19 of 21 tested connected cars contacted third parties over Wi-Fi

The vehicle itself was only part of the picture. Researchers also examined 30 companion mobile apps to better understand the connected-car ecosystem, as reported by TechCrunch.

Reporting on the study found that seven of those apps shared sensitive information such as vehicle identification numbers, emails, phone numbers, and precise location with third-party companies associated with tracking and advertising, according to TechCrunch. The Verge reported that seven companion apps — HondaLink, Lincoln, MyNissan, myCadillac, myChevrolet, myBuick, and myGMC — transmitted VINs, phone numbers, and precise locations directly to advertising networks.

The Verge reported that researchers were particularly concerned by the pairing of a vehicle’s VIN with identifiable personal data, which allows data brokers to build detailed dossiers on individual drivers. TechCrunch similarly reported that combining multiple forms of information can help advertisers and data brokers build in-depth consumer profiles.

One automaker changed course

Honda was the clearest example of a company changing its practices after the findings were raised. The Verge reported that Honda asked its analytics provider Amplitude to delete collected location data and updated the HondaLink app so it would stop transmitting geolocation. Ars Technica similarly reported that Honda no longer shares precise location data with at least one tracking company after being contacted.

The broader takeaway from the coverage is that connected cars remain a significant privacy problem, and that companion apps can make that problem worse by increasing the number of outside companies involved. Ars Technica described connected-car privacy as still abysmal and reported that using a companion app can multiply the problem. TechCrunch emphasized how difficult the issue is for consumers to avoid if they want to keep using connected features such as remote start and unlock.