Most modern cars and their companion apps share data with outside advertising and analytics companies, and regulators have been penalizing automakers for doing it without clear consent since January 2025. A Northeastern University study run with Consumer Reports, covered in the press from September 30, 2026, found that 19 of 21 tested vehicles contacted at least one third party over Wi-Fi, and that 7 of 30 companion apps sent identifiers such as VINs, emails, or precise location to advertising and tracking companies.
Every manufacturer whose app shared personal data had disclosed that it "may" share data with third parties. None said which third parties or why. That gap between a generic disclosure and specific consent is what the FTC, California, and Texas have targeted, and it applies to any business that embeds third-party code in an app or website.
What the Northeastern and Consumer Reports study found
The researchers tested 21 late-model vehicles from 19 brands, using cars from Consumer Reports' own fleet, and instrumented 30 manufacturer companion apps. Testing ran from October 2024 to August 2025. The paper, "Automatic Transmission," will be presented at the ACM Internet Measurement Conference (IMC '26), which runs October 12 to 16, 2026.
The headline numbers, taken from the paper and the authors' project page:
- Vehicles: 19 of 21 contacted at least one third party over Wi-Fi, and 11 of 21 contacted at least one advertising, tracking, or analytics domain. 13 of 21 contacted Google-owned domains of that kind, such as doubleclick.net.
- Apps: 7 of 30 transmitted sensitive identifiers (VINs, emails, phone numbers, location) to advertising and tracking companies. All but one of the 30 contacted multiple advertising and tracking third parties, and 70% contacted more than five.
- Exposure from pairing an app: adding the companion app roughly doubled a vehicle's exposure to advertising and tracking companies on average.
The sharpest example is General Motors. The myCadillac, myChevrolet, myBuick, and myGMC apps each sent the owner's VIN to the same 10 companies: Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap, and Yahoo. HondaLink sent VINs and precise location to the analytics firm Amplitude. The Lincoln and MyNISSAN apps were also among the seven.
The study has limits that matter. The researchers could not decrypt most vehicle traffic, so contacting a domain does not prove personal data was sent. They saw cellular traffic only from the Tesla Model 3, so they call their totals a lower bound. They also tested before the FTC's GM order took effect, and they have not alleged that GM breached it.
The manufacturer responses are the most useful part for compliance teams. Of 17 manufacturers contacted, 14 replied. All said the flows matched their contracts with vendors. Five blamed web pages that open inside the app's embedded browser. Seven said owners must read and accept third-party terms themselves. The authors summarize the pattern as "shifting the blame to the consumer." Only Honda changed anything: it asked Amplitude to delete the location data and updated HondaLink to stop sending it.
The enforcement wave: who acted, and on what theory
The study landed on top of a series of actions that began before it. They came from different agencies under different laws, and the penalties differ widely.
| Date | Who acted | Target | Outcome | What it was about |
|---|---|---|---|---|
| January 2025 | Texas Attorney General | Allstate and Arity | Lawsuit under the Texas Data Privacy and Security Act | Arity software embedded in third-party apps allegedly collected location data from over 45 million consumers without notice or consent |
| March 2025 | California Privacy Protection Agency (CPPA) | Honda | $632,500 fine | Excessive identity checks for opt-outs, asymmetric cookie choices, missing ad tech contracts |
| January 14, 2026 | FTC | General Motors and OnStar | Final consent order, 20 years, no monetary penalty | Misleading Smart Driver enrollment and sale of location and driving data without valid consent |
| March 2026 | CPPA | Ford | $375,703 fine | Email verification step that stalled opt-out requests |
| April 22, 2026 | Federal court, Northern District of Georgia | GM, OnStar, LexisNexis, Verisk | Most claims in a consolidated class action survived dismissal | Alleged sharing of driving data with insurers through data brokers |
| May 8, 2026 | California Attorney General, with district attorneys and CPPA support | General Motors | $12.75 million proposed settlement, subject to court approval | Sale of driving and location data to data brokers, plus keeping it longer than needed |
Three details in this table are often reported wrongly. First, the Texas suit is not a 2026 event. It was announced in January 2025 and was described by law firms as the first state attorney general action under a comprehensive privacy law. It has also stalled on jurisdiction: a Montgomery County court ruled in April 2025 that Allstate Corp. and Arity 875 LLC could not be sued in Texas, and an appeals court heard arguments on May 21, 2026, with no ruling found.
Second, the Honda and Ford fines came from the CPPA and were about how opt-outs work, not about selling driving data. Third, the $12.75 million GM settlement came from the California Attorney General, not the CPPA, and it is the first California action to enforce the CCPA's data minimization and purpose limitation rules, according to the Attorney General's office.
The California complaint covers 2020 to 2024. It alleges GM sold names, contact details, geolocation, and driving behavior data of hundreds of thousands of Californians to Verisk and LexisNexis, while its privacy policy said it did not sell driving or location data. The Attorney General's office adds that California drivers were probably not directly harmed on pricing because state insurance law bars insurers from using driving data to set rates. The case was about the sale and retention of the data, not about higher premiums.
What the FTC and California orders actually require
The terms are the best available template for what regulators now expect from any business that handles location data.
