Your car app knows where you parked. So, it turns out, does Meta.

Researchers from Northeastern University parked 21 cars at Consumer Reports' test centre in Connecticut and recorded everything they said to the internet. Almost all of them were talking to somebody.

The study was published on 29 September and is due to be presented at the ACM Internet Measurement Conference this month. It covered 21 vehicles from 19 brands, model years 2022 to 2025, plus 30 manufacturer phone apps. Twenty-eight of those 30 apps sent something to advertising or analytics companies. Seven sent genuinely personal details: names, precise location, and the vehicle identification number, a permanent unique code for your car in roughly the way a passport number is for you. The four General Motors apps, myCadillac, myChevrolet, myBuick and myGMC, each shared the VIN with ten third parties. HondaLink, MyNissan and the Lincoln app were also named. Among the recipients: Amazon, Google, Meta, Microsoft, Pinterest, Snap and Yahoo.

Pairing a VIN with an email address or a location is what makes the data valuable, because it stitches what you do in the car to what you do everywhere else. Manufacturers do disclose third-party sharing in their privacy policies, without saying who or for what. Honda asked the analytics firm Amplitude to delete the location and VIN data it had received and changed its app. One of the co-authors, Sarah Elizabeth Gillespie, put it plainly: it does not appear a customer can buy a new car that does not track them.

If one of those apps is on your phone, open its privacy settings and switch off everything optional, and read Consumer Reports' opt-out guidance before assuming there is nothing to switch off. The same question is worth asking about the PC at home, and Tendvane's privacy and accounts check walks through what Windows and your browser hand over by default.