Pinterest probably doesn't need your car's VIN, but General Motors' apps were sending it there anyway — and to Snap, Yahoo, Meta, Google and the data broker Acxiom. At least, that's according to a recent study from Northeastern University, which tested 21 late-model cars and 30 automaker apps on Consumer Reports' fleet between October 2024 and August 2025.
Nineteen of those cars sent data to at least one third-party company via Wi-Fi, with seven of the apps passing identifiers like VINs, email addresses and precise locations to advertising and analytics companies. Four of those seven belong to GM, which has been under a 20-year FTC privacy order since January.
Those four GM apps are myCadillac, myChevrolet, myBuick and myGMC, and each sent VINs to 10 companies including Microsoft and Adobe. Meanwhile, HondaLink sent VINs and location to the analytics firm Amplitude, with the Lincoln and MyNISSAN apps making up the remainder of the list. But unlike a phone's advertising ID, a VIN can't be reset, so pairing one with an email address lets ad companies tie an owner to activity on other apps and websites.
According to Consumer Reports' per-vehicle summary, 10 of the 21 cars contacted no advertising or tracking domains on their own. The Buick Envista and Nissan Ariya were among them, yet pairing their apps exposed owners to 23 and 25 ad and tracking companies respectively. Tesla went the opposite way, with the Model 3 reaching 22 such companies from the car while its app added two.
Source link