Under the FTC order, GM must get affirmative express consent, meaning clear permission separate from the privacy policy or terms of service, before collecting, using, or sharing connected vehicle data. Parts of the order run 20 years. GM also cannot share covered driver data with consumer reporting agencies for five years. It must publish a retention schedule, delete previously collected data, tell third parties to delete what they received, and give consumers a way to disable location tracking where the vehicle supports it. Limited exceptions cover emergency, theft, safety, and legal-compliance uses.
The California settlement adds a five-year ban on selling driving data to consumer reporting agencies, deletion of retained driving data within 180 days unless consumers give affirmative express consent, and a privacy program that documents risk and reports assessments to regulators.
Why this matters even if you do not make cars
The vehicle is incidental. Every action above rests on the same pattern: a business collected location or behavioral data, passed it to third parties, and relied on a general policy clause as consent. That pattern exists in mobile apps, smart home devices, wearables, and ordinary websites with embedded analytics tags.
Texas law treats precise geolocation as sensitive data, which calls for consent rather than a notice. Our guide to personal data versus sensitive data explains how to sort what you hold, and the Texas Data Privacy and Security Act guide covers the statute behind the Allstate case.
Data brokers are the other half of the story. The GM and Allstate cases both turn on what happens after data leaves the first company. California's Delete Act now makes that harder to ignore: according to the CPPA, data brokers must process deletion requests from the state's DROP platform beginning August 1, 2026, at least once every 45 days. See our California Delete Act guide and the data broker registration explainer.
The SDK problem inside the headline
The most practical finding for compliance teams is not about cars. It is that automakers appear not to have had full visibility into what the advertising and analytics code inside their own apps was sending. Their answers to the researchers (contracts cover it, the embedded browser did it) describe a company that approved a vendor but never watched the traffic. The authors also report that three of the five manufacturers who blamed embedded browsers said those pages would prompt users about tracking cookies, but the researchers did not find that to be consistently true in their recordings.
A policy can sound accurate and still be wrong if nobody checked what each SDK transmits, to whom, and on what consent basis. Our guides to third-party SDK compliance and mobile app consent management show how to run that audit. The Ford order is a useful reminder of the web side: it requires an audit of cookies, web beacons, and pixels, and compliance with opt-out preference signals such as Global Privacy Control, which our Global Privacy Control guide explains.
Practical checklist for businesses
Consent
▢ Ask for opt-in consent, separate from terms of service, before collecting precise location or sharing it with third parties
▢ Never make a core feature depend on agreeing to unrelated data sharing without disclosing that trade-off
▢ Offer opt-out choices of equal prominence, with no email or identity verification step that stalls the request
Disclosure
▢ Replace "may share with third parties" with named categories of recipients and the purpose for each
▢ Check that your privacy policy matches what your apps and site actually do today
Vendor and SDK review
▢ Inventory every SDK, tag, and embedded browser page in your apps and connected products
▢ Capture real network traffic and compare it to the inventory, not just to vendor contracts
▢ List which persistent identifiers (VIN, device ID, email, phone) each vendor receives
▢ Confirm data broker and analytics contracts limit use to the stated purpose
Location data handling
▢ Set a retention limit and delete location and driving data once the service no longer needs it
▢ Do not sell or share precise location with data brokers or consumer reporting agencies without a legal basis and consent
▢ Record consent and opt-out events so you can show a regulator what happened
A separate issue: shared access and abuse
Connected-car features can let someone other than the driver see a vehicle's location or control functions such as locks. The Safety Net Project at the National Network to End Domestic Violence documents this as a risk for survivors of abuse. California's SB 1394 (2024) requires automakers to cut off a person's remote access within two business days of a qualifying request. SB 719, signed June 30, 2026, moved some in-vehicle deadlines to July 1, 2027 for model year 2027 and older vehicles, unless implementation is technologically infeasible. If your product has shared-access or remote-control features, treat who can enable monitoring, and whether the monitored person can see and revoke it, as its own design question.
FAQ
Is my car selling my data?
Possibly. The Northeastern study found that 19 of 21 tested vehicles contacted a third party over Wi-Fi and that 7 of 30 companion apps sent identifiers to advertising and tracking companies, but contacting a domain does not prove personal data was sold. Regulators have separately alleged sales by GM and others.
What did the FTC's GM order require?
Affirmative express consent before GM collects, uses, or shares connected vehicle data, with parts of the order running 20 years. It also bans sharing covered driver data with consumer reporting agencies for five years and requires deletion and consumer controls.
Does this only apply to car companies?
No. The same expectation applies to any business whose apps or sites send location or behavioral data to third parties through SDKs, tags, or data brokers.
Who fined Honda and Ford, and for what?
The California Privacy Protection Agency fined Honda $632,500 in March 2025 and Ford $375,703 in March 2026, both over how opt-out requests were handled. The $12.75 million GM settlement came from the California Attorney General.
If my privacy policy mentions third-party sharing, am I covered?
Not necessarily. Every manufacturer whose app shared personal data in the study had disclosed possible third-party sharing, and regulators still acted on consent and specificity.
Was the Texas Allstate case the first under a state privacy law?
Law firms described it as the first state attorney general lawsuit under a comprehensive privacy law. A Texas trial court dismissed Allstate Corp. and Arity 875 LLC for lack of jurisdiction in April 2025, and the appeal was argued in May 2026.
Checking what your own apps and embedded SDKs actually send, rather than what your policy says they send, is the gap this enforcement wave exposed. Book a demo to see how Secure Privacy, a consent management platform, helps teams keep consent and third-party data flows consistent with what they disclose.
