Your Car's App May Be Sharing Your Data With Google and Meta. Here's How to Limit It
A Consumer Reports study found 28 of 30 automaker apps sending data to ad and analytics firms, and seven sharing VINs or names. Here's what it means and the settings to change.
The app you use to unlock your car or check its charge may also be reporting to Google, Meta, and Amazon. Consumer Reports and researchers from Northeastern University's Khoury College tested 21 vehicles from 19 automakers and 30 companion apps at CR's test center in Connecticut. They found that 28 of the 30 apps sent data to advertising, tracking, or analytics companies. CR published the findings on September 29.
Modern cars already record a lot on their own. We have covered how to find out what your Tesla recorded in a crash. This study looked at a different channel: the app on your phone. Here is what it found, whose apps stood out, and which settings you can change today.
What the study found
The researchers captured traffic three ways: from the vehicles over Wi-Fi, from the vehicles over cellular with Wi-Fi blocked inside a Faraday tent, and from the apps while they used every feature. Recipients included Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo. According to the study, 70% of the apps contacted more than five separate advertising, tracking, or analytics domains.
The gap between vehicles was large. CR found that the Tesla Model 3, Tesla Cybertruck, Cadillac's Lyriq, and Chevrolet Blazer sent data to the most outside companies. The Model 3 reached 34 tracking domains, while the Mercedes-Benz EQS reached none, according to The Drive's account of the study. The myCadillac app alone contacted 51 advertising and analytics firms.
Seven apps shared data that points to you
Most tracking runs on your phone's advertising ID, which you can reset or switch off. The bigger problem in this study was personal information. Seven of the 30 apps sent names, email addresses, precise location, or vehicle identification numbers to outside companies. The Record reports that those seven were four GM apps (myCadillac, myChevrolet, myBuick, and myGMC) plus the Honda, Nissan, and Lincoln apps, each pairing a VIN with location data or an email address.
A VIN is effectively permanent. You cannot reset it the way you reset an ad ID, and it connects to registration, insurance, and service records. Pair it with GPS coordinates and you get a driving history tied to a specific car and its owner.
What the automakers said
Honda was the only company that changed anything. It said it had directed its analytics vendor, Amplitude, to delete location data collected through its app. GM, Nissan, and Stellantis said their contracts restrict how third parties can use the data. Tesla, according to CR, warns owners that refusing data collection could cause "serious damage, or inoperability." That is a real trade-off. Remote start, charging controls, software updates, and crash notification all depend on connectivity.
GM's history makes its answer harder to accept on trust. In January, the Federal Trade Commission finalized an order that bars GM and OnStar for five years from sharing drivers' location and driving-behavior data with consumer reporting agencies. The order requires affirmative consent before connected-vehicle data is collected, used, or shared. In May, California's attorney general and privacy agency announced a $12.75 million settlement, the largest penalty under the state's privacy law. Officials said GM sold names, contact details, location, and driving data from hundreds of thousands of Californians to the data brokers Verisk and LexisNexis between 2020 and 2024.
How to check and limit what your car app shares
No single switch fixes this, but you can shrink your footprint in about 15 minutes.
- Block app tracking on your phone. On an iPhone, go to Settings, then Privacy & Security, then Tracking, and turn off "Allow Apps to Request to Track." On Android, open the privacy settings, go to Ads, and delete your advertising ID. This does not stop VIN sharing, but it cuts the ad-network trail.
- Tighten location access. Set the car app to "While Using" instead of "Always." Turn precise location off if the features you rely on still work without it.
- File a privacy request with the automaker. Look for "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" in the app or on the brand's website. Ask for a copy of your data, opt out of sale and targeted advertising, and request deletion. Residents of states with comprehensive privacy laws, including California, have legal rights to do this. GM must now offer copy, deletion, and opt-out tools under the FTC order.
- See whether your driving data reached insurers. Request your free consumer disclosure report from LexisNexis Risk Solutions. If the company holds driving-behavior data tied to your name, it will appear there.
- Clean up before you sell or trade in. Remove the car from your app account and reset the infotainment system to factory settings, so the next owner can't see your trips and your account stops tracking a car you no longer own.
What we still don't know
CR has not published a full map of which data went to which company for every app. Most automakers also have not said whether they will change anything. Car software is already a pain point, with infotainment making up a quarter of new-car problems in J.D. Power's 2026 study, and automakers keep building more of their own software into the car. GM's new truck interface, for example, puts Apple CarPlay in a window next to GM's own apps. The data those apps collect will stay under scrutiny. We will update this guide as automakers respond.
