Home / Technology / Car Apps Share Your VINs: Major Automakers Caught in Data Leak
Car Apps Share Your VINs: Major Automakers Caught in Data Leak
12 Oct
Summary
- Automaker apps shared sensitive data, including VINs, with third parties.
- General Motors apps sent VINs to 10 companies, violating a previous FTC order.
- Vehicle Identification Numbers, unlike phone IDs, cannot be reset by owners.
A study conducted between October 2024 and August 2025 has uncovered significant privacy breaches in automotive applications. Researchers found that 19 out of 21 tested late-model cars transmitted data to third parties via Wi-Fi. Notably, seven of these vehicle applications shared identifying information, such as Vehicle Identification Numbers (VINs), email addresses, and precise locations, with advertising and analytics firms.
General Motors was a prominent focus, with its myCadillac, myChevrolet, myBuick, and myGMC applications identified as sending VINs to 10 different companies, including Microsoft and Adobe. This occurred despite GM being under a 20-year FTC privacy order since January. HondaLink, Lincoln, and MyNISSAN apps were also implicated in similar data-sharing practices.
The implications of VIN sharing are particularly serious. Unlike a phone's advertising ID, a VIN cannot be reset, making it a permanent identifier. When paired with an email address, it allows advertising companies to link an owner's activity across various applications and websites, raising substantial privacy concerns.
