AIBRIEF
Car companion apps, not the cars, share driver data with ad networks: seven of 30 tested apps sent names, VINs (vehicle identification numbers), and locations to third parties, with Tesla and GM vehicles linked to the most.
Your car's companion app is the part talking to advertising networks, not the car itself. A new Northeastern University and Consumer Reports project found that seven of 30 tested car apps transmitted identifying details like names, vehicle identification numbers, and precise locations to third parties linked to advertising and tracking, while the vehicles' own cloud payloads stayed encrypted.
The team ran controlled tests on 21 U.S.-market vehicles and 30 companion apps between October 2024 and August 2025. They decrypted app traffic using test iPhones and mitmproxy, and report that 19 of 21 vehicles contacted at least one third party over Wi-Fi. Adding a companion app roughly doubled the number of advertising and tracking companies a driver's phone reached.
Downstream recipients named in the data flows include Amazon, Google, Meta, and Microsoft. Tesla and General Motors vehicles connected to the most outside firms. The researchers, led by Northeastern computer scientist David Choffnes, accepted every iOS permission request during testing, so the figures describe a default-consent sample, not a worst case.
Honda, told of its app's data flow, asked analytics vendor Amplitude to delete collected location data and updated HondaLink to stop transmitting geolocation. Honda and GM both said their contracts bar independent sale or use of driver data by providers.
The leverage for drivers sits in the app settings: trim permissions, decline ad and analytics toggles, and treat the companion app as a data-sharing app in its own right.