Advisories
Automakers Share PII from Connected Cars with Advertisers and Data Brokers
A study shows that 19 of 21 major automakers routinely transmit personally identifiable data from connected vehicles to advertising and data‑broker networks. The data includes names, email addresses, VINs, and precise geolocations, and is shared with tech giants such as Google, Amazon, and Meta. Defenders should audit app integrations, enforce data‑minimization, and monitor outbound telemetry for compliance.
What Happened
Recent research from Northeastern University and Consumer Reports found that 19 of 21 major automakers routinely forward personally identifiable data from connected‑car systems to third‑party advertisers, analytics firms, and data brokers. The study examined 30 vehicle‑connected apps; 28 shared data with at least one external partner, and 7 transmitted PII such as names, email addresses, and precise GPS coordinates.
Impact
Automotive data now flows into the ecosystems of Google, Amazon, Microsoft, Meta, Reddit, and Pinterest, enabling advertisers to target drivers with highly granular profiles. General Motors’ companion apps (myCadillac, myChevrolet, myBuick, myGMC) and apps from Honda, Nissan, and Lincoln bundle VINs with location or email data, creating a rich dataset for data brokers. California regulators fined GM over $12 million and barred it from sharing driver data with credit‑reporting agencies and data brokers for five years.
What Defenders Should Do
- Audit all connected‑car app integrations to identify outbound telemetry to ad‑tech and data‑broker domains.
- Enforce strict data‑minimization policies: restrict app permissions to only the data required for core functionality.
- Implement network segmentation and outbound filtering to block or log traffic to known advertising and analytics endpoints.
- Review and update privacy‑by‑design controls in vehicle software stacks, ensuring that PII is not transmitted without explicit user consent.
- Stay informed on regulatory actions (e.g., California’s enforcement against GM) and adjust compliance programs accordingly.
Automotive privacy is no longer a theoretical risk; it is an operational reality that requires immediate attention from SecOps and system administrators.
Related articles
CrowdStrike & Intel Unveil On‑Device AI for Instant Data Classification
CrowdStrike has partnered with Intel to embed large‑language‑model inference directly into its Falcon endpoint agent, enabling real‑time, privacy‑first data classification on dedicated AI hardware. The new capability classifies files, emails, and clipboard content locally, tagging them with sensitivity labels such as PII, PHI, or trade secrets without sending data to the cloud. This zero‑latency, scalable solution feeds Falcon’s data‑loss‑prevention engine, blocking exfiltration before it starts and easing compliance with GDPR, HIPAA and other regulations.
Read briefing
CrowdStrike Unveils On‑Device AI‑Driven Data Classification in Falcon
CrowdStrike has partnered with Intel to embed language‑model intelligence directly into Falcon’s data‑security engine, enabling real‑time, on‑device classification of sensitive files. The new capability sidesteps cloud latency, preserves privacy, and lets endpoints flag PII, PCI, or regulated data before it leaves the device. Leveraging dedicated AI hardware and lightweight models, the update delivers enterprise‑grade visibility without compromising performance.
Read briefing
DMDC File‑Sharing Server Breach Exposes 3 Million DoD Personnel Records
The Defense Manpower Data Center (DMDC) confirmed that a security flaw in its file‑sharing system allowed unauthorized users to read unencrypted personal data for roughly nine months. The breach, discovered in mid‑July 2026, exposed PII for about 3 million Department of Defense personnel. Defenders should verify DMDC system patches, monitor for suspicious activity, and review access controls on file‑sharing services.
Read briefing
CrowdStrike Deploys On‑Device AI for Real‑Time Data Classification in Falcon Data Security
CrowdStrike, in partnership with Intel, has unveiled a next‑generation feature for Falcon Data Security that leverages on‑device language models running on dedicated AI hardware. The new capability instantly tags and classifies sensitive information—such as PII, PHI, and financial data—directly on endpoints, eliminating the need to ship raw data to the cloud. This reduces latency, preserves privacy, and tightens compliance controls while maintaining the same high detection accuracy that Falcon is known for. The move underscores CrowdStrike’s commitment to edge‑AI security and sets a new standa
Read briefing