No, the EU Data Act Doesn’t Put a Camera on Your Face. It’s the One Law Written on Your Side.

For my EU peeps, BMW starts collecting exterior camera footage from customer cars in Europe this month. The good thing is that it asked permission first, which is more than we can say for most. Do note, however, that it still hasn't said where the footage goes. Maybe that's a corporate secret or, even more possible, they haven't figured that out. But, you know, data is king. Also, nobody has said what it's worth to the person who generated it.

BMW announced yesterday that it is expanding the collection of image data from customer vehicles in Europe. Starting mid-September, the new iX3 and i3, the X5 and the 7 Series will send video and sensor data back to Munich when something specific happens.

Image courtesy of BMW Group

The press, of course, covered it within the day. One of the widely read versions of it made a mistake I want to spend some time on, because the mistake is more interesting than the announcement.

Autoblog reported that the European Union enacted the EU Data Act in September 2025, and that under this law automakers are required to install interior-facing driver monitoring systems.

I want to go on the record as saying that data collection in general is a pox on society. Face recognition is even more insidious. However, that general mention in Autoblog is two different regulations welded into one sentence, and the wrong one got the blame.

The camera that watches your eyes is not the Data Act

The interior camera comes from the General Safety Regulation, specifically its Advanced Driver Distraction Warning requirement, in force since July 7 of this year.

It uses infrared and eye tracking. It warns you when your eyes stay off the road for more than six seconds between 20 and 50 km/h, or three and a half seconds above that. The regulation calls for a closed loop, which means the footage is supposed to stay in the car and never reach a server. And look, no matter what is said on this, I'm just going to say that "stay in the car" is a lie. For instance, Volvo has said its own driver-monitoring architecture processes real-time data on external cloud servers, which is a different sentence than the one the regulation intended, and someone should ask about it.

That is the surveillance mandate and it's not the Data Act.

The Data Act is the one written for you

The EU Data Act has been applicable since September 12 of last year. You may not remember that it's an access and portability law.

It obliges the maker of a connected product to give you the data your product generates, and to hand that data to any third party you name. Your car, your telemetry, your choice of independent mechanic or insurer or aggregator. The Commission published sector-specific guidance for automotive because the automakers fought it.

It doesn't go far enough, but you have to hand it to the Commission in making it the most pro-driver piece of car-data regulation anyone has passed. They tried.

And it got reported as the reason there is a camera pointed at your face.

Why the mistake is the story

I am not interested in scoring a point off a competitor's copy desk. Two EU regulations governing vehicle data, adopted within a year of each other, is a genuinely confusing pile, and I have read enough regulatory text to know that the confusion is engineered rather than accidental.

What interests me is the direction the error ran.

Nobody mistook a surveillance mandate for a consumer right. The mistake went the other way. A law that hands drivers access to their own data got read, instantly and without friction, as a law that installs a camera in their car.

That is what a decade of default assumptions produces. We have arrived at a place where any regulation touching vehicle data reads as a surveillance measure, because that is what vehicle data regulation has almost always been. So, I get it. It is also now getting in the way, because the one law that gives drivers a lever is the one nobody recognizes as theirs.

The Data Act built you a pipe. You may not be able to shut it off, but you can demand your own driving data and send it wherever you want.

Read the whole thing, and one thing you won't find is a line about anyone paying you for it. The compensation provisions govern what one business charges another. The person who produced the data is a party to the plumbing and not to the transaction. Oh, of course they are.

Somebody wrote a law about who may move the oil and conveniently left out who owns the well.

Meanwhile, BMW is doing the good version

Now the announcement itself.

BMW's cameras in this program face outward, at traffic. Not inward, at the driver. Putting the interior mandate and BMW's exterior program in the same story reads as if Munich is filming you in your seat, and it isn't.

The triggers are narrow and worth reading.

A collision the assistance system prevented during a highway lane change. The emergency braking assistant firing. Heavy manual braking. A sudden evasive maneuver.

Those four things, and with them the exterior footage, the environment sensor readings, and the speed, direction and steering angle the car was carrying at the time.

The program is consent-based, in BMW's words "contingent upon customers' consent." The vehicle identification number is deleted immediately after transmission to the backend. Faces and license plates are obscured before any employee sees playback.

BMW says the purpose is the continuous development of driver assistance systems and partially-automated driving functions. It wants the systems to behave more like a person and intervene less often when they shouldn't. That is a real engineering problem, and watching a large number of real-world near-misses is genuinely how you solve it. It also isn't solved.

Euro NCAP runs a scenario where a child runs out from between parked cars. In daylight, most current cars handle it. After dark it falls apart. BMW's own X3 drops from Good to Adequate on that exact test at night, and AAA found cars avoided a nighttime pedestrian only 60 percent of the time.

So I'm for getting those safety features right. I want that work to happen. If every automaker behaved this way I would have less to complain about. But I still have two things to complain about.

The first question is "Where does it go?"

BMW's release specifies what it takes, when it takes it, and that the VIN comes off. It states the purpose in a single clause.

It doesn't say how long the footage lives in the backend. Nor does it say who inside the company can pull it, or whether anyone outside the company can. It doesn't say whether the resulting perception models stay in Munich or get licensed to a supplier, a mapping partner, a warranty group, or a fleet customer. And it says nothing about whether the improved system arrives in my next car as standard equipment or as an eleven-hundred-euro option.

