by Michael Hollister
Exclusive published at Michael Hollister on June 12, 2026
2.081 words * about 9 minutes readingtime
Part 2 read here:
What They Ban – and What They Fund: The EU and the Biometric Border – Part 2
The complete analysis continue reading here:
Five Layers, One Profile – How the EU Is Building the Transparent Citizen
There are always two reasons, my grandmother used to say:
The one they give you, and the real one.
Since July 07, 2026, every newly registered new car in the EU must have an infrared camera in the interior that permanently observes the driver. Since July 09, 2026, platform operators are once again permitted to automatically scan private messages – after the EU Parliament had rejected precisely that twice by clear majorities. In parallel, the EU Commission is rolling out an age verification app that security researchers cracked in two minutes – and whose documented flaws did not move the Commission to halt the process.
Three measures, three good purposes: road safety, child protection, more child protection. Three assurances: the data stay local, privacy will be preserved, everything is voluntary. And three documented contradictions between what was assured and what is actually happening – evidenced not by hypotheses but by manufacturer statements in response to direct inquiries, by voting records of the European Parliament, and by security incidents that have already occurred. The sequence is no coincidence: first the infrastructure is created, then the assurances prove hollow – and then the rollout continues regardless.
This briefing describes the pattern. No assertions, no conspiracy theories – only regulatory texts, manufacturer responses, and facts. Anyone wishing to read the full analysis with all sources, the Malte Spitz case, the VW data leak in detail, and the military intelligence-picture analogy can find it in the accompanying Deep Dive.
The Camera: “The Data Stay in the Vehicle”
The system is called Advanced Driver Distraction Warning – ADDW. An infrared camera in the interior captures the driver’s eye area and head position, evaluates them in real time, and warns when distraction is detected – visually, audibly, or as a vibration in the steering wheel. Above 31 mph, the system engages after 3.5 seconds; between 12 and 31 mph, after six seconds. It activates automatically after every engine start. Deactivation is possible, but only until the next start. The legal basis is EU Regulation 2019/2144, which makes the system mandatory for all new registrations as of July 07, 2026. The declared goal: zero road fatalities by 2050, the EU Commission’s “Vision Zero.” The regulation clearly stipulates: no biometric data, no facial recognition, no storage of images. The data are to be processed locally within the vehicle and must not leave it.
That is the assurance. And here is what the manufacturers themselves say when asked directly.
The Belgian broadcaster VRT surveyed seven automobile manufacturers in June 2026 about their specific handling of ADDW data. Volvo stated it processes the data in real time on “secured servers” within a “worldwide digital infrastructure” – explicitly outside the vehicle. Mercedes-Benz confirmed that since July 2025 it has been using image and sensor data from customer vehicles to train its driver-assistance systems. Renault stated it uses personal data for the “improvement of products and services” and shares them with partners in a “controlled” manner. What “controlled” means was left open. The remaining manufacturers did not respond at all.
The regulation says: local. Volvo says: external servers. Mercedes says: image data for training. Renault says: sharing with partners. This is not a matter of interpretation. These are three responses to a direct question from a public broadcaster – and not one aligns with the assurance. Sofie Royer, professor of IT law at VUB Brussels and KU Leuven, names the structural problem: the data protection authorities that should be overseeing compliance are chronically overloaded and understaffed. A legal prohibition alone does not prevent misuse. Added to this is an open flank: the regulations do not clearly define how judicial requests for ADDW data are to be handled. A Belgian court already used data from an on-board computer as evidence in 2017. The precedent exists.
That connected vehicles can leak data on an industrial scale is not a hypothesis. In December 2024, the Chaos Computer Club uncovered a data leak at VW’s software subsidiary Cariad: 807,357 vehicles, nearly 900 million geocoordinates – location data accurate to within four inches, sitting for months, unprotected, on an Amazon cloud storage. Patrol cars, politicians’ vehicles, cars in the vicinity of the BND. The data were exposed. The movement profiles were complete.
The look ahead: The EU Commission has announced it will develop the next level of ADDW requirements by July 2027 – cognitive distraction detection, meaning mental states that cannot be measured through gaze direction alone. The hardware that would enable such an expansion is already installed in every new car. Full-HD camera, integrated AI, infrared. Facial recognition and biometric evaluation would be one software update away. The regulation says: “May not.” But it does not say: “Cannot.”
Chat Control: Twice No, Then Expedited Procedure
On July 09, 2026, the European Parliament passed the so-called chat control – a regulation that permits platform operators to automatically scan private messages for depictions of child sexual abuse. The result is remarkable – less because of the matter itself than because of the procedure by which it was achieved.
The temporary derogation regulation that had permitted such scanning since 2021 expired on April 04, 2026. In March 2026, Parliament rejected an extension by 311 to 228 votes – clear majority, democratically decided. The matter appeared settled. Three months later, the Parliament leadership introduced an emergency motion.
On July 06, MEP Martin Sonneborn attempted to point out to Parliament President Roberta Metsola in the plenary that the expedited procedure violated Parliament’s rules of procedure. Metsola had previously told the press that everything was in order. When Sonneborn tried to explain it to her in the plenary, she cut his microphone after 60 seconds. On July 07, Parliament voted 331 to 304 to initiate the expedited procedure.
The procedure was constructed to reverse the burden of proof. Not the majority had to approve – instead, 361 MEPs had to actively vote against in order to stop the regulation. A procedure that allows a democratic decision to be overturned only by an extraordinarily high threshold of opposing votes. The vote fell on July 09 – the last plenary day before the summer recess. Numerous MEPs were already on their way to vacation. Independent MEP Friedrich Pürner commented: “Just before the summer break – while everyone is packing their swimsuits and eyeing the World Cup – the Parliament President sneaks the topic back onto the agenda.” The result: 314 opposing votes – 85 fewer than the required 361. 276 MEPs voted in favor, 30 abstained. Chat control thus applies until April 2028.
An amendment intended to exempt end-to-end encryption was adopted – how this is to be technically implemented remains unclear. In the background, negotiations on the permanent CSA Regulation continue – which could go significantly further, up to mandatory client-side scanning, meaning the searching of messages directly on the user’s device before they are encrypted. Next trilogue: September 29. The official purpose: child protection. No one argues against the purpose. MEPs from all groups argue against the procedure – but the microphone was cut.
The Profile: What the Combination Yields
Each of these measures has a good, comprehensible purpose. The ADDW camera saves lives – that is undisputed. Chat control is meant to protect children. Together with the data retention of cellular data, the age verification app, and the central bank data registries in several member states, however, a picture emerges that extends far beyond the individual purpose.
The camera knows who is sