A federal mandate rooted in a bipartisan 2021 law is pushing surveillance technology into every new American passenger vehicle by model year 2027, and the debate about what that means for privacy, data ownership, and civil liberties is only just beginning.
Section 24220 of the 2021 Infrastructure Investment and Jobs Act, signed under President Biden with broad bipartisan support, requires the National Highway Traffic Safety Administration to mandate passive impaired driving prevention technology in all new passenger vehicles. That mandate survived into the current administration when President Trump signed the Consolidated Appropriations Act on February 3, 2026, preserving the funding and the legal requirement. The technology in question is not a breathalyzer. It is infrared cameras mounted on steering columns and A-pillars, continuously reading your eye movements, pupil size, head position, and behavioral signals to assess whether you are alert and sober enough to operate the vehicle. If the system decides you are not, it can prevent the car from starting or, in more advanced implementations, limit operation mid-drive.
The surveillance-in-a-car framing sounds dramatic until you realize that most new vehicles from Subaru, General Motors, Ford, and several European brands already ship with driver monitoring systems built in. Subaru's EyeSight system has been tracking driver attention for years. GM's Super Cruise uses infrared eye-tracking as a prerequisite for hands-free driving on approved highways. What the federal mandate does is make these systems non-optional, extend them to every new passenger vehicle regardless of price point, and , critically , give them the authority to refuse vehicle operation rather than merely sound an alert. The passive monitoring is the architecture; the veto power is the political and legal controversy.
NHTSA missed its November 2024 deadline for issuing a final rule. In March 2026, the agency delivered a report to Congress stating directly that the technology is not yet sufficiently reliable for a blanket mandate. Automakers have pushed back on the same grounds, citing false positive rates , scenarios where a sober, attentive driver in bright sunlight or with specific physical characteristics is misread as impaired , as a defect that cannot be resolved through software updates alone. That tension, between a law that is already on the books and technology that regulators themselves say is not ready, is where the practical timeline stands today. The 2027 model year target remains the legislative goal. The implementation reality is less certain.
The Privacy Architecture Nobody Voted On
The law's actual text does not require the data collected by these systems to stay inside the vehicle. As Road and Track noted in its analysis of the NHTSA report to Congress, the mandate specifies passive monitoring and impairment response, but says nothing definitive about what automakers may do with the biometric data these cameras generate. Every blink, every microsleep, every moment of distraction that the system logs is, in principle, a data record that exists on the vehicle's computing architecture. Whether that data stays local, gets transmitted to manufacturer servers via over-the-air update pipelines, or eventually flows to insurance companies adjusting premiums based on behavioral profiles is a question the current regulatory framework does not cleanly answer.
Insurance companies have an obvious commercial interest in driver behavioral data. The industry has already moved aggressively into telematics, with usage-based insurance programs from State Farm, Progressive, and others tracking speed, braking, and time of day through apps and OBD-II dongles. Eye-movement data and impairment scores represent a qualitative leap beyond that. A driver who consistently shows mild drowsiness indicators during a morning commute is a different actuarial risk than one who does not, and insurers will price that difference once they can measure it. The federal mandate creates the measurement infrastructure. Whether Congress intended to create a biometric data pipeline into the insurance industry is, at minimum, a question worth asking now rather than after 50 million cars are on the road collecting the data.
The Safety Case and Its Honest Limits
The government's stated justification is compelling on its own terms. NHTSA estimates the mandate could prevent 9,000 to 10,000 deaths annually, primarily through the elimination of drunk and drowsy driving, which together account for roughly a third of U.S. traffic fatalities. Drunk driving alone kills approximately 13,500 Americans per year. If passive monitoring technology can reliably detect and prevent a meaningful fraction of those events, the public health math is difficult to argue with. The cost increase per vehicle is estimated at $100 to $500, a figure that will be passed directly to consumers already navigating an auto market where the average new vehicle price exceeded $48,000 in early 2026.
The honest tension is between a safety goal that is real and a data infrastructure that is irreversible once installed at scale. Passive sensors embedded in 100 million American vehicles, connected to manufacturer software that updates over the air, represent a surveillance capability that did not exist five years ago and that no single piece of legislation explicitly authorized. The mandate was written to save lives. The data architecture it creates will outlast every administration that touches it, and its secondary uses will be determined not by Congress but by automakers, insurers, and whoever eventually acquires their data assets. That is the conversation worth having before 2027 model year cars start shipping.
Also read: Raya built a 2.5 million person waitlist without spending a dollar on marketing and that is the business lesson • Raya built a 2.5 million person waitlist without spending a dollar on marketing and that is the business lesson • DJI's Osmo Pocket 4 makes a serious case for being the last vlogging camera most creators will ever buy
