How Car Companion Apps May Share Your VIN and Location With Big Ad Firms

A study by Northeastern University and Consumer Reports examined 30 vehicle companion apps and found that seven shared VINs, names, or locations with advertising companies.

When you open your automaker’s app just to confirm the doors are locked, the tap may also be sending user data to advertising servers run by Google, Meta, or an unfamiliar data brokerage. That is the key conclusion of a new investigation from Northeastern University and Consumer Reports, which reviewed 30 companion apps linked to 21 vehicles across 19 brands.

The researchers found that some of the apps transmitted information that could identify a specific car or driver. At the center of those transmissions was the VIN, a number that cannot be reset the way a cookie can.

What the Researchers Found

Almost all of the apps tested sent data to outside advertising or analytics firms, and several shared information that could identify the driver or the vehicle.

Twenty-eight of the 30 apps contacted at least one outside advertising or analytics company. Seven went further and sent personally identifying details, including a driver’s name, a vehicle identification number, or precise location data. The apps named as sending that sensitive information were HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC. The four GM-branded apps also shared VINs together with email addresses or location data.

More than 70% of the apps studied reached at least five separate tracking or analytics domains, according to Consumer Reports. Among the companies on the receiving end were Google, Meta, Microsoft, Snap, Adobe, Amazon, Pinterest, Yahoo, and Reddit. The pattern resembles the way a surveillance-style app can quietly collect information from users who may not realize it is happening.

The investigation tracked what data left the apps and where the network traffic went. It does not prove that every company named used the information for a specific ad campaign or built profiles from it.

Why a VIN Is Different From a Cookie

This identifier stays with the vehicle for life, and it cannot be cleared like browser history.

A VIN is a permanent, vehicle-specific number assigned at manufacture. Unlike an advertising ID on a phone, which can usually be reset in device settings, a VIN remains attached to the car indefinitely. When an app sends that identifier together with an email address or precise location, it creates a lasting link between a particular vehicle and an identifiable person.

Researchers said that combination can allow data brokers to build detailed profiles. Those profiles may show where a car is parked overnight, where it travels during work hours, and which destinations it visits repeatedly. That is an implication of the data combination documented in the study, not a confirmed result for every company named.

What Drivers Can Do

Deleting the app helps, but it does not solve the entire problem.

Removing an automaker’s app from a phone may cut down on some device-based transmissions. But it does not stop data collected by the vehicle itself, dealership systems, usage-based insurance programs, or other connected services. The available controls also vary widely by brand and by region.

The most practical first step is to review the automaker’s privacy settings and connected-services account options. Look for data-sharing preferences, location permissions, and any opt-out tools attached to your account. Readers concerned about related device-level privacy risks may want to look for additional guidance as well.

The connected-car world now runs through the same advertising and data systems that power websites and smartphones. The crucial difference is the identifier at the center of it all. You can delete an app, reset an ad ID, or clear cookies. You cannot reset your VIN.