Starting in September 2027, every new car sold in the United States will be required by federal law to include technology that monitors you for signs of impairment. Not a breathalyzer you blow into. Not an ignition interlock device installed after a DUI conviction. A permanent, passive surveillance system built into every vehicle, watching your eyes, sampling your breath, and reading your fingertips — deciding in real time whether you are fit to drive. If the AI determines you are impaired, it can prevent your car from starting. It can limit your speed. It can pull the car over. There is no appeal. There is no override. And there is no opt-out. This is not a proposal. It is law. Section 24220 of the Infrastructure Investment and Jobs Act, signed by President Biden in November 2021, mandates that NHTSA develop a federal safety standard requiring advanced impaired driving prevention technology in all new passenger vehicles. The deadline is September 2027. The technology is called DADSS — the Driver Alcohol Detection System for Safety — and it is the most invasive surveillance system ever mandated for civilian vehicles in the United States. The Law That Started It Section 24220 of the Infrastructure Investment and Jobs Act directs the Secretary of Transportation to issue a federal motor vehicle safety standard requiring all new passenger vehicles to be equipped with "advanced drunk and impaired driving prevention technology." The law specifies that the technology must be passive — meaning it must work without the driver taking any action — and it must be capable of preventing or limiting the operation of the vehicle if impairment is detected. The statute was sold to the public as a drunk driving measure. The numbers are real: approximately 13,000 people die annually in alcohol-related crashes in the United States. But the law Congress wrote does not limit itself to alcohol. It covers "impaired driving" broadly, which includes alcohol, drugs, fatigue, and distraction. The surveillance system you will be required to purchase as part of your next car does not just check whether you have been drinking. It monitors your cognitive state continuously and makes decisions about whether you are allowed to drive. NHTSA was supposed to issue a final rule by November 2024. They missed the deadline. The Advance Notice of Proposed Rulemaking identified driver monitoring systems using cabin-facing cameras and sensors as the most likely technological approach, but as of May 2026, the final rule has not been issued. The delay does not change the mandate. The statutory requirement remains in effect. NHTSA is late, not reconsidering. What DADSS Actually Does The Driver Alcohol Detection System for Safety is a research program co-funded by NHTSA and the Automotive Coalition for Traffic Safety, an industry group representing major automakers. DADSS has developed two primary detection technologies that are being positioned for the 2027 mandate: Breath-based alcohol detection. Sensors mounted in the cabin analyze the air around the driver for ethanol concentration. The system is designed to measure blood alcohol content (BAC) from the driver's exhaled breath without requiring the driver to blow into a tube. The sensors sample continuously while the vehicle is running. If the detected BAC exceeds the legal limit, the system can prevent the vehicle from starting or trigger a graduated response — speed limiting, hazard light activation, or a controlled pull-over. Touch-based alcohol detection. Sensors embedded in the ignition button or steering wheel use infrared spectroscopy to measure blood alcohol through the driver's skin. When you press the start button or grip the wheel, the sensor shines infrared light through your fingertip and analyzes the tissue below the skin surface to estimate BAC. Like the breath system, this operates passively and continuously. Both technologies are still in development. Neither has been validated at scale across diverse real-world conditions. But the mandate does not require validated technology. It requires technology. The statute says "advanced drunk and impaired driving prevention technology," and NHTSA gets to define what qualifies. The Infrared Eye Tracking Layer DADSS handles alcohol detection. The broader mandate covers impairment — which is where the cameras come in. NHTSA's rulemaking identifies driver monitoring systems (DMS) as the primary approach for detecting non-alcohol impairment. These systems use infrared cameras mounted on the steering column or dashboard, pointed directly at the driver's face. They track: Eye movement and gaze direction Blink rate and eyelid closure duration Pupil dilation Head position and nodding frequency Facial expression and microexpressions Hand position on the steering wheel AI algorithms analyze this data in real time to determine whether the driver is impaired by fatigue, distraction, drugs, or any other cause. The system does not wait for you to do something wrong. It monitors you constantly and makes a determination about your cognitive state every moment you are behind the wheel. If the AI decides you are drowsy, distracted, or otherwise impaired, it can escalate through a graduated response: auditory warnings, haptic feedback (vibrating the seat or steering wheel), speed limiting, and ultimately preventing the vehicle from operating. The car decides. You do not. This is not a future concept. Multiple automakers — Tesla, BMW, Subaru, Ford, Cadillac — already install cabin-facing cameras for driver attention monitoring. The 2027 mandate makes this technology mandatory in every new vehicle, standardizes its capabilities, and gives it enforcement authority over whether your car will start. Your Car Already Tracks You Every 3 Seconds The mandate adds biometric surveillance on top of an existing tracking infrastructure that most drivers do not know exists. A CNN investigation published in February 2026 