As of Tuesday, July 7th, all new cars sold within the European Union are required by law to include an extra spy gadget, whether you want it or not.
The so-called driver monitoring camera, switched on at all times while the car is running above 20 km/h, and capable of precisely tracking the driver’s eye movements, is part of the now mandatory Advanced Driver Distraction Warning system, or ADDW.
Its purpose is to detect if the driver falls asleep or gets distracted, and if they look away from the road for a certain amount of time, depending on the speed, the car warns them with a combination of sound, light, or vibration.
The tech must also be so advanced as to know exactly if the driver is looking at the speedometer or the display screen, for instance, each with its own allowed number of seconds before the system activates. Looking at a phone or turning back to the kids, however, earns an instant warning.
The idea may be a noble one, as the EU estimated that the new measure will save 25,000 lives by 2038. However, it’s also problematic on multiple fronts.
Not only is it the latest annoying piece of EU overregulation—tests indicate that the system activates way too often, confuses blinking with drowsiness, and tends to tell drivers to take a break even if they’ve been driving for ten minutes—but the regulation leaves room for plenty of privacy concerns.
On paper, the ADDW should work on a “closed loop” system, meaning all data is processed locally, within the car, and no footage should be uploaded to any third-party server, be it the car manufacturer’s or law enforcement’s.
However, data privacy experts warned that the implementation might not be so straightforward.
For one, the EU regulation does not impose any independent audit to ensure that the ADDW systems installed actually operate on a closed-loop basis. Meaning both the car manufacturers and the tech companies selling them these systems could theoretically circumvent the rules and stealthily collect data on drivers.
Secondly, the EU offers little clarity over how the data is handled. We don’t know how much footage the system captures once a “distraction” decision has been made, nor how long that data is stored or when it gets deleted, if it ever does.
The implications are obvious. The continuous surveillance of the inside of a car can net car companies (or any third party that’s capable of hacking into it) a treasure trove of data that’s too valuable to pass on. Put simply, driver behavior can be turned into precious consumer data to be used internally or sold to the highest bidder.
And this is not just a hypothetical, but something that already happened. In 2024, GM, Honda, Acura, Kia, Hyundai, and Mitsubishi were all caught sharing driver behavior data—including mileage, speed, hard braking, and rapid acceleration—with multiple data brokers. These turned the data into “risk scores” and sold them to insurance companies, which then freely used them to increase their personalized rates by over 20%.
Another investigation in 2023 revealed that Tesla employees had been secretly pulling and sharing video footage made by the forward-facing cameras of their cars, including clips of crashes, road-rage incidents, and even of people getting undressed near their vehicles.
Now imagine what could go wrong when suddenly millions of European cars all have cameras facing inside. Even if GDPR should protect consumers on paper, it’s only a matter of time until someone gains access to all the sensitive data and footage these cameras capture along the way.
