Automakers routinely share personally identifiable connected-car data with third parties, report says

1. Executive summary

Northeastern University academics and the nonprofit Consumer Reports published a study finding that 19 of 21 major automakers collect and broadly disseminate connected-car customer data, and that 28 of 30 connected-car apps shared data with at least one third-party advertising or analytics firm. Seven of the 30 apps sent personally identifiable data (names, email addresses, precise geolocations) to at least one outside company, and four GM companion apps plus Honda, Nissan and Lincoln apps share VINs bundled with location or email data. No CVE, exploitation state or threat actor is involved; this is a consumer-privacy and third-party data-governance finding, not a vulnerability or campaign. For EMEA financial services the direct technical exposure is limited, but the same connected-car and mobile-app telemetry supply chain can carry employee and executive location data into advertising and data-broker ecosystems that sit outside your vendor inventory. The verified reference data resolved no CVEs for this item, so no CVSS score, severity or CISA KEV state is asserted here.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The finding concerns consumer connected-car data flows between automakers, app vendors and advertising or analytics firms. It does not describe an ICT-related incident at a financial entity, a cyber threat, an operational resilience test, or an ICT third-party arrangement that a financial entity has contracted for. Mapping DORA Art. 28 or NIS2 Art. 21(2)(d) here would require treating a consumer privacy study as a supply chain event at your firm, which the source does not support. The one fact worth tracking is that connected-car apps move precise geolocation and identifiers to advertising and analytics firms; if your firm embeds such an app, or issues connected vehicles to staff, that flow becomes a data-protection question under your existing privacy programme, not a DORA or NIS2 reporting trigger on the facts available.

3. Technical analysis & attack chain

The source describes a data-sharing study, not an intrusion. There is no initial access vector, no exploited component, no payload, no persistence mechanism and no command-and-control channel in the material. What follows is the confirmed data-flow chain the study documents.

1. A connected car collects customer data. The study covers 21 major automakers and found 19 of them collect and broadly disseminate customers' private data.
2. The driver downloads the manufacturer's companion app at the point of sale. The study examined 30 such apps.
3. The app transmits data to third parties. Twenty-eight of the 30 apps shared data with at least one third-party advertising or analytics firm.
4. A subset of that data is personally identifiable. Seven of the 30 apps sent at least one piece of personally identifiable data (car owners' names, email addresses, precise geolocations) to at least one outside company.
5. Vehicle identifiers are bundled with location or contact data. Four GM companion apps (myCadillac, myChevrolet, myBuick, myGMC), plus Honda, Nissan and Lincoln apps, share VINs packaged with either location data or email addresses. The study states this lets data brokers identify individuals' driving patterns and sell them.
6. Data reaches large advertising and analytics firms. Consumer Reports names Google's Alphabet, Amazon, Microsoft, Meta, Reddit and Pinterest as recipients. The study notes these firms act in two roles, as software providers and as operators of advertising auction platforms, which the press release describes as making the collecting companies "the first node in a vast personal data ecosystem."
7. A second collection path runs through embedded web content. Several automakers told Consumer Reports that links in their connected apps lead to external webpages, which lets third-party firms place cookies and pixels. The study says those pages can collect consumer data, typically without the driver knowing.

Two remediation actions are documented. After Consumer Reports notified Honda of the findings, Honda directed a digital data analytics and tracking vendor to delete all ingested location data and stop sharing it with third parties. Separately, in May, California Attorney General Rob Bonta and the California Privacy Protection Agency, with four local prosecutors, fined GM more than $12 million and ordered it to stop sharing driver data with credit reporting agencies and data brokers for five years.

Two caveats. First, the entire technical account rests on a single study by Northeastern University and Consumer Reports, reported by The Record; no independent corroboration of the specific app counts or the named recipients appears in the material. Treat the 19-of-21, 28-of-30 and 7-of-30 figures as single-sourced. Second, the automakers' position is that data sharing is opt-in and that some third parties are contractually barred from independently using or selling the data; Consumer Reports disputes the adequacy of that consent, arguing drivers often do not know what they are agreeing to and that some automakers warn vehicles may be inoperable if the customer opts out. Both positions are recorded here; neither is independently verified.

4. Mitigation & containment

This item does not describe a compromise of your estate, so the actions below are governance and data-flow controls, not incident containment. They apply if your firm embeds connected-car apps, issues connected vehicles, or has staff who use them for business.

P1 within 24h

• Determine whether any connected-car companion app is installed on firm-managed mobile devices or referenced in firm processes. If so, treat the app as a data-sharing endpoint and review what it can read (location, contacts, identifiers) under your mobile device policy.
• If your firm issues connected vehicles to staff, confirm with the fleet or leasing provider whether the manufacturer's app is provisioned and what data it transmits. The source names GM (myCadillac, myChevrolet, myBuick, myGMC), Honda, Nissan and Lincoln apps as sharing VINs with location or email data.

P2 within 72h

• For any connected-car app in scope, review the consent flow and the app's third-party sharing disclosures against your data-protection obligations. The study's finding is that consent is often given without the driver understanding the scope, so do not rely on the vendor's opt-in claim alone.
• Where an app embeds external web content, check whether third-party cookies and pixels are loaded in that context. The source states this is a documented collection path and that it typically happens without the driver knowing.

P3 within 7 days

• Add connected-car apps and their advertising or analytics recipients to your third-party data-flow register if they are not already there. The named recipients in the study are Alphabet, Amazon, Microsoft, Meta, Reddit and Pinterest.
• If you cannot establish what a connected-car app transmits, remove it from firm-managed devices or restrict its permissions until the vendor provides the data-flow detail in writing.

No vendor patch, version pin or configuration fix exists for this item. There is no software defect to remediate.

5. Indicators of compromise

No indicators of compromise available in the source material. The source contains no hashes, domains, IP addresses, file paths, registry keys or command-line artefacts. It describes a data-sharing arrangement between named companies, not malicious infrastructure.

The source does describe observable data flows. These are not atomic indicators and are recorded separately.

6. Detection

Insufficient indicators to author detection rules. The source provides no file artefacts, command-line strings, mutex names, registry keys, scheduled-task names or network values from which a YARA or Sigma rule could be built. The named companies and app names are not threat artefacts; a rule matching them would detect reporting about the study, not any malicious activity.

7. Sources

• Suzanne Smalley, The Record, "Automakers routinely share personally identifiable connected-car data with third parties, report says", https://therecord.media/automakers-routinely-share-connected-car-data-third-parties, 2026-09-30

8. Adverse Trace position

Adverse Trace assesses this as a consumer-privacy and third-party data-governance finding with no direct technical impact on EMEA financial services infrastructure. There is no CVE, no exploitation state and no threat actor, and the verified reference data resolved nothing for this item, so we assign no CVSS score or severity. The client-impact assessment is narrow: exposure exists only where a firm embeds a connected-car app, issues connected vehicles, or has staff using these apps on managed devices, and even there the risk is data leakage to advertising and analytics firms rather than intrusion. The study's figures and named recipients are single-sourced to Northeastern University and Consumer Reports; verify before acting on any specific app or recipient. We will monitor for follow-up reporting that names additional apps or recipients, and for any regulatory action in EMEA jurisdictions that changes the compliance position. Clients who need to know what a specific connected-car app transmits on their managed devices should contact us to scope a targeted review.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.