The Camera That Cannot Be Turned Off

This piece extends the connected-vehicle data series — “The Car That Knows Too Much,” which documented Toyota’s location-data exposure, Volkswagen’s undisclosed law-enforcement data sharing, and the surveillance architecture embedded in modern vehicles — and the ambient-monitoring work in “The Room Has Been Watching” and “The Credential You Can’t Change.” The pattern across all of them is identical: a safety or convenience justification, infrastructure deployed at scale, and data governance that arrives after the architecture is already in millions of devices.

Yesterday. Every new car. Every new driver.

Since 7 July — yesterday — every new car and van registered across the European Union watches its driver. An infrared camera aimed at the person behind the wheel is now a legal condition of sale. The requirement is not hypothetical and not proposed; it reaches tens of millions of vehicles a year, and it arrives wrapped in the language of safety.

The system is the Advanced Driver Distraction Warning — ADDW, specified by Commission Delegated Regulation (EU) 2023/2590 under the General Safety Regulation. A small infrared camera near the steering wheel or dashboard tracks where the driver’s eyes point. Look away from the road for more than 3.5 seconds above 50 km/h, or more than six seconds in the 20–50 km/h band, and the car warns you with some combination of light, sound, or vibration. It switches on automatically above about 20 km/h, and while it can be silenced for a single drive, it cannot be permanently turned off — it re-arms every time the engine starts.

The safety case is real and documented. EU-funded research estimates driver distraction plays a role in 5% to 25% of car crashes, and the broader package of safety rules this camera belongs to — not the camera alone — is projected by the Commission to save more than 25,000 lives by 2038. The people who will not die in distraction-related crashes are real people, not a regulatory abstraction.

That is the easy part to explain. The harder part is what the camera does with what it sees — and that is the part the regulation, the manufacturers, and the Commission have not adequately answered. Not because the answer does not matter, but because the question has not been pressed with the rigour the safety case has been.

What the regulation actually requires — and what it prohibits

The specification needs to be stated precisely, because the gap between what the regulation requires and what circulates on social media is already significant, and conflating the two weakens the concerns that deserve serious treatment.

One detail most commentary buries: the ADDW system must function without the use of biometric information, and it must not identify the occupants. The regulation mandates gaze detection and prohibits biometric identification. Those are technically distinct capabilities. A system that tracks where a driver’s eyes point — relative to a defined road-facing zone — does not need to know who is driving. A facial-recognition system does. ADDW, as written, requires the first and forbids the second.

But the prohibition on facial recognition does not change what is being captured. Using an infrared camera aimed at the driver’s face, the system continuously analyses gaze direction, eye movement, and related signals, in real time, from every driver of every new vehicle. The ban constrains one specific use of that stream — identification. The stream itself exists regardless. And the question of what else it can be used for, and by whom, is the one the safety framing has not yet been required to answer.

What happens to the footage nobody has explained

This is the central question, not a peripheral one. The ADDW regulation mandates the hardware, specifies the trigger thresholds, and requires the warning output. It does not specify data-retention periods. It does not mandate deletion beyond what is needed for the system to function. It does not, on its own, resolve third-party sharing, insurer access, data-broker absorption, or law-enforcement access to anything derived from in-cabin sensing over the life of the vehicle.

The connected-vehicle series already documented what automaker privacy practices look like when examined honestly rather than accepted at face value. Toyota admitted collecting facial and voice data; Volkswagen fed location data into undisclosed commercial channels and drew a €1.1 million fine; Mercedes had roughly 130,000 UK customer records surface on a criminal forum. The pattern is consistent: connected-vehicle data is collected for one stated purpose and used for others that were not disclosed at the time of collection.

The ADDW camera is new hardware in that existing ecosystem. My assessment is that there is no structural reason to expect the camera’s data surface to be governed more transparently than the GPS location, the telematics, and the cabin microphones that the same manufacturers — now installing ADDW as a legal requirement — have already been documented collecting, sharing, and losing. The prudent move for any driver is to read the manufacturer’s actual privacy policy, not its marketing page, for how long eye-tracking-derived data is retained, whether it is shared, and whether it ever leaves the vehicle.

The capability gateway nobody is discussing

The detail that deserves the most attention is not the camera. It is what the camera makes structurally possible next — and here precision matters, because the popular version of this concern is wrong in a way that discredits the real one.

The popular claim is that the distraction camera will lock your ignition if it detects alcohol. It will not, and it cannot: ADDW does gaze detection, not alcohol detection. What is true is adjacent and separately mandated. The same General Safety Regulation package requires alcohol-interlock installation facilitation — a standardised interface (Delegated Regulation (EU) 2021/1243) that makes it straightforward to fit an alcohol interlock. That is a different provision from the camera, and it is worth stating cleanly rather than merging the two.

The accurate concern is structural, and it is stronger than the myth. The ADDW camera is infrastructure — a permanent, always-on sensor pointed at the driver, in every new vehicle. And under Article 14 of the General Safety Regulation, the Commission has committed to develop and adopt further ADDW requirements by July 2027, extending beyond simple visual distraction toward intermittent and cognitive distraction. The camera is mandated now; the Commission defines what it must additionally do by 2027; the manufacturers implement it; the drivers learn about it through a privacy policy they will not read, in a vehicle whose safety systems cannot be permanently disabled. This is not a conspiracy. It is a regulatory pipeline operating exactly as designed — incremental, documented, publicly announced, and structurally invisible to almost everyone it affects until the capability is already in their car.

GDPR applies. That is both reassuring and insufficient.

The GDPR applies to any system that processes personal data about an identifiable person in the EU, and an infrared camera reading a driver’s gaze almost certainly falls within scope. Manufacturers cannot hide behind the General Safety Regulation’s vaguer language; they must observe the GDPR’s core principles — collect only what is necessary, retain only as long as needed, and give drivers rights over their data. That is real and meaningful.