Your Car Is Probably Sharing Your Data With Google and Meta. Here's How to Opt Out
A Northeastern study run at Consumer Reports found 28 of 30 automaker apps feeding ad and analytics firms. Here's where it was worst and how to switch it off.
Privacy researchers from Northeastern University spent time at Consumer Reports' Connecticut test center intercepting the network traffic of 21 cars and 30 automaker phone apps. The headline finding, published by Consumer Reports on September 29: 28 of the 30 apps sent data to at least one outside advertising or analytics company, and seven of them passed along an owner's name, the car's VIN, or its precise location.
The biggest recipients were household tech names, including Amazon, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo. If you've read our guide to what Tesla's crash data does and doesn't show, the theme is familiar: a modern car records far more than the dash lets on. Below is which models and apps stood out, what the study can't tell you, and where each major brand keeps its opt-out.
What the researchers actually measured
The 21 vehicles came from 19 brands and spanned the 2022 to 2025 model years. Many were EVs, partly to avoid running engines indoors.
Each car sat inside a Faraday tent that blocked cellular signals, then connected to a custom Wi-Fi access point so the team could log every outgoing connection. Traffic was captured while parked and while driving, including bursts of hard acceleration, braking, and swerving.
The apps were tested separately. Testers logged in and used every function, from locating the car to checking service history. They also accepted every set of terms and conditions, which is what most owners do on delivery day.
The cars and apps that stood out
Ranked by the number of advertising, tracking, and analytics domains each car contacted over Wi-Fi, according to the study chart Consumer Reports published, the leaders were:
- Tesla Model 3: 34
- Tesla Cybertruck: 23
- Cadillac Lyriq: 10
- Lucid Air: 9
- Chevrolet Blazer: 7
- Honda Prologue: 5
Ten of the 21 vehicles, including the Ram 1500, Nissan Ariya, Mercedes-Benz EQS, and Buick Envista, registered zero such domains. Every car still contacted other third parties, such as navigation, roadside-assistance, and cloud providers. And because cellular links were blocked, a low score describes the Wi-Fi channel, not everything a car transmits.
The seven apps that sent personal identifiers were myCadillac, myChevrolet, myBuick, myGMC, HondaLink, MyNissan, and Lincoln's app. Consumer Reports says they shared VINs paired with either an email address or location data. Apps from BMW, GM's brands, and Toyota contacted the largest number of outside companies.
That VIN-plus-identifier pairing is what worried the researchers most. With both, a large ad or tech platform can tie a specific car, and its owner, to the commercial consumer profiles data brokers already sell.
What the study doesn't tell you
The study maps where the data goes. It does not show what Google, Meta, or any other recipient does with it after it arrives, and Consumer Reports' write-up doesn't claim to.
GM, Honda, Nissan, and Stellantis told Consumer Reports that some recipients are barred from using or selling the data on their own. Several automakers also said some tracking came from outside webpages opened inside their apps, where third parties can embed pixels and cookies. The researchers say drivers got no warning when that happened, and that contractual limits aren't a dependable safeguard.
One concrete result: after seeing the findings, Honda told a vendor, Amplitude, to delete the location data it had received, and stopped sending it.
The test also covered specific vehicles and app versions. A newer model or an updated app could behave differently, in either direction.
How to opt out, brand by brand
Most automakers offer two levers: a web privacy portal for "do not sell or share," "limit sensitive data," and deletion requests, plus settings inside the car or app. Some honor portal requests nationwide; others limit them to states with privacy laws, according to Consumer Reports.
- Chevrolet, Buick, GMC, Cadillac: GM's U.S. consumer privacy request form at gm.com/consumer-privacy. Under its FTC order, GM must also give owners a way to opt out of geolocation and driving-behavior data collection, with limited exceptions.
- Honda: the Honda Privacy Center at honda.com/privacy/your-privacy-choices lists separate requests to stop sale or sharing, limit sensitive data, and delete what Honda holds.
- Nissan: the web form at nissanusa.com/data-privacy.html, or Nissan's data privacy line at 1-877-647-2272. Nissan says it may ask for proof of identity.
- Ford and Lincoln: start with Ford's U.S. privacy notice at ford.com/help/privacy, which covers both brands and has a separate Connected Vehicle Privacy section.
- Toyota and Lexus: per Consumer Reports' guide, open the app, tap the person icon, then Account, then Data Privacy Portal, and pick the vehicle. CR notes this stops collection and sharing but doesn't delete data already gathered.
- Subaru: the consumer privacy portal at subaru.com/support/consumer-privacy.html; the VIN field is optional.
- Tesla: on the touchscreen, go to Software, then Data Sharing. Tesla says it doesn't sell personal data and doesn't tie driving data to your account by default. Account deletion is under Data & Privacy in your Tesla account.
For other brands, look for a "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" link in the footer of the automaker's U.S. site. Two cheap habits help regardless of badge: set the companion app's phone location permission to "while using the app," and avoid the web links that open inside the app.
The catch: opting out can cost features
Consumer Reports says there is almost always a trade-off, from losing roadside assistance or crash detection to losing remote locking. Sometimes the stakes are higher. A Tesla owner who declines the company's data-sharing agreement is warned the car may suffer "reduced functionality, serious damage, or inoperability."
Study co-author Sarah Elizabeth Gillespie told CR that buying a new car that doesn't track you no longer appears possible. The realistic goal is narrowing who gets the data, not stopping it entirely.
Regulators are already circling
GM is the cautionary tale. In January, the FTC finalized an order barring GM and its OnStar unit, which recently launched an AI assistant for fleet customers, from disclosing drivers' geolocation and driving-behavior data to consumer reporting agencies for five years. In May, California's attorney general announced a $12.75 million settlement with GM over the sale of Californians' driving data to brokers, subject to court approval. Both cases stem from GM's Smart Driver program, which the company shut down in 2024.
What's next
Consumer Reports shared the results with every automaker in the test. The full paper, "Automatic Transmission: An Empirical Study of Data Privacy in the Connected Vehicle Ecosystem," comes from Northeastern's Khoury College, and we'll update this guide if automakers change their apps, regulators act on the findings, or the paper adds detail beyond CR's summary.
Don't expect the appetite for data to shrink. Automakers such as Hyundai are building "data flywheels" to train driver assistance, and every connected feature is another stream to manage.
