A recent study by academics at **Northeastern University** and the nonprofit **Consumer Reports** has shed new light on the pervasive data collection and sharing practices of connected vehicles. The findings, unveiled this week, indicate that 19 out of 21 major auto manufacturers investigated are actively gathering and widely distributing customers’ private data. While the privacy implications of connected cars have been a long-standing concern – with the **Federal Trade Commission (FTC)** issuing warnings to automakers in 2024 – this new research provides concrete evidence detailing how data flows from individual vehicles to companion apps and, subsequently, to a multitude of third-party companies. ### The Data Flow: From Your Car to the Cloud and Beyond The report highlights that 28 out of 30 car-connected apps shared data with at least one third-party advertising or analytics firm. More alarmingly, seven of these 30 apps transmitted personally identifiable information, including car owners’ names, email addresses, and precise geolocations, to at least one external entity. Specific examples cited include four **General Motors (GM)** companion apps – **myCadillac**, **myChevrolet**, **myBuick**, and **myGMC** – along with **Honda**, **Nissan**, and **Lincoln** apps. These applications were found to share Vehicle Identification Numbers (VINs) packaged with either location data or email addresses. This practice enables data brokers to easily identify individuals' driving patterns and monetize this sensitive information. ### Regulatory Action and Corporate Accountability This revelation follows recent regulatory action. In May, **California Attorney General Rob Bonta** and the **California Privacy Protection Agency (CPPA)**, alongside local prosecutors, fined **GM** over $12 million. The settlement also mandated that GM cease sharing driver data with credit reporting agencies and data brokers for five years, underscoring the growing legal scrutiny on these practices. ### The Extensive Network of Data Recipients The automakers were found to share this wealth of data not only with advertising and analytics firms but also with numerous tech giants. Companies such as **Google’s Alphabet**, **Amazon**, **Microsoft**, **Meta**, **Reddit**, and **Pinterest** were identified as recipients. Consumer Reports noted that many of these companies play a dual role, acting as both software providers and operators of advertising auction platforms used for targeted marketing. This makes them a critical initial node in a vast personal data ecosystem, where the data they collect from drivers can be leveraged for various commercial purposes. ### Industry Responses and Ongoing Challenges While none of the implicated automakers immediately responded to requests for comment regarding the new findings, there have been some reactions. Following notification by Consumer Reports, **Honda** reportedly directed a digital data analytics and tracking vendor it works with to erase all ingested location data and discontinue sharing it with third parties. Some manufacturers have defended their practices by stating that links embedded in their connected apps lead to external webpages, allowing third-party firms to place cookies and pixels, often without the driver's explicit knowledge. Others claim that some third-party companies receiving data are contractually barred from independently using or selling it. Automakers often present data sharing as an opt-in process. However, Consumer Reports argues that drivers frequently do not fully comprehend what they are agreeing to. Furthermore, some manufacturers reportedly warn customers that opting out of data sharing may render their vehicles inoperable, creating a coercive environment for consent. These findings underscore the immense personal data ecosystem that American consumers are unknowingly drawn into when purchasing and using everyday products, including their automobiles.