Nobody cross-shops crossovers by their ad-tech stack. But a new study shows that whatever you drive home, a few of Silicon Valley’s biggest ad businesses probably came along for the ride.
The peer-reviewed paper, titled “Automatic Transmission,” comes from Northeastern University’s Khoury College and will be presented at the ACM Internet Measurement Conference in Karlsruhe, Germany, October 12–16. The team ran its tests at Consumer Reports’ facility in Connecticut. They covered 21 vehicles from model years 2022 to 2025, most of them EVs so nobody had to idle combustion engines inside an enclosure. They parked the cars in a Faraday tent that blocked cellular signals, which forced the traffic onto Wi-Fi networks the researchers controlled. They also drove the cars, gently and then badly, and used every function in 30 companion apps after accepting every set of terms.
The scoreboard
Twenty-eight of the 30 apps sent data to at least one advertising or analytics company. Seven sent at least one personal identifier, meaning an owner’s name, a VIN, or a precise location. The recipients included Alphabet, Amazon, Meta, Microsoft, Pinterest, and Reddit.
Over Wi-Fi, the Tesla Model 3 reached 34 domains classified as advertising, tracking, or analytics. The Cybertruck reached 23, the Cadillac Lyriq 10, the Lucid Air 9, and the Chevrolet Blazer 7. The Mercedes-Benz EQS, Range Rover, and Buick Envista reached none.
Related Articles
- Two Drivers Stopped in the Middle of I-70 in Wheat Ridge, Colorado, and One Grabbed a Tire Iron — Then Both Got the Same Summons
- EPA Built Its Smog Rule Around EVs That Aren’t Coming. Now It Wants Two More Years for Gas Cars
That last name is the useful one. The Envista itself came out clean. But the myBuick app was one of seven, along with myCadillac, myChevrolet, myGMC, HondaLink, MyNissan, and Lincoln’s app, that sent VINs paired with an email address or a location. A car’s own hardware can be quiet while the app on your phone does the talking. Judging privacy by the infotainment screen means looking at the wrong device.
Why the VIN is the real problem
You can reset an advertising ID and clear your cookies. You can’t reset a VIN. It’s printed on your title, registration, insurance card, service invoices, and every auction listing the car will ever have. Decoded, it gives make, model, trim, powertrain, and assembly plant.
Paired with an email address, that 17-character string links a specific vehicle to a specific online identity. Regulators already treat it that way. The FTC’s order against GM says that data tied to a VIN doesn’t count as deidentified.
How the data gets out
The leaks look more like web tracking than anything mechanical. Several automakers told CR that some links inside their apps open outside web pages, and that third parties can put pixels and cookies on those pages. In practice, a companion app is often a thin wrapper around web content, and every analytics SDK or tracking pixel inside it is a separate path out.
GM, Honda, Nissan, and Stellantis said their contracts bar recipients from independently using or selling the data. A contract clause doesn’t stop network traffic, though. After the researchers showed Honda their findings, Honda told its analytics vendor, Amplitude, to delete the location data it had received and stopped sending it. That fix only happened because someone outside the company found the problem.
The opt-out trap
Automakers point out that most of these services are opt-in. The catch is what opting out costs you. Tesla warns owners who decline that the car could suffer “reduced functionality, serious damage, or inoperability.”
The FTC has written down a stricter standard, but only for one company. GM’s order bars it from degrading a product’s quality or functionality to punish customers who withhold consent, unless the data is technically necessary for that function. Owners of every other brand get no such protection.
Why insurance shoppers should care
This has already ended up in insurance pricing. According to California’s attorney general, GM sold names, contact details, geolocation, and driving-behavior data on hundreds of thousands of Californians to Verisk and LexisNexis between 2020 and 2024, and earned about $20 million nationwide from those sales. The settlement, which needs court approval, includes $12.75 million in penalties and bans selling that data to data brokers.
Related Articles
The Northeastern study didn’t track data reaching insurers. Ad-network flows and broker sales are different pipelines. Both start the same way, though: a car generating identifiable data that ends up with someone other than you.
What you can shut off
- Lock down the app. Set location access to “while using” instead of “always,” deny cross-app tracking, and avoid tapping promotional links inside the app. The study found those links are where third-party pixels live.
- Use a separate email for your car account. It weakens the VIN-to-email link that makes this data valuable.
- Clean up at trade-in. Remove the car from your app account and factory-reset the head unit. If you’re buying used, make sure the previous owner no longer has app access.
- Use state privacy rights. Californians can now send a single deletion request to more than 575 registered data brokers through the state’s one-request deletion tool.
- Think before cutting connectivity entirely. Over-the-air updates and remote recall fixes depend on it, and losing those is a real cost.
Co-author Sarah Elizabeth Gillespie said it doesn’t appear possible to buy a new car that doesn’t track you. Since you can’t opt out of tracking, figure out which piece is doing it (usually the phone app) and shut off what you can.
Ever turned off data sharing in your car’s app? Did the car push back?