Threat intel
Car apps sent VINs and location to trackers, study finds
A Northeastern and Consumer Reports study found 7 of 30 car apps sending VINs, location or emails to third parties. What fleets and staff should change.
Researchers at Northeastern University, working with Consumer Reports, tested 21 late-model cars from 19 brands and 30 manufacturer companion apps on the US market between October 2024 and August 2025. Seven of the 30 apps sent sensitive identifiers to advertising, tracking or analytics companies: Vehicle Identification Numbers (VINs), precise GPS location, email addresses and a phone number. On the vehicle side, 19 of the 21 cars contacted at least one third party over Wi-Fi. The paper, "Automatic Transmission", was presented at the ACM Internet Measurement Conference (IMC '26) in Karlsruhe on October 12 to 16.
If your company runs a vehicle fleet, issues company cars, or lets staff install a carmaker's app on a managed phone, the findings apply to you. A VIN never changes and is tied to a registration and an insurance policy, and the apps paired it with the owner's email or location. For a fleet, a VIN combined with a location trail tells an outsider where a named employee drives.
How the researchers measured it
Coverage of the study mixes two different measurements, and they are not equally strong.
The vehicle numbers come from Wi-Fi only. Each car joined a Raspberry Pi access point that logged its traffic while parked and idle, while testers worked every control and infotainment menu, and while it was driven on Consumer Reports' private test track. The team tried to intercept the encrypted traffic with substituted certificates, and every car rejected them. So the vehicle results show which domains a car contacted, not what it sent. Eleven of the 21 cars contacted at least one domain that specialises in advertising, tracking or analytics (the paper calls these ATA), and 13 reached Google-associated ATA domains. Several of those cars run Google's Android Automotive OS, but the paper notes that domains such as doubleclick.net and googlesyndication.com are not needed for core services.
Every car in the sample had an active cellular connection by default, and that traffic was largely out of view. The researchers drove 11 electric vehicles into a Faraday tent to block the mobile network and force traffic onto Wi-Fi. Seven of the 11 then showed more destinations, including 27 extra ATA domains for the Tesla Model 3 and 14 for the Tesla Cybertruck. Only the Model 3, which has a user-accessible SIM slot, had its cellular traffic captured directly.
The app numbers are the stronger finding, because that traffic was decrypted. The team ran the apps on iPhones with a custom root certificate and mitmproxy, logged in to real vehicle accounts and used every feature. They then searched the traffic, including MD5, SHA1 and SHA256 hashes, for the VIN, licence plate, owner name, phone number, email, location and the Wi-Fi name and password. The four General Motors apps (myCadillac, myChevrolet, myBuick and myGMC) sent VINs to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo, and sent owner emails to Adobe. HondaLink sent the VIN and precise location to Amplitude, MyNISSAN sent the VIN and email to Alchemer, and the Lincoln app sent the VIN to ContentSquare.
The authors call both sets of results a lower bound. They could not read vehicle payloads, some first-party app domains used certificate pinning and stayed encrypted, most cellular traffic went unseen, and any sharing from the manufacturer's servers to third parties is invisible from the car or the phone. Android versions of the apps were not tested.
Why the app matters more than the car
Pairing the companion app at least doubled cumulative tracker exposure for most vehicles in the sample. The Buick Envista and Nissan Ariya contacted no ATA domains from the car over Wi-Fi, yet reached more than 20 ATA companies once their apps were counted. Seventy percent of the apps contacted more than five unique ATA domains, against 29 percent of the cars.
A VIN works like a phone's advertising ID that the user cannot reset. Sent alongside an email address to the same company, it lets that company link vehicle ownership to a person's activity on other sites and apps. When manufacturers were shown the results, all 14 that replied said the flows matched their vendor contracts. Five blamed embedded browser pages inside the app, and seven said owners are responsible for accepting third-party terms. Honda was the only one to change: it asked Amplitude to delete the location data and stopped sending geolocation from HondaLink.
What fleets and staff should do
1. Inventory and classify
List every vehicle with its VIN, the driver it is assigned to, the manufacturer account it is registered under and any third-party telematics unit. Classify the VIN-to-driver mapping and any location history as personal data in your records of processing. Treat a VIN in a support ticket or spreadsheet with the same care as a home address.
2. Audit the apps on work phones
Decide whether manufacturer apps belong on managed devices at all. If they do, deploy them through your mobile device management (MDM) tool as managed apps so you can remove them and their data on offboarding. On iOS, set location to "While Using the App" and turn off Precise Location under Settings > Privacy & Security > Location Services for the app, and turn off Settings > Privacy & Security > Tracking > Allow Apps to Request to Track. The tracking prompt does not stop an app from passing a VIN to an analytics provider, so a protective DNS profile pushed by MDM adds a second layer. Expect gaps: existing blocklists caught 262 of the 300 ATA hostnames the researchers found.
3. Set the head unit
In each vehicle's privacy or connectivity menu, turn off optional data sharing and do not sign a work Google or Microsoft account into the infotainment system. Pair phones without contact sync where the car allows it. On pool cars, delete paired phones and accounts at handover, and factory reset before resale or lease return. Turning off connected services or the modem can cut more than tracking: Rivian warns it disables navigation, lane keeping assistance and over-the-air updates, which carry security fixes, so test one vehicle before a fleet-wide change. Keep vehicles off corporate Wi-Fi, and if your depot has a separate network, log its DNS queries to see what the vehicles contact.
4. Contract for it
Put every telematics supplier and fleet app under a data processing agreement (DPA) that names its sub-processors, including analytics and session-replay tools in the driver app such as FullStory and ContentSquare, both of which turned up in the study. Put the six questions in the graphic above to the supplier in writing, and add two more: where the data is stored and processed, and how quickly they will notify you of a breach. Ask the carmaker the same questions for the built-in connection, since removing the phone app does not switch off the car's own modem.
Fleet data is a supply chain
A company car sends data along at least three paths: the vehicle's modem, the driver's phone app, and the servers of the carmaker or telematics supplier. The study could see part of the first two and none of the third, and a fleet can reach that third path only through its contracts.
Our mobile penetration testing covers what a fleet or driver app sends and to whom, and our compliance and audit readiness work covers the processor contracts and records behind it. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Northeastern University paper, Automatic Transmission (IMC '26), Automatic Transmission project site, Consumer Reports, Northeastern Global News, Help Net Security, Malwarebytes, Gridinsoft.