The EU has begun mandating the installation of facial recognition cameras in cars sold within the EU.

From July 7, 2026, all new cars sold in the European Union (EU) will be required to be equipped with driver monitoring cameras that point towards the driver's face. The purpose of the system is to reduce traffic accidents caused by distracted driving, but there is little regulatory description as to how the collected video and data will be handled afterward, and privacy concerns have been raised.

All Cars Sold in the EU Now Require a Camera Aimed at Your Face. It's Still Not Clear Where That Data Goes | All About Cookies
https://allaboutcookies.org/eu-mandatory-distracted-driver-system

This driver monitoring camera system is called the 'Advanced Driver Distraction Warning System (ADDW),' and it uses small infrared cameras mounted near the steering wheel and on the dashboard to track the driver's gaze. If the driver looks at their smartphone, a child in the back seat, or the radio for an extended period while driving, the system alerts the driver with a warning light, sound, and vibration.

ADDW automatically activates when the vehicle speed exceeds 20 km/h and cannot be permanently turned off. If the driver takes their eyes off the road for more than 3.5 seconds at high speeds, or more than 6 seconds at low speeds, a warning is issued using a combination of light, sound, and vibration. The EU estimates that ADDW will save more than 25,000 lives by 2038.

On the other hand, some users have reported that the warning system is overly sensitive during actual driving. Gocar.be , a major Belgian automotive information website, conducted a test and found that the warning activated even during normal driving that did not involve distracted driving. Furthermore, the warning would sound even if the driver simply looked at the scenery on an empty highway or changed the music playing in the car. Although it can theoretically be turned off manually, it automatically reactivates when it detects problematic eye movements, effectively meaning the system constantly monitors the driver.

Similar experiences have been reported by other users. One user was driving a rented Ford Puma when a warning prompting them to take a break appeared about 10 minutes after starting to drive, and another 10 minutes later a red warning light came on and a loud warning sound was emitted. This user said they found the warning itself 'very distracting' and reported that even if they turned the system off, it would reappear every time they restarted the engine.

A further problem is how the data acquired by ADDW is handled. By regulation, ADDW is required to operate in a 'closed loop' that is completed within the vehicle and does not use biometric authentication data. In other words, the data used to detect distracted driving should not be transmitted outside the vehicle and should not be shared with the car manufacturer or third-party servers.

However, there is no clearly defined independent audit system to verify whether a closed data loop is actually being maintained. Furthermore, it remains unclear how eye-tracking data and video are processed after analysis, for how long they are retained, and when they are deleted. While general safety regulations require that data not be recorded or retained beyond what is necessary for the purpose, what is required in ADDW is not specifically defined.

In March 2024, it was reported that GM, Honda, Acura, Kia, Hyundai, and Mitsubishi had been sharing driving data such as mileage, speed, sudden braking, and sudden acceleration with a data broker. The data broker processed this information into a 'risk score' and sold it to insurance companies. One driver reportedly found out that his driving records had been compiled into 258 pages after his insurance premiums increased by 21%. GM ended the data sharing after the report and later settled with California for $12.75 million (approximately 2.05 billion yen).

It has been alleged that manufacturers such as GM, Honda, Kia, and Hyundai are sharing driving data with insurance companies without explicit consent, and that this data is being used to review insurance premiums - GIGAZINE

Regarding video data, a Reuters investigation in 2023 revealed that a former Tesla employee had privately shared customer in-car camera footage through the company's internal messaging system. The shared footage reportedly included not only scenes of accidents and road rage, but also some footage of people who were near the vehicles.

Tesla owner sues Tesla for privacy violation after reports that video recordings were shared - GIGAZINE

In the EU, the General Data Protection Regulation (GDPR) applies, meaning manufacturers cannot freely handle drivers' personal information. Infrared cameras that read drivers' faces and gaze are likely to be systems that process information about identifiable individuals, and therefore must adhere to GDPR principles such as collecting only the minimum necessary data and retaining it only for the necessary period. However, even here, it remains unclear what constitutes 'the minimum necessary' data.

While ADDW (Active Driver Distraction Warning) is a valuable mechanism for reducing accidents caused by distracted driving, overly sensitive warnings could create new stress for drivers, and the handling of gaze and facial data remains unclear, failing to alleviate driver anxiety. Therefore, it is necessary to clarify the scope of data that can be collected, the retention period, and the deletion method, and to establish an independent audit system to ensure that data is not transmitted to manufacturers or third parties.