A study by Northeastern University and Consumer Reports reveals that automakers are collecting extensive driver data to build consumer profiles for advertisers. Analysis of 21 vehicles and 30 automaker apps found that 19 cars sent data to at least one third-party company via Wi-Fi. Seven apps passed sensitive identifiers, including VINs and email addresses, to advertising and analytics firms.
Four General Motors apps -- my Cadillac, my Chevrolet, my Buick and my GMC — sent VINs to 10 companies including Microsoft and Adobe. Honda Link sent VINs and location data to Amplitude, while Lincoln and My NISSAN apps also shared data. Unlike phone advertising IDs, VINs cannot be reset, allowing ad companies to tie owners to activity across other apps and websites.
Consumer Reports notes that 10 of the 21 cars contacted no advertising domains independently, but pairing their apps exposed owners to 23 and 25 tracking companies respectively. Tesla Model 3 reached 22 such companies from the car, with its app adding two more. Since cellular data from the Model 3 could not be fully decrypted, real totals are likely higher.
For most cars, the bulk of ad-tech exposure came from the phone app. Of the 30 apps tested, 28 contacted at least one advertising or analytics company. Automakers cite vendor contracts and privacy policies.
The FTC recently finalized a punishment against GM over data sharing, banning the sale of driver data for five years and requiring express consent for future data collection. However, the study predates this order. Seventeen manufacturers were approached; 14 confirmed data flows matched their vendor contracts.
Seven said owner responsibility applies, while five attributed tracking to web pages opened inside apps. Privacy policies of the seven sharing apps disclose data may pass to third parties without specifying which ones or why. Owners declining Tesla's agreement face warnings of reduced functionality, while Rivian says disabling collection limits features like navigation.
Honda agreed to delete location data and update its app to stop sending it. Researchers urge regulators to step in.
Source: Engadget · Summarized by HeadlinesBriefing