How your car is spying on you, "for your safety"

Every new car and van registered in the European Union since 7 July 2026 must carry a camera that tracks the driver's eyes and head movements. The requirement sits in Regulation (EU) 2019/2144, the bloc's General Safety Regulation. It applied first to newly certified models in July 2024, and since 7 July 2026 no vehicle without the system may be registered as new.

Before a carmaker can sell a model in the EU, that model has to pass type approval, the certification that checks it against the bloc's safety rules. The regulation calls the camera system an advanced driver distraction warning, or ADDW, which is a legal term and not a brand name. Its technical rules sit in a separate delegated regulation, which requires the system to monitor the direction of the driver's gaze, and to do so without relying on biometric personal data, meaning data derived from a person's physical, physiological or behavioural characteristics. A system that identified a driver from their face would fall outside what the rule allows.

A camera in the cabin follows that gaze, and the system warns the driver when the gaze rests away from the road for more than 3.5 seconds at 50 kilometres an hour or above. Between 20 and 50 km/h the limit is six seconds, and below 20 the system does not have to be active at all.

Already on board

EU rules have been putting data-collecting hardware in new cars for years. Every new vehicle type has carried a satellite positioning receiver since 31 March 2018 under the bloc's eCall rule, so the car can call emergency services after a crash. The same General Safety Regulation added an event data recorder, which cannot be deactivated and which records, for the moments shortly before, during and immediately after a collision, the vehicle's speed, its braking, its position and tilt on the road, the state and rate of activation of all its safety systems, and the input parameters of its active safety systems. That requirement reached newly certified models in July 2022 and all new vehicles in July 2024.

Most new models also carry radar and forward-facing cameras for lane-keeping and emergency braking, plus a telematics unit that stays connected to the manufacturer's servers while the engine runs. A drowsiness warning has been required on every new vehicle since July 2024, but the cabin camera is the first system that watches the driver itself.

Footage rules, no transparency

The General Safety Regulation is explicit about what the system may do with what it records. Article 6(3) says driver drowsiness and advanced driver distraction warning systems must not continuously record or retain data beyond what is necessary for the purpose, and must operate within a closed-loop system. It adds that the data shall not be accessible or made available to third parties at any time, and shall be immediately deleted after processing.

Verification is where the texts go quiet. A technical service has to ensure that a system meets the criteria in Part 1 of the annex, and the privacy conditions sit in that part, but no test and no document is prescribed for them. The documentation package filed by manufacturers covers activation speeds, the metrics used to measure distraction, the areas of the cabin treated as off-road, the warning interface, the limitations of the system and how it was validated. It asks nothing about where the images are processed or how deletion is performed, and neither deletion nor third-party access is mentioned anywhere in the delegated regulation.

Buyers cannot decline the hardware. The camera comes with every version of a car, whatever the options, trim level or price.

Past incidents in Europe and the US

The closed-loop rule covers the distraction warning system and nothing else. Location data from the emergency call module, crash records from the event data recorder and the permanent telematics link to the manufacturer's servers sit under other rules, and cars with no driver-facing camera have already leaked data from them on both sides of the Atlantic.

In Europe, the Chaos Computer Club, a German hacker association, reported in December 2024 that Cariad, Volkswagen's software subsidiary, was collecting movement data from hundreds of thousands of Volkswagen, Audi, Seat and Skoda vehicles, keeping it for long periods, and leaving it accessible on the internet without protection, along with information about the owners. The records held the precise place and time at which each ignition was switched off. Among those affected were fleet operators, management and supervisory board members of DAX-listed companies, and police forces. The movements of 35 electric patrol cars of the Hamburg police sat on the Volkswagen platform where third parties could read them, and the club also found records from the car park of Germany's foreign intelligence service and from the United States Air Force base at Ramstein. Reporting on the same data put the number of vehicles at about 800,000, with location accurate to within ten centimetres for roughly 460,000 of them, and said Volkswagen closed the hole after being notified.

In the United States, General Motors sold the names, contact details, geolocation data and driving behaviour of hundreds of thousands of OnStar subscribers in California to the data brokers LexisNexis Risk Solutions and Verisk between 2020 and 2024, according to the case the state brought against the company. The state found that GM had kept the data long after it was needed to run OnStar, and that the brokers intended to sell it for insurance rate-setting. California's attorney general, the district attorneys of Los Angeles, Napa, San Francisco and Sonoma counties and the state privacy agency settled in May 2026 for $12.75 million in civil penalties, which the attorney general called the largest penalty under the state's privacy act to date and its first data minimisation case. GM agreed to stop selling driving data to consumer reporting agencies for five years, to delete retained driving data within 180 days absent express consent, and to ask both brokers to delete what they had received.

The Federal Trade Commission finalised a separate order in January 2026 that bars GM for five years from disclosing geolocation and driver behaviour data to consumer reporting agencies, and requires affirmative express consent before it collects connected vehicle data. The order runs for 20 years, and the complaint behind it was announced in January 2025.

A 2023 review took in brands from both markets. The Mozilla Foundation examined 25 car brands based in the United States, Germany, Japan, France and South Korea, and every one of them failed its privacy test, a first in the guide's seven-year history. Its researchers spent 600 hours on the companies' privacy policies, apps and written answers. They found that the brands can collect data as sensitive as sexual activity, immigration status, race, facial expressions, weight, health and genetic information, and can share or sell it to third parties.

Ratings push past the legal minimum

Beyond official mandates, third-party assessments of vehicle safety push automakers towards even more monitoring of drivers.

Euro NCAP, the body whose star ratings carmakers advertise, is not a regulator. It is not a government agency and not part of the car industry, and the programme is supported by a consortium of European governments, motoring clubs, consumer organisations and insurance bodies.

Its ratings work on points that add up to a star score, and the 2026 protocols are the largest revision since the overall rating system was introduced in 2009. Driver monitoring was worth two points under the protocol that took effect in 2023. From 2026 it sits in a category called Driver Engagement, inside a new Safe Driving stage scored out of 100, and the driver monitoring assessment alone carries 25 points.

Points are not awarded to a system the driver can switch off. To score at all, it has to be on by default at the start of every journey, deactivation must not be possible with a single press of a button, and the sensitivity must not be adjustable. Euro NCAP then scores the driver states a system catches, among them distraction, microsleep, sleep, an unresponsive driver and impairment from alcohol or drugs. For distraction the warning has to come from 20 kilometres an hour. For impairment the system has to work from 50, and it is allowed a learning period of up to 10 minutes from the start of each journey before it is expected to detect anything. The test procedure has the driver hold their gaze on fixed points in the cabin, including their own lap. The highest scores go to cars that track eyes and head continuously and feed that reading into how sensitively their driver-assistance systems behave.

The rating points came before the mandate. Euro NCAP has awarded points for driver monitoring since 2020 and doubled them in 2023, before the system became compulsory on new models in July 2024. One supplier, Smart Eye, says its technology has won more than 300 design contracts from carmakers including BMW, Geely and Polestar.

Carmakers were fitting the cameras to earn stars before the law asked them to.

Scale and what comes next

EU registrations rose 5.3% in the first eight months of 2026 from a year earlier, to 7.55 million cars, and battery-electric models accounted for 1.64 million of them, or 21.7% of the market. That is close to one million new cars a month, and every one registered since 7 July carries the camera.

Two enforcement routes exist and neither has been tested on these systems. Type approval is policed by the national authority that granted it, and the data rules by the data protection authority of each of the 27 member states, whose cases generally start with a complaint.

EU lawmakers are separately weighing the message-scanning proposal known as Chat Control and a bloc-wide age-verification system for online services.