Your Car Is Sharing Your Data With Google and Meta. Opting Out Might Break It

Your car is probably talking to Big Tech, and not only about your drive.

A new study from Northeastern University researchers, done with Consumer Reports, found that connected cars and their companion apps regularly send driver data to companies like Amazon, Google, Meta, and Microsoft. That data includes vehicle identification numbers (VINs), email addresses, and precise locations.^[1][2]

It's the same ad-tracking system that follows you around on your phone. Now it can be tied to the car in your driveway. The study's authors say there doesn't appear to be a way to buy a new car that avoids it.

Automakers do technically disclose this sharing. The catch is where. It's buried in privacy policies that take a college-level reading ability to understand, according to an All About Cookies analysis of 14 major car brands.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What happened

Researchers from Northeastern's Khoury College of Computer Sciences tested 21 vehicles from model years 2022 through 2025, plus 30 automaker companion apps. The testing took place at the Consumer Reports Auto Test Center in Connecticut. To see exactly what each car was sending, they parked it inside a Faraday tent, which blocks cellular signals. Then they routed its traffic through a Wi-Fi network they controlled.

Here's what they found:

• 28 of 30 apps sent data to at least one outside advertising or analytics company.
• 7 of 30 apps sent personally identifiable information (PII), such as the owner's name, VIN, or precise location, to at least one outside company
• 19 of 21 vehicles sent traffic to at least one third party.

Four GM apps (myCadillac, myChevrolet, myBuick, and myGMC), along with the HondaLink, MyNissan, and Lincoln apps, shared VINs paired with an email address or location data. Among the cars themselves, the Tesla Model 3, Tesla Cybertruck, Cadillac Lyriq, Lucid Air, and Chevrolet Blazer contacted the most ad and analytics companies.

Consumer Reports shared the results with the automakers. Several responded that some links inside their apps open outside webpages, where other companies can place their own cookies and tracking pixels. The researchers noted that drivers got no warning when this happened. Other automakers pointed out that many connected services are opt-in.

Honda changed course. After seeing the findings, it told its analytics vendor, Amplitude, to delete the location data it had received, and it updated its app to stop sending that data.

The researchers will present the full study at the ACM Internet Measurement Conference, Oct. 12 to 16.

What it means for you

On its own, a VIN seems harmless. It's printed right on your dashboard. Paired with your email address, though, it works like a name tag. It lets an ad company connect your car to the rest of your digital life, including your browsing and shopping history.

That's the part researchers flagged as most concerning. Data brokers build and sell consumer profiles to banks, insurers, lenders, and retailers. Those buyers can use the profiles to tailor loan terms and insurance offers, according to a Consumer Reports and CalMatters investigation. It's the same system behind surveillance pricing, where the prices and deals you see can depend on what companies know about you.

Car data has already been sold this way. In May 2026, General Motors agreed to pay $12.75 million in civil penalties to settle claims from California's attorney general. The attorney general alleged that GM sold the names, locations, and driving behavior of hundreds of thousands of Californians to data brokers through its OnStar program.

Why car privacy disclosures don't protect most drivers

Automakers aren't hiding this, at least not technically. Every manufacturer's app privacy policy disclosed that it may share personal information with third parties, Northeastern researchers found. None said which companies would get the data, or why.

Even getting through that disclosure takes real effort. All About Cookies analyzed 18 privacy documents from 14 major automakers. The average policy required a 13th-grade (college freshman) reading level. Most American adults read at about a 7th- to 8th-grade level. 

The two studies also line up in a telling way. In Northeastern's testing, Tesla's vehicles contacted the most ad and analytics domains. In our analysis, Tesla's privacy policy was the hardest to read of any brand, at a 16th-grade level. Honda, which changed its data practices after seeing the findings, has one of the easier policies we reviewed, at grade 11. 

Opting out isn't a clean choice either. Popular features may not work unless you accept data sharing, and in some cases the car can't be driven at all. Tesla warns owners who decline its data-sharing agreement that their vehicle could suffer "reduced functionality, serious damage, or inoperability."

Northeastern professor David Choffnes, one of the study's authors, said drivers who opt out risk being left with a car that barely works. “It’s not reasonable that we’re in a situation where if they opt out of this kind of data collection, they mostly brick their cars.”

What to do right now

You can't unplug a modern car from the internet, but you can cut down how much of your information leaves it.

• Check your car app's privacy settings. Look for toggles labeled analytics, marketing, or "improve our services," and turn off anything you don't need. Consumer Reports has a step-by-step guide to opting out of driver data sharing. Our guide to protecting your privacy in a connected car covers the settings inside your vehicle.
• Think twice about pairing the app. Much of the personal data researchers caught came from the companion apps, not the cars themselves. Pairing the app with the car roughly doubled exposure to ad and tracking companies, according to TechCrunch. If you rarely use remote start or remote unlock, the convenience may not be worth it.
• Avoid tapping outside links inside your car app. Automakers told Consumer Reports that some tracking came from webpages opened within their apps.
• Use your state privacy rights. A growing number of states let residents request that companies stop selling their data or delete it. California residents can use the state's Delete Request and Opt-Out Platform (DROP) to send deletion requests to registered data brokers.
• Shrink the profile your car data gets matched to. Your VIN is only valuable to advertisers when it can be linked to everything else about you. A data removal service can send removal requests to the brokers holding your name, address, and phone number.

Bottom line

Car privacy used to mean locking your doors. Now it also means knowing which companies ride along every time you open your car's app. The Northeastern study shows the data is flowing, and our analysis shows why most drivers never find out. Before you use your car app again, take five minutes to go through its privacy settings and turn off anything you don't use.

Take Control of Your Online Privacy

5.0

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On Incogni's website

2026 Editors’ Choice

Best Overall Data Removal Service

Privacy Protection

Incogni

PROMOTION: Get 55% Off Annual Plans With Code COOKIE

• Top-rated data removal service that scrubs your info from 420+ data broker sites automatically
• Independently verified by Deloitte, meaning removals are actually sent, confirmed, and not just claimed
• The Unlimited plan extends coverage to 2,000+ additional sites with human-assisted custom removals

Author Details

Kalleigh Lane

About the Author

Kalleigh Lane is the Managing Editor at All About Cookies, where she helped develop the site's star rating system for product reviews and specializes in testing VPNs, ad blockers, and parental controls on Android and PC. She brings more than five years of experience editing and writing across cybersecurity, tech, and finance, and she has authored and edited over 275 articles for All About Cookies. Before joining AAC, she worked as a journalist and editor at CTV News and the Globe and Mail, and she holds a Master of Arts in English Literature from the University of Toronto.