Tech Desk: A recent study by Northeastern University and Consumer Reports has uncovered a concerning reality: many new cars and their associated apps are extensively sharing owner data, including sensitive identifiers like VINs and precise locations, with a wide array of third-party companies. This widespread data sharing often goes beyond what consumers might expect, funneling information to advertising firms, analytics companies, and even data brokers like Acxiom.

The investigation, spanning 21 late-model vehicles and 30 automaker apps, found that 19 cars transmitted data via Wi-Fi, while seven apps passed critical identifiers to external entities. General Motors’ apps, including myCadillac and myChevrolet, were particularly notable for sending VINs to numerous companies. Unlike a phone’s resettable advertising ID, a VIN is permanent, allowing advertisers to link an owner’s vehicle to their online activity.

Even cars that didn’t share data directly from the vehicle often exposed owners through their accompanying smartphone apps. For instance, the Buick Envista and Nissan Ariya, while seemingly secure from the car itself, exposed owners to dozens of ad and tracking companies via their apps. Automakers largely defend these practices, citing vendor contracts and privacy policies that few owners fully comprehend.

While companies like Rivian warn of “reduced functionality” if data sharing is declined, and GM faces an FTC privacy order, only Honda has publicly committed to changing its practices by asking Amplitude to delete collected location data. Experts are now calling for stronger regulatory intervention to protect consumer data in the connected car era.