The study identified several high-profile models as being particularly active in their data-sharing habits. Vehicles found to be sending information to the widest range of outside advertising and analytics firms included the Cadillac Lyriq, the Chevrolet Blazer, the Lucid Air, and both the Tesla Model 3 and the Tesla Cybertruck. The presence of both "old-guard" manufacturers like General Motors and "tech-first" EV startups like Tesla and Lucid suggests that data harvesting is not a quirk of a specific business model, but rather a standardized industry practice. Whether a company builds its brand on traditional luxury or futuristic technology, the monetization of driver data appears to be a core component of the modern automotive ecosystem.
The researchers made a clear distinction between vehicle telemetry—the stream of data a car generates about its internal systems, sensors, and immediate surroundings—and the more personal data collected through smartphone integration. While telemetry is often framed by manufacturers as a tool for engineering improvements and safety diagnostics, the study suggests that the lines between technical data and marketable consumer insights are becoming increasingly blurred.
Companion Apps Exposed Names, VINs And Locations
While the vehicles themselves are active data transmitters, the study’s most alarming findings emerged from the analysis of companion mobile apps. These apps, which allow users to remotely start their engines, check battery levels, or locate their vehicles in a crowded parking lot, have become a primary vector for the collection of personally identifiable information (PII).
The researchers tested 30 different companion mobile apps and discovered that 28 of them sent data to at least one outside advertising or analytics company. Unlike the often-anonymized engineering data sent by the car’s hardware, the data harvested by these apps was frequently tied directly to the individual user.
Roughly a quarter of the apps tested were found to be transmitting sensitive PII, including the owners’ names, precise GPS locations, and Vehicle Identification Numbers (VINs). The combination of a VIN and a name is particularly powerful for data brokers; a VIN is a permanent, unique identifier for a vehicle, and when paired with a name and a residential address, it allows for the creation of a highly specific profile that can track a driver’s daily movements, habits, and lifestyle choices over the course of years.
The study singled out four General Motors apps—myCadillac, myChevrolet, myBuick, and myGMC—for pairing VINs with either an email address or precise location data. This discovery comes at a time of heightened scrutiny for GM and other automakers regarding how they handle driver information. Earlier reports had already highlighted Ford’s telematics practices, specifically how the automaker began sharing driving behavior data with insurance companies—a move that can directly impact a consumer’s premiums without them fully understanding why.