reported that 90% of new cars collect driving data every 3 seconds. This includes speed, location via GPS, acceleration, braking force, cornering, trip start and end times, and duration at each location. The data is transmitted from the vehicle to the manufacturer's cloud via built-in cellular connections that you cannot disable without losing core vehicle features. Your car knows where you live. Where you work. Where you worship. What doctor you visit. What stores you shop at. How fast you drive on the highway. Whether you brake hard at a yellow light. Whether you drive late at night. All of it collected every 3 seconds, stored indefinitely, and tied to your vehicle identification number — a unique identifier that connects every data point to you permanently. The BBC published a feature titled "Your car is spying on you — it's about to get worse." The piece detailed how modern connected vehicles have become the most pervasive consumer surveillance devices on the market, collecting more personal data than smartphones, smart home devices, or fitness trackers. The BBC's conclusion: cars are not just vehicles anymore. They are mobile data collection platforms, and the people inside them are the product. Who Buys Your Data Automakers do not collect all this data for their own use. They sell it. The pipeline works like this: Automakers collect driving behavior data through telematics systems built into vehicles Data brokers like LexisNexis Risk Solutions and Verisk purchase this data and compile consumer risk profiles — detailed reports showing every trip, hard braking event, speeding incident, and late-night drive Insurance companies including Progressive, Allstate, and State Farm purchase these profiles and use them to set rates, deny coverage, or target marketing Drivers are never told any of this is happening LexisNexis risk profiles were found to contain data on every trip a driver had taken in their GM vehicle — start time, end time, route, and driving events. This was not anonymized data. It was tied to the VIN and therefore to the vehicle owner. Verisk operated a similar product but shut it down in June 2024 after a New York Times investigation exposed the practice and triggered public backlash. The backlash did not stop the data collection. It stopped one broker from selling one product. The data still flows. The GM OnStar Precedent In January 2026, the Federal Trade Commission finalized its order against General Motors and its OnStar division for collecting and selling drivers' precise geolocation and driving behavior data without proper consent. GM's OnStar Smart Driver program enrolled consumers during vehicle purchase or lease without clearly disclosing what data would be collected or how it would be used. The program collected detailed driving data — GPS coordinates, speed, hard braking, rapid acceleration, trip timestamps — for hundreds of thousands of vehicles. GM sold this data to LexisNexis and Verisk. Drivers were not informed. Many first learned about it when they received insurance rate increases or denial letters they could not explain. The FTC's order imposed a five-year ban on GM disclosing geolocation and driver behavior data to consumer reporting agencies. GM was required to delete collected data unless consumers gave explicit consent for retention. The order is narrow. It covers GM. It covers geolocation and driving behavior data. It covers consumer reporting agencies. It does not cover other automakers. It does not cover biometric data. It does not cover law enforcement access. And it expires in five years. GM is not the only automaker doing this. They are the one that got caught. Biometrics Tied to Your VIN The 2027 mandate creates a new category of surveillance data: biometrics collected inside your car, tied to your vehicle identification number. Infrared eye tracking data — your gaze direction, blink rate, pupil dilation, head position — is biometric data. It uniquely identifies you. It reveals your cognitive state, your level of fatigue, your emotional responses. It can indicate medical conditions. It is the kind of data that biometric privacy laws in Illinois, Texas, and other states were written to protect. Breath pattern data — the rhythm, depth, and chemical composition of your respiration — is biometric data. It reveals not just alcohol content but respiratory health, stress levels, and metabolic state. Touch-based spectroscopy data — the infrared signature of blood through your skin — is biometric data. It is effectively a fingerprint combined with a blood chemistry analysis. All of this will be collected inside your car, processed by AI, and tied to your VIN. The mandate does not include data retention limits. It does not include use restrictions beyond the immediate impairment detection function. It does not prohibit secondary use. It does not prohibit sale to third parties. It does not prohibit access by law enforcement without a warrant. The camera that watches for impairment can also watch for everything else. The data that proves you were drowsy can also prove where you went, what state you were in, and what your body was doing at the time. Your biometric profile — your eyes, your breath, your blood chemistry — becomes a surveillance commodity, permanently attached to a vehicle identification number that is registered to your name and address. The Missing Rulemaking NHTSA missed its November 2024 deadline for issuing a final rule. As of May 2026, the agency has issued an Advance Notice of Proposed Rulemaking and collected public comments, but has not published a Notice of Proposed Rulemaking or a final rule. The delay creates a dangerous ambiguity. The statute requires the technology in new cars by September 2027, but the regulatory framework defining what the technology must do, how it must perform, what data it may collect, how long it may retain data, and who may access that data does not exist yet. Automakers are