The news
Northeastern University researchers and Consumer Reports said on September 29, 2026, that 28 of 30 automaker phone apps they tested sent data to outside advertising or analytics companies, a car data privacy finding the researchers link to a gap between disclosures and practice.
The team tested 21 vehicles from model years 2022 to 2025 and 30 companion apps, the phone apps owners use to lock doors, locate a car or book service, at Consumer Reports' Auto Test Center in Connecticut. The project page says testing ran from October 2024 to August 2025 and that a peer-reviewed paper will be published at the IMC '26 conference.
According to Consumer Reports, seven of the apps sent at least one piece of personally identifiable information, such as the owner's name, the car's vehicle identification number (VIN) or its precise location, to at least one outside company. Consumer Reports named four General Motors (GM) apps, myCadillac, myChevrolet, myBuick and myGMC, along with HondaLink, MyNissan and Lincoln, as sharing VINs paired with email addresses or location data.
Consumer Reports said the top recipients of driver data included Alphabet (GOOGL), Amazon (AMZN), Meta Platforms (META), Microsoft (MSFT), Pinterest (PINS) and Reddit (RDDT), among dozens of others. The researchers' project page adds that 19 of 21 vehicles contacted at least one third party over Wi-Fi, including known advertising and tracking domains, and that pairing a phone app roughly doubled a vehicle's exposure to tracking companies on average.
Automakers responded in different ways. Consumer Reports reported that once the researchers shared their findings with Honda (HMC), the automaker directed its vendor Amplitude to erase the location data sent to it and halted further transfers. GM, Honda, Nissan and Stellantis (STLA) said some recipients were barred from independently using or selling the data, and several automakers told Consumer Reports that some app links open outside webpages where third parties can place tracking pixels and cookies.
The researchers concluded on their project page that automakers' public disclosures fall well short of describing how data actually moves across the connected-vehicle ecosystem.
The numbers
- Automaker apps tested
- 30
- Apps that sent data to outside ad or analytics firms
- 28 of 30
- Apps that sent personally identifiable information to an outside company
- 7
- Vehicles tested (model years 2022-2025)
- 21
- Vehicles that contacted a third party over Wi-Fi
- 19 of 21
- Facebook violations found by New Mexico jury
- Nearly 44 million
- Maximum civil penalty per violation under New Mexico law
- Up to $5,000
Why CEOs should care
For general counsel, chief privacy officers and boards, the lesson is that privacy statements are now evidence. The New Mexico case turned promises about user control and data sales into nearly 44 million violations, and the car study shows outside researchers can measure whether apps behave as described. Ask your team for a line-by-line check of every public privacy claim, such as "we do not sell your data", against what your apps and websites actually transmit.
For chief information security officers (CISOs) and product leaders, the study found data leaving through ordinary analytics and advertising connections: 28 of 30 apps sent data to such outside companies, and several automakers said app links open outside webpages where trackers can load. Questions to ask: which third-party software development kits (SDKs, code libraries from outside vendors) run in our mobile apps, what fields do they receive, and can any of them pair a stable identifier such as an email address or VIN with location? Honda's response, which Consumer Reports said was to instruct its vendor to delete the location data and stop sending it, shows a company can act once someone measures the problem.
For operations leaders and CFOs who run vehicle fleets, connected cars now carry the same data-governance questions as any software vendor. Ask manufacturers what leaves the vehicle and its apps, who receives it and whether contracts bar reuse. The automakers' answer, that some recipients are prohibited from independently using or selling the data, is a policy promise, not a technical control, so request audit rights and data-flow documentation.
The bigger picture
Privacy claims are being tested in two new places at once. On September 25, a New Mexico jury found Facebook violated the state's Unfair Practices Act nearly 44 million times by misleading consumers about its privacy practices, including telling them they controlled how their information was shared and that it did not buy or sell their private data, The Record reported. Each violation carries up to $5,000 in civil penalties, and a judge will set the amount. Attorney General Raúl Torrez brought the case.
Consumer Reports noted that regulators have already reprimanded and fined automakers over allegations that they did not clearly disclose how they collect and share driver data. The researchers say more than three-quarters of vehicles sold globally have connected features, and they call for more transparency and continued measurement across the whole connected-vehicle ecosystem.
What’s next
A judge is expected to set Meta's penalty in the coming weeks, according to The Record, and the Northeastern paper is due to be published at IMC '26. Companies that make public privacy promises should watch whether other state attorneys general cite the New Mexico result, and whether automakers that were named change their apps as Honda did. Running an internal traffic test of your own apps before an outside group does is a practical step.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
