Every New Car in Europe Now Has an AI Camera Watching the Driver — Privacy Debate Erupts

Starting July 7, 2026, every new passenger car and van sold in the European Union must include a camera pointed at the driver’s face. Not optional. Not available as a premium upgrade. Mandatory on every vehicle, from economy hatchbacks to luxury sedans, from urban delivery vans to family SUVs.

The requirement is part of the second phase of the EU’s General Safety Regulation (GSR), which has been rolling out in stages since 2022. Phase one, implemented in 2024, mandated intelligent speed assistance systems — technology that uses GPS and road-sign recognition to warn drivers when they exceed posted limits. Phase two goes considerably further: it requires advanced emergency braking capable of detecting cyclists and pedestrians, expanded safety glass for pedestrian protection, new testing standards for worn tyres, and the driver distraction warning system that has attracted the most public attention.

The European Commission estimates the full package of Phase two requirements will save approximately 25,000 lives by 2038.

How the System Works

The driver distraction warning system uses an infrared camera mounted inside the cabin, typically pointed at the driver’s face and upper body. The system analyzes gaze direction, head position, and eye blink patterns in real time to detect signs of inattention — looking away from the road, eyes closed, head drooping. When the system detects distraction above a threshold duration, it triggers a driver-facing alert: a visual warning on the instrument cluster, an audible tone, or both.

The specific thresholds are defined by technical standards accompanying the regulation. At highway speeds above 50 km/h, the system must trigger an alert if the driver’s eyes are off the road for more than 3.5 seconds. Between 20 and 50 km/h — urban driving speeds — the threshold extends to 6 seconds. Below 20 km/h, the system is inactive.

The regulation specifies that the system must operate without recording or transmitting footage. The infrared camera captures images for real-time processing, but those images are required to remain within the vehicle’s onboard processing system and must not be stored, uploaded, or transmitted to external servers. Automakers are required to attest to these data handling restrictions as part of type approval.

The system is required to be “always-on” when the vehicle is in motion above the lower threshold speed. Drivers cannot disable it, though the regulation does not require that the car refuse to operate if the system malfunctions.

Safety Case

The safety argument for driver monitoring is well-supported by accident data. Driver inattention and distraction are consistently identified as contributing factors in a substantial proportion of serious road accidents across the EU. In-cabin camera systems have been available in vehicles ranging from Tesla to Volvo to various Subaru models for years, typically framed as a safety feature for semi-autonomous driving modes. What is new is the mandate that every vehicle, at every price point, must include the technology.

The European Commission frames the requirement as a logical extension of the EU’s broader Vision Zero road safety agenda, which aims to eliminate traffic fatalities and serious injuries by 2050. Phase one of the GSR mandated intelligent speed assistance; Phase two adds driver monitoring; future phases are expected to address vehicle-to-infrastructure communication and other collision avoidance systems.

Road safety researchers largely support the mandate. Studies of voluntary driver monitoring systems in trucks and commercial vehicles — where they have been in use longer — show meaningful reductions in distraction-related incidents. The extension to passenger cars, where the technology is more novel, is expected to require a period of driver adaptation before behavioral effects are measurable.

Privacy Concerns

The backlash has been proportionately sharp. Privacy advocates, digital rights organizations, and a vocal segment of the European public have raised objections that range from the principled to the conspiratorial.

The principled concern centers on normalization: even if today’s regulation mandates that footage not be recorded or transmitted, the infrastructure for continuous in-cabin behavioral monitoring is now legally required in every new vehicle. Future regulations — or future automakers operating in regulatory grey areas — could expand what the camera does with its data. The precedent of mandating an always-on inward-facing camera in a private space is significant regardless of current data handling rules.

The more specific concern involves trust and verification. Automotive regulations require manufacturers to attest to data handling practices, but the actual processing happens in embedded systems that are effectively black boxes to consumers. Independent verification that footage is genuinely not being stored or transmitted requires access to firmware and system logs that are typically proprietary.

Several European data protection authorities have announced they will closely monitor implementation and have signaled interest in technical audits of the processing systems in specific vehicle models. The European Data Protection Board has issued guidance reminding manufacturers that even local, non-transmitted processing of biometric data — which facial analysis qualifies as — must meet GDPR’s standards for data minimization and purpose limitation.

Industry Response

Automakers have had several years to prepare — the GSR’s Phase two requirements were finalized in 2022 — and most major manufacturers have confirmed that their current model year vehicles comply. Some have gone further: BMW, Mercedes-Benz, and Volvo have implemented more sophisticated systems than the minimum specification requires, integrating driver monitoring with lane-keeping assistance and semi-autonomous driving mode supervision.

The regulatory push has also created a new hardware and software market. Camera and semiconductor suppliers including Continental, Valeo, and a growing number of Asian competitors have invested in driver monitoring system development over the past three years in anticipation of the mandate. The GSR requirement, combined with similar regulatory discussions in the UK, Japan, South Korea, and several US states, is expected to drive significant volume through this supply chain over the next decade.

The U.S. Picture

The EU has consistently moved faster on mandating in-vehicle safety technology than the United States, where the regulatory process is slower and industry opposition more organized. The NHTSA has been studying driver monitoring system requirements for several years and has issued advisory guidance encouraging automakers to include the technology voluntarily, but a federal mandate remains under discussion rather than finalized.

Several U.S. states are further along. California’s Department of Motor Vehicles has issued guidelines for Level 3 autonomous vehicles that effectively require driver monitoring capability. New York’s commercial vehicle regulations have included driver monitoring requirements for trucking fleets. But there is no equivalent of the GSR’s consumer vehicle mandate at the federal level.

What the EU’s implementation will provide, over the next two to three years, is a substantial real-world dataset on both the safety effects of driver monitoring systems and the privacy implications of their deployment at scale. That data will inform — and likely accelerate — regulatory discussions in jurisdictions that are currently still deliberating.

A Line Crossed

Mandatory driver monitoring sits at the intersection of several of the most contested questions in contemporary technology policy: behavioral surveillance in private spaces, the trade-off between population-level safety benefits and individual privacy, the governance of AI systems embedded in physical products, and the appropriate role of regulation in accelerating safety technology adoption.

The EU’s answer is unambiguous: when the safety case is strong enough and the technology mature enough, the default should be deployment, with privacy protections built into the technical standard rather than left to voluntary choice. Whether that trade-off is the right one will be debated for years. Starting July 7, it is also the law.