Congress ordered the camera.
It forgot the rules.

What the law actually says

In November 2021, Congress passed the Infrastructure Investment and Jobs Act. Buried at Section 24220 is a requirement that has nothing to do with roads and bridges. It orders the Secretary of Transportation to write a Federal Motor Vehicle Safety Standard requiring new passenger vehicles to carry "advanced drunk and impaired driving prevention technology."

Read the definition the statute gives, because the first branch of it is the one that matters. Such a system is one that can:

• "(A)(i) passively monitor the performance of a driver of a motor vehicle to accurately identify whether that driver may be impaired; and (ii) prevent or limit motor vehicle operation if an impairment is detected"; or
• (B) passively detect blood alcohol concentration at or above the legal limit and prevent or limit operation; or
• (C) a combination of the two.

Branch (A) does not mention alcohol. It does not mention a breathalyzer, a touch sensor, or a steering input. It describes a system that continuously assesses the person behind the wheel and can stop the car. Congress wrote a functional requirement and left the method open, and the cheapest way to satisfy it is a camera pointed at your face.

The statute set a hard deadline: a final rule not later than 15 November 2024, with compliance two to three years after that. Nothing in Section 24220 places a single condition on what the monitoring system may record, how long it may keep it, or who may ask for it.

Where the camera enters

Congress did not specify a camera. The regulator did the specifying. In January 2024, NHTSA published an Advance Notice of Proposed Rulemaking (89 FR 830, Docket NHTSA-2022-0079) laying out how it might be done. The document is where the abstraction becomes hardware.

NHTSA describes reviewing camera-based driver monitoring systems that can track "driver's eye gaze, eyelid/eye closure, pupil size, head/neck position, posture, hand/foot position, and facial emotion during the driving task." Elsewhere it lists the specific signals such a system reads:

• Head pose and gaze activity, meaning the number and distribution of your glances.
• PERCLOS, the percentage of time your eyes are closed.
• Blink speed and eye closure duration.
• Yawns and other facial expressions.

To establish that this is not speculative, NHTSA cites systems already on the road. In a footnote supporting its point about camera-based monitoring in vehicles with Level 2 automation, it names four by name, and one of them is Ford BlueCruise. The regulator's own document treats Ford's shipping hardware as the proof that the sensing platform already exists.

Then, in its section on privacy, NHTSA asks the public a question that gives the game away:

The rulemaking has not been withdrawn, and NHTSA is still doing work on it: a notice published in July 2026 covers research into the dashboard warning light such a system would use, including driving-simulator studies with participants dosed to roughly the legal limit. The mandate is alive. The rules about the data are not.

Europe answered that question first

The European Union mandated the same hardware, earlier, and more comprehensively. Regulation (EU) 2019/2144, the General Safety Regulation, requires every new car to carry intelligent speed assistance, an event data recorder, a standardised interface for fitting an aftermarket alcohol interlock, and two systems that watch the driver directly:

• Driver Drowsiness and Attention Warning (DDAW), required on every new car sold in the EU since 7 July 2024.
• Advanced Driver Distraction Warning (ADDW), required on every new car sold since 7 July 2026.

So Europe is further along than the United States, not behind it. The difference is what came attached. Article 6(3) of that regulation is binding law, and it reads:

The detailed rules go further. The delegated regulation governing distraction warning is explicit that a camera is expected, and equally explicit about its limit: the requirement "does not forbid the ADDW system to use data from the camera(s) equipped in the vehicle, it forbids the identification of the person by the ADDW system." The drowsiness regulation says the system "shall function in normal operation mode without the use of biometric information, including facial recognition, of any vehicle occupants." The parent regulation separately bars event data recorders from storing anything that could identify the vehicle or its owner.

That is a coherent position, and it has a name: surveil the function, not the person. The camera may measure whether eyes are open. It may not work out whose eyes they are, it may not keep the footage, and it may never hand it to anyone else. Whatever else one thinks of European regulation, somebody sat down and answered the question NHTSA is still asking.

The rules are set by a body no one voted for

There is a third actor here, and it is neither Congress nor the European Commission. Euro NCAP is a private consumer-testing programme. It cannot compel anything. But a rating below five stars is commercially unacceptable in Europe, so its protocols function as a mandate that no one voted on.

