are barred from “independently using or selling” it.

While car companies defended the practices by pointing out that the data sharing is opt-in only, Consumer Reports argues that drivers often don’t know what they are agreeing to and that some automakers warn customers their vehicles may be inoperable if they opt-out.

“The findings underscore the immense personal data ecosystem that American consumers are unwittingly drawn into when they purchase and use everyday consumer products, including autos,” the press release said.