Please understand that none of that is an accusation. BMW may have excellent answers to all four. It just didn't publish them, and consent to collection is not consent to a destination.

"We are collecting this to improve driver assistance" is a purpose. It is not an address. A consent screen that names the first is treated as though it disclosed the second but it didn't.

The second thing is the word that never appears

Read BMW's release start to finish and you will not find a sentence about what the owner gets.

There's no mention of a discount. Not a credit. Not a free year of the connected services subscription that this same data will eventually improve, and that BMW will eventually charge for.

The owner supplies the car, the sensors, the electricity, the insurance, the road time, and the four terrifying seconds where the emergency braking assistant earns its keep. Munich supplies a checkbox. And, pardon my jaded self here, I'm buying the vehicle that serves, Matrix style, as the connection to a much broader leech that's sucking my data away.

That is the whole arrangement, and it is the arrangement everywhere. But BMW is only the company that put it in writing this week.

Let's suppose you should get paid for your data

McKinsey has put the global revenue pool from car data monetization as high as $750 billion by 2030.

Sit with that for a second, because it is not a rounding error and it is not speculative revenue from some future Cybercab operation. It is the estimated value of information that vehicles are generating right now, on roads you pay to drive on, in cars you already bought.

Your share of $750 billion is currently $0. In fact, you're paying lots of money for something that's taking your data for free. How crazy is that?

What it looked like the last time somebody sold it

In May, California Attorney General Rob Bonta (whom I'm not a fan of) settled with General Motors over OnStar. Regardless of how I feel about our Attorney General, going after GM was a good thing.

From 2020 through 2024, GM collected names, contact information, precise vehicle location, and driving behavior including hard braking, acceleration and speed. It sold that to LexisNexis Risk Solutions and Verisk Analytics, the data brokers that feed insurance pricing. Drivers found out when their premiums moved.

GM made about $20 million nationally on those sales. It settled for $12.75 million without admitting liability. Of course, in what was patently a more egregious move, the money went to the California Attorney General's office and not the consumer. GM has to stop selling driving data to consumer reporting agencies for five years and delete what it kept within 180 days.

So, once again. The drivers whose braking habits were the product received nothing. Not a small payment. Nothing. The entity that got made whole was a state government. And for all I know, they also took the data. The entity that generated the asset got a news story about itself.

College football settled this argument already

For about a century the NCAA ran an operation where the people generating the revenue were told the arrangement was for their benefit. They got development, exposure, a scholarship, and a great deal of language about tradition.

The stadium filled. The television contract got signed. The athletic director got a raise. Then a court was forced to look at it.

Under the House settlement approved in June of last year, schools may share up to 22 percent of average Power Five athletic revenue directly with athletes. That is roughly $20.5 million per school for 2025-26, rising toward $32.9 million by the middle of the next decade, plus $2.576 billion in back damages for everyone who came through before the rule changed.

Nobody needed a new theory of property to get there. They needed a judge, and enough years of somebody saying out loud that the person generating the value should be in the revenue conversation.

So, for grins, hold two numbers next to each other.

General Motors made about $20 million selling driving data and shared none of it with the drivers. A single university now shares about $20.5 million a year with the athletes who produce its revenue.

Same figure. Opposite answer. The difference is that one group got representation and the other group got a checkbox in a settings menu.

What I actually want

I am not asking for a windfall and I am not asking anyone to stop building better emergency braking. I want the assistance systems to work, and the way they get better is exactly what BMW described.

So here is the deal I would sign, and it has three lines.

Publish the destination. Not the purpose, the destination. Retention period, internal access, external recipients, and whether the model my data trains ends up in a product I get charged for.

Give me the device or meter the feed. If the data from my car is worth having, hand me the hardware and the connected services at no cost for as long as you are collecting, and say so on the window sticker. Or publish a rate, pay it quarterly, and let me see the statement.

Let me turn it off without losing the seat heaters I already bought.

The middle one sounds strange only because nobody does it. Volvo has floated usage-based insurance where sharing driving data reduces a premium, which is at least a rate. But even then, you're letting someone take your data for free and then giving you an extremely small discount. I'd turn it down. But, it's a start, and it's more than a checkbox.

The 2019 in my driveway

I drive an Audi from 2019 with no Audi Connect and no Virtual Cockpit. Bought it that way new.

That was a choice, and it cost me things I would have enjoyed. The digital instrument cluster is genuinely good. I gave it up because the price of admission was an always-on connection to a company whose data policy I would have to re-read every time it changed, and I decided the gauges were not worth the subscription to myself.

That option is closing. You can't buy a new car without this, and in a few years you won't be able to buy a used one either, because the fleet turning over is already connected. The opt-out is a museum piece and I own one.

The industry keeps calling this a privacy conversation, which suits it fine because privacy conversations end with a consent screen and a longer policy document that you're not going to read.

Consent isn't the problem. BMW got consent. And, for that matter, GM had a checkbox too. Arguing about consent leads to not discussing money.

From what I can tell, there are two questions nobody is answering and those are:

1. Where does my data go after I hand it over?
2. What is it worth to me?

Right now, the answer to the first one is that I don't know. The answer to the second one is Zero. Nada. Nothing.

Neither answer changes until someone asks the question somewhere that forces a company to answer. That took college athletes about a century. Which doesn't look good now that car owners are only 20 years in.