Its 2026 driver engagement protocol awards 30 points for driver monitoring, scoring separately for long distraction, short distraction, phone use, impairment, microsleep, sleep, and unresponsiveness. To score at all, a system must meet conditions stated in the protocol itself:

• The system "shall be default ON at the start of every journey and deactivation of the system shall not be possible with a momentary single push on a button."
• "The driver state detection sensitivity shall not be manually adjustable."

A separate occupant monitoring protocol adds 30 more points for detecting seatbelt routing, rear seat occupancy and occupant classification, and requires child presence detection by "direct sensing," which it defines as detecting a human in the vehicle "by means of tracking heartbeat, respiration, movement, or any other sign of life."

Sit with where that comes from. The strictest requirement that your car sense the people inside it, always on, not adjustable, not easily disabled, comes from a testing body accountable to no electorate. It is in no statute. There is no comment period, and no one to vote out.

What Ford filed for

Care matters here. Ford Global Technologies is Ford's patent-holding subsidiary and it files applications in the low thousands per year. A published application discloses an idea, nothing more. It is not a product, a roadmap, or evidence that anyone intends to ship it. Ford's standard response to coverage of these filings is fair, and worth quoting: "The ideas described within a patent application should not be viewed as an indication of our business or product plans."

Several of the documents below were also abandoned, meaning Ford stopped paying to pursue them. That does not make them meaningless. It makes them evidence of what Ford's engineers thought was worth claiming, which is a narrower and more honest thing to say than most coverage has said.

Two corrections that most coverage of these filings got wrong, and that this page will not repeat.

• The repossession patent's cameras are not pointed at you. The document is specific: one camera "is arranged to capture images of objects located in front of the vehicle," another captures objects "located behind the vehicle." Their job is checking whether the car can drive itself out of your garage. A separate clause uses them to detect a medical emergency and lift the lockout. A car that drives itself to the impound lot is troubling enough without inventing a driver-facing camera that is not in the text.
• The speeding patent is a police-car patent. The fair criticism is narrower: the application never states the technology is limited to law-enforcement vehicles, and the boundary between "police car" and "any car" is a policy line rather than a hardware one. The roadside tracking units it describes are the same infrastructure documented on our page about Flock cameras.

What is already true, with no patent required

Ford BlueCruise ships today with a driver-facing camera and infrared illuminators that track eye gaze and head position. This is not a filing. It is in the car, and NHTSA cites it by name as a working example of the sensing platform a future federal standard could ride on.

Ford's position is that the camera is active only while the hands-free system is engaged, and that no images or video leave the vehicle in normal use. Take that at face value. It is a reasonable design and, if accurate, a better one than the law requires of Ford in the United States. Note precisely what it is: a policy, not an architecture. The camera is installed. The compute is installed. What governs the footage is a company's current decision about what to do with it.

What Ford's own privacy notice says

Ford's US Privacy Notice, effective 1 July 2026, is a more useful document than any of the patent filings, because it describes what the company does rather than what it once considered. Three passages bear on this page.

The first settles the question the patents only gesture at. A driver-facing image exists, and there is a process for obtaining it:

The second concerns location, and it is what makes the abandoned repossession patent look less like a thought experiment:

• "In limited situations, we may collect Vehicle Location, regardless of location settings. We do this to protect and defend our rights or property (including repossessing a vehicle in the event of a delinquency) or to comply with applicable law, to respond to valid legal process (including from law enforcement or other government agencies)…"
• "if you are financing your purchase or lease with Ford Credit and Ford Credit asks us to locate your vehicle due to default of your agreement with Ford Credit, we may disclose Vehicle Location to Ford Credit."

Ford abandoned the patent that would have disabled your air conditioning. It did not abandon the underlying business need. Repossession appears in the live notice twice more, as a stated purpose for both geolocation data and for precise geolocation, which the notice itself classifies as sensitive. The gadget was never the point. Knowing where the car is, whatever the location setting says, is.

The third concerns what the car hears. The notice defines a category of Sensory Data covering "audio and visual data such as voice commands and other utterances captured when the vehicle's voice recognition system is in 'active listen' state," and lists among its purposes:

• "To understand your preferences, make recommendations, and deliver personalized offers and communications."
• "To promote and offer our Products, and those of our selected partners, through co-branded service offerings, joint marketing, advertising, contests, and sponsorships."

