Your car and its mobile app are probably handing over all kinds of data to tech companies
- ID
- 30023
- Status
- summarized
- Published
- 30 Sep 2026, 6:18 AM
- Fetched
- 30 Sep 2026, 6:20 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/09/29/your-car-and-its-mobile-app-are-probably-handing-over-all-kinds-of-data-to-tech-companies/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 5.5
- Created
- 30 Sep 2026, 6:21 AM
- Tags
- Audience
- developersvibe_coders
What happened
Researchers at Northeastern University, working with Consumer Reports, tested 21 late-model vehicles from 17 automakers (including Cadillac, Chevrolet, Ford, Lucid, Rivian, Tesla and Toyota) plus 30 companion mobile apps. Nineteen of the 21 vehicles sent traffic to at least one third party — including Adobe, ContentSquare, Google, Microsoft, Meta, Snap and Yahoo — and 7 of the 30 apps handed over sensitive data such as VIN, email, phone number and precise location to tracking and advertising companies. Pairing the app to the car roughly doubled the exposure to advertising and tracking, per the peer-reviewed study.
Why it matters
If you ship a mobile app that embeds third-party analytics or ad SDKs, this is a concrete measurement of what 'linking an account' does: the study found app-to-vehicle pairing roughly doubled tracking exposure, and 7 of 30 apps leaked VIN, email, phone and precise location. Check whether your own SDKs collect precise location and device identifiers, and whether logging a user in with a stable ID merges an anonymous device profile into an advertising profile. Note the study covers US-market vehicles and apps, and names no Malaysian automaker, telco or app, so this is a privacy-engineering lesson for local builders, not a local policy or regulatory finding.
Discussion angle
The 7-of-30 apps leaked VIN plus email plus precise location to the same third parties — walk through what a similar combination looks like in a typical app (device ID + precise location + logged-in email) and whether anyone in the room has actually inspected their analytics SDK's network traffic.