developing systems to meet a mandate whose specifications have not been finalized. This is not a recipe for privacy protection. It is a recipe for the minimum viable surveillance system that satisfies the statute while maximizing the data available for secondary commercial use. Without explicit data protection rules in the final regulation, automakers will default to their current practice: collect everything, retain it indefinitely, and monetize it. No Opt-Out There is no federal opt-out provision in the 2027 mandate. You cannot decline the technology. You cannot disable the sensors. You cannot remove the cameras. If you want to buy a new car after September 2027, you will purchase a vehicle equipped with AI-powered biometric surveillance, and you will have no legal right to turn it off. For existing car data collection, the picture is only marginally better. Some state privacy laws — the California Consumer Privacy Act, the Virginia Consumer Data Protection Act, and others — allow consumers to request that automakers delete their data or opt out of data sales. But these laws are inconsistent across states, enforcement is weak, and there is no universal federal right to disable vehicle tracking. The FTC's action against GM established that the Commission considers undisclosed data sales to be an unfair and deceptive practice. But the FTC does not write regulations prohibiting the collection itself. They enforce after the fact, one company at a time, and only when they can prove harm. The mandate does not address any of this. It requires the technology. It does not protect the data. Safety and Surveillance Are Not the Same Thing Impaired driving kills approximately 13,000 people per year in the United States. Technology that could prevent those deaths is worth discussing. But the current mandate does not distinguish between a safety system and a surveillance system. A safety feature detects impairment, prevents vehicle operation, and deletes the data immediately. No retention, no transmission, no secondary use. The driver is stopped from driving impaired. That is the end of it. A surveillance system collects continuous biometric and behavioral data, stores it, transmits it to external servers, makes it available to third parties, and provides no mechanism for driver control or deletion. The driver is stopped from driving impaired, but the data lives on — in automaker clouds, in data broker databases, in insurance company risk profiles, and in law enforcement systems. The 2027 mandate, as written and as currently implemented, builds a surveillance system. The technology to build a safety system exists. The choice to build surveillance instead is deliberate. What Privacy Advocates Want Organizations including the Electronic Privacy Information Center (EPIC), Consumer Reports, and the Electronic Frontier Foundation have called for specific guardrails: Data minimization: DMS systems should collect only the data necessary for impairment detection and delete it immediately after processing. No retention, no storage, no transmission. Purpose limitation: Any data collected for safety purposes must be legally prohibited from use for any other purpose — insurance, marketing, law enforcement, or otherwise. Opt-out rights: Drivers must have the ability to disable data collection and transmission without losing core vehicle functionality. Warrant requirements: Law enforcement must obtain a warrant before accessing any vehicle data, including DMS data. Independent oversight: Third-party audits of DMS data handling, with public reporting on compliance. No preemption of stronger state laws: A federal standard should not override state privacy laws that provide greater protection. None of these provisions exist in the current mandate. None of them are guaranteed to appear in the final rule. What You Can Do Now Submit public comments to NHTSA: The rulemaking process is not complete. When NHTSA publishes its Notice of Proposed Rulemaking, there will be a public comment period. Use it. Demand data minimization, purpose limitation, and warrant requirements. Contact your representatives: Section 24220 was created by Congress. Congress can amend it. Demand that any impaired driving prevention requirement include strict data privacy guardrails and a federal opt-out right. Check your current car's privacy settings: Most connected vehicles have settings to control data sharing. Look in the infotainment system or the manufacturer's mobile app. Disable what you can. Request your data: Under some state privacy laws, you can request the data automakers have collected about you. File requests with your vehicle manufacturer and with LexisNexis and Verisk. Do not connect your phone: Syncing your phone to your car's infotainment system gives the vehicle access to your contacts, messages, call logs, and location history. Use a standalone GPS instead. Consider what you buy next: When shopping for a car, ask about data collection before signing. Request written information about what data the vehicle collects, how it is used, and whether it is sold. If the dealer cannot answer, that is your answer. Your next car will come with infrared cameras pointed at your face, breath sensors sampling the air around you, and touch sensors reading your blood through your skin. An AI will decide whether you are allowed to drive. Your biometric data will be tied to your VIN. There is no opt-out. The technology to detect impaired driving without building a permanent surveillance apparatus exists. The mandate does not require it. That is the problem. And it will not fix itself. --- _Sources include the Infrastructure Investment and Jobs Act (Section 24220), the DADSS Program, CNN (February 2026), the FTC order against General Motors/OnStar (January 2026), the NHTSA Advance Notice of Proposed Rulemaking on Driver Monitoring Systems, the Mozilla Foundation 2023 "Privacy Not Included" report, and BBC Future._