That is the in-vehicle advertising patent's premise without the patent. The limit is real: utterances are captured in an active-listen state, not continuously, which is materially different from the patent's controller monitoring dialogue to decide when you have stopped talking. But in-cabin audio may already be put to advertising, and that is in a document in force today rather than an application Ford walked away from.

Three smaller things from the same notice. Ford states it may apply "artificial intelligence, machine learning, and other automated decision-making technologies" to this data. It declines to offer the right to opt out of profiling, on the basis that it does not profile in a way producing "legal or similarly significant effects." And it discloses that it does not use personal data to train large language models, but makes that disclosure for Connecticut residents only, because Connecticut is the only state that requires it.

One last detail, and it is the tell. Who does the notice make responsible for telling your passengers any of this? You do. Its second paragraph asks owners to "inform others who drive the vehicle, and passengers who connect their mobile devices to the vehicle, about the information in this Notice."

How much weight that decision carries is a fair question, and there is evidence to answer it. In March 2026 the California Privacy Protection Agency fined Ford $375,703 over its connected-vehicle privacy practices, after finding that an email confirmation step silently voided opt-out requests from anyone who did not click the link. The agency accepted it looked like a misconfiguration rather than a deliberate barrier. That is the point: one unnecessary click, added by accident, nullified a legal right at scale. The details are in our Corporate Dossier.

Meanwhile the American courts have been clear about how little help they will be. In Jones v. Ford Motor Co. (9th Cir. 2023), drivers alleged that Ford infotainment systems copied and permanently stored the call logs and text messages of any connected phone. The Ninth Circuit held they had standing to sue, then affirmed dismissal anyway, because Washington's privacy statute requires injury to "business… person, or… reputation" and, in the court's words, "an invasion of privacy, without more, is insufficient." The court never reached whether the allegation was true. Having your private communications copied and kept simply was not, by itself, a harm the statute would remedy.

Ford has plenty of company

When the Mozilla Foundation reviewed 25 car brands for privacy in September 2023, all 25 failed. It was the first time an entire product category failed in the guide's history. Nineteen of the 25 said they could sell personal data. Fourteen said they share information with government or law enforcement. Ford's badge was "Super creepy," and Mozilla could not determine whether Ford encrypts the data it collects, because Ford did not respond to repeated requests.

Note the limit of this table. None of these cases involve footage from a driver-facing camera. Every one of them concerns location and driving-behaviour data, which is far less intimate than a video feed of your face, and it was still collected without meaningful consent and sold for pennies. The camera arrives into an industry with this record, under a federal mandate that says nothing about what may be kept.

What actually changes things

There is no consumer fix on this page, because there is not one. You cannot opt out of a federal safety standard, you cannot decline the camera and still buy a new car, and no setting in the infotainment menu will unsolder it. This is a law problem, and it has the unusual property of being a law problem with a working solution already drafted in another jurisdiction.

• The text already exists. Article 6(3) of the EU General Safety Regulation is one sentence long: no continuous recording, no retention beyond the immediate purpose, no third-party access at any time, immediate deletion after processing. It does not have to be invented, negotiated from scratch, or tested for feasibility. Every manufacturer selling in Europe already complies with it.
• The docket is the pressure point. NHTSA asked in its own rulemaking whether it should prohibit camera-based monitoring from recording certain imagery. That question is still formally open at the prerule stage. Rulemaking comments are one of the few places where an ordinary submission enters the public record and has to be addressed.
• Insist on the distinction that matters. Not camera versus no camera. The mandate is real, drowsy driving kills people, and the safety case is genuine. The line is between a system that measures whether your eyes are open and one that keeps a record of them. Europe drew it. It can be drawn here.
• Watch the state route. Illinois' biometric statute is the only US law that has meaningfully constrained in-cabin face analysis, and it did so through litigation over fleet dashcams rather than anything written with passenger cars in mind. State privacy law is currently the only thing in the United States doing the job Article 6(3) does in Europe.

The problem was never that the camera exists. Europe mandated it too, sooner and more thoroughly, then wrote down what it may never do. The United States has spent 21 months past its own deadline not answering that question.