Apple And Google Face DOJ Test Over EZ Lynk App Data

The Department of Justice (DOJ, the federal law enforcement agency) probe involving Apple Inc. and Google LLC centers on subpoenas for at least 100,000 users of the Auto Agent app from EZ Lynk SEZC, a Cayman Islands vehicle software company. The demand turns an old Clean Air Act case into a test of whether app-store records can expose people who never altered emissions systems.

The privacy stake sits beside a serious pollution case. Federal lawyers say they need customers who can testify about how the technology was used; the company says a bulk pull of identities, addresses and purchase histories sweeps far past the evidence needed to prove that point.

The Subpoena Turns App Stores Into Witness Lists

Forbes first reported on May 14 that DOJ had subpoenaed Apple, Google, Amazon.com Inc. and Walmart Inc. for records tied to Auto Agent. The platform demands cover people who downloaded the app through subpoenas issued in March and April, while the retailer demands focus on buyers of the matching hardware.

The requested data matters because a download is not conduct. A person can install a car app, read diagnostic trouble codes, pair it with a vehicle, or never open it again. That gap is why a database built by the App Store, Google Play and retail checkout systems can become broader than the alleged emissions conduct.

On Google Play’s Auto Agent listing, the app is shown with 100K-plus downloads, a 4.8-star rating and about 3,000 reviews. That public count helps explain why the subpoena number is large before retailer records are even considered.

The Case Was Already About Software Liability

The government’s case began on March 8, 2021, when the U.S. Attorney’s Office for the Southern District of New York said it had sued the Auto Agent maker, related company Prestige Worldwide SEZC, co-founder Bradley Gintz and co-founder Thomas Wood under the Clean Air Act, the federal air pollution law. The 2021 DOJ lawsuit announcement accused the defendants of selling a device designed to let car and truck owners remove computerized emissions controls.

In the government’s Clean Air Act complaint, federal lawyers described the product as a three-part system made of the Auto Agent device, the cloud service and the mobile app. The complaint said the device plugged into a vehicle’s diagnostic port and helped transfer custom software to a vehicle’s computer system.

The company’s defense has leaned on a familiar tech-law argument. It argued that third-party technicians created the software tunes and that Section 230 of the Communications Decency Act, which shields online services from liability for some user content, protected the company from being treated as the publisher of those tunes.

The Second Circuit’s August 2025 Auto Agent opinion held that the complaint adequately alleged the system was a defeat device and that the defendants had directly and materially contributed to the creation of unlawful delete tunes, so Section 230 did not end the case at the pleading stage.

The Product Sits Between Diagnostics And Tuning

Auto Agent is not marketed only as a tool for emissions deletes. The company’s official Auto Agent app page calls it a connected On-Board Diagnostics II (OBD-II, the standardized vehicle diagnostic connector) scan tool for a driver and a chosen technician. It lists live data, diagnostic trouble codes, technician-shared recordings, vehicle functions and software updates as core uses.

The company’s own site also says vehicle functionality and data are available in a vehicle’s onboard diagnostic system and are not created by the company. That sentence is central to the defense posture: the app is the channel, while the technician and vehicle remain part of the action.

• Read live sensor data or clear a warning after repair.
• Share a vehicle recording with a chosen technician for remote help.
• Install a software update sent by a technician through the cloud service.
• Use a custom tune, including the type the government says can disable emissions controls.

The messy part is that the same chain can support lawful maintenance and illegal tampering. That is why a subpoena aimed at every downloader lands differently from a subpoena aimed at people who installed a specific tune, activated a device on a specific vehicle, or bought a kit marketed for an emissions delete.

The Emissions Harm Gives DOJ Its Hardest Argument

The government is not hunting a paperwork violation. The Environmental Protection Agency (EPA, the agency that enforces federal environmental rules) has treated aftermarket defeat devices as a major enforcement target because one modified truck can pollute far more than its compliant twin.

An EPA analysis of tampered diesel pickup trucks looked at evidence gathered in civil investigations over roughly five years. It estimated that emissions controls had been removed from more than 550,000 Class 2b and Class 3 diesel pickup trucks after 2009 and before 2020.

• 550,000-plus diesel pickups were estimated to have had emissions controls removed in the EPA review.
• 570,000 tons of excess oxides of nitrogen were projected over the vehicles’ lifetimes.
• 9 million compliant diesel pickups was the agency’s comparison for the air-quality impact of those tampered trucks.

Those figures do not prove anything about a particular Auto Agent user. They do explain why the government wants witnesses, sales records and usage evidence rather than relying only on public forum posts. A civil emissions case can still turn on granular customer behavior.

The Privacy Problem Lands On the Gatekeepers

The case also tests the privacy promises of the two app-store operators. Google says in its user information request policy that it requires valid legal process, reviews each request and may object when demands are overbroad. Apple’s law enforcement request guidelines say the company can object, challenge or reject requests that lack a valid basis or are unclear, inappropriate or overbroad.

Those policies now meet a hard fact pattern. A download record is held by the platform, not by the driver’s mechanic. A purchase record is held by a retailer, not by the vehicle owner’s engine control module. The resulting paper trail can identify people who touched the tool without showing what they did with it.

That tension has shown up across consumer tech. Oton Technology has covered the same privacy burden in hardware with Apple’s camera-equipped AirPods privacy test, while Google’s control over measurement data surfaced in Google’s AI Search click data gap. The Auto Agent dispute adds law enforcement pressure to the same platform question: who controls a user trail once a product moves through a giant app store?

Forbes quoted the company’s lawyers as saying the requests for potentially hundreds of thousands of people’s personally identifiable information (PII, data that can name or contact a person) go beyond the needs of the case and create serious privacy concerns. That objection is practical. If the government receives a full downloader list, a lawful user may never know whether their record was reviewed, retained, cross-checked against a retailer purchase, or used only as a dead end.

A Narrower Request Would Test the Same Case

A narrower subpoena would not block the government from proving an emissions case. It could ask first for records tied to activated hardware, identified device serial numbers, known technicians, specific date windows, or users who consent after a notice process. Each route carries tradeoffs, but each starts closer to alleged conduct than a bulk downloader list.

Federal lawyers may argue that narrowing too early lets key witnesses disappear into a market built around remote tuning and online sales. That concern has weight. The original complaint said the company refused to provide customer locations when EPA sought information, and the lawsuit asked for penalties and an injunction because the alleged conduct was ongoing.

The danger is precedent. If an app download plus a broad regulatory theory is enough to pull names from two mobile platforms and buyer records from two retailers, the next case does not need to involve diesel trucks. It could involve a drone app, a health device, a crypto wallet, a home security camera or any other product whose lawful and unlawful uses share the same download button.

Courts can solve that without blessing emissions tampering. They can require targeted identifiers, protective orders, notice where lawful, staged discovery and deletion rules for nonresponsive records. Those mechanics are boring, but they are where privacy survives civil enforcement.

If the court narrows the subpoenas, the government still gets a path to witnesses tied to specific alleged conduct. If it lets the demands stand, the strongest legacy of the Auto Agent case may be a simple one: an app download can become a government lead.