Your car knows where you drive, how fast you go and where you park. A new study shows that some of what it knows leaves the car — and ends up with advertising companies.
What the researchers found
Researchers at Northeastern University, working with the consumer organisation Consumer Reports, tested 21 cars from 19 brands, built between 2022 and 2025. They also tested the 30 phone apps that belong to those cars — the ones people install to unlock the doors remotely or check a service history.
Each car went inside a tent that blocks mobile phone signals, connected to a Wi-Fi network the researchers controlled, so they could watch what it tried to send. All but two of the 21 cars contacted at least one outside company that way.
The phone apps were worse. Twenty-eight of the 30 sent information to an advertising or analytics company — firms whose business is building a picture of who you are. Seven passed on something that identifies you personally: your name, the car’s identity number, or the exact place it was parked.
Those seven were four General Motors apps — myCadillac, myChevrolet, myBuick and myGMC — plus HondaLink, MyNissan and Lincoln. The biggest receivers of driver data included Amazon, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.
One car stood out. The Tesla Model 3 contacted 34 advertising and tracking companies, more than any other vehicle tested. Two others, the Mercedes-Benz EQS and the Buick Envista, contacted none.
Why this matters to you
The part that matters most is the car’s identity number, or VIN. It is the 17-character code on a small plate at the bottom of the windscreen. On a phone you can reset the advertising ID that apps use to recognise you. A VIN is fixed for life.
When a company receives a VIN together with your email address or the place you parked, it can link the car to a profile of you that already exists. Those profiles are sold to banks, insurers, lenders and retailers, which is how the same information turns into a particular loan offer or insurance quote.
And it is not only the car. Adding the maker’s phone app roughly doubled the number of companies that could see a driver’s data.
What you can actually do
Nothing here needs a computer. The switches are in two places: the car and the app on your phone.
- Open the maker’s app on your phone and find the privacy or data settings. Turn off anything about sharing driving data, vehicle data or location with partners.
- In the car, open Settings and look for Privacy, Data or Connected Services. Turn off location sharing and data sharing where you can.
- If you never use the remote features — unlocking, heating, finding the car in a car park — delete the app. That closes one of the two doors.
- Use a separate email address for the car app. The pairing the researchers found most troubling was the car’s identity number plus a personal email address; keeping the two apart makes that match harder.
- Ask for your data. Under European privacy law you can write to a company and ask what it holds about you and to delete it, and the car maker has to answer. Consumer Reports publishes example letters for this request.
- Before buying, ask to see the privacy terms and what happens if you decline. Tesla’s warning to a driver who refuses says it “may result in your vehicle suffering from reduced functionality, serious damage, or inoperability”.
Three things people get wrong
Myth: it is only about advertising
Advertising is the visible part. The same profiles are the raw material for insurance offers, loan terms and credit decisions. What looks like an advertising problem is often a pricing problem.
Myth: I never agreed to this
You almost certainly did, in the terms accepted when the car app was set up — often at the dealership rather than by you. The problem is not that nobody consented, but that the terms never say which companies get the data or what they do with it.
Myth: switching off location in the car is enough
It helps, and it is worth doing. But the phone app is a separate path, and in this study it was the busier one. Switch off both.
What to watch for next
The full paper will be presented at the ACM Internet Measurement Conference in Karlsruhe, Germany, from 12 to 16 October. It is the first study to follow the data from the car, through the phone app, to the companies that end up holding it.
Regulators are already moving. In May 2026, California’s attorney general and privacy agency reached a $12.75 million settlement with General Motors over the sale of driving data, the largest penalty of its kind in the state, and a five-year ban on selling it.
One car maker changed course after the researchers showed it what its app was sending: Honda ordered its advertising partner to delete the location data it had received and stopped sending more. The researchers’ main demand is simple — companies should ask before they collect, and saying no should not break the car.
The one thing to remember
Every new car is a computer that reports on you. One of the study’s authors put it plainly: it no longer appears possible to buy a new car that does not track you.
You still hold two switches — the app on your phone and the privacy menu in the car. Turning both off takes a few minutes and closes the easiest path your driving data was taking out of your life.
Image credit: “Tesla Model 3 Screen Dec 2020” by SirAsdof, Wikimedia Commons, licensed under CC BY-SA 4.0 — creativecommons.org/licenses/by-sa/4.0. Study: “Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem”, Northeastern University and Consumer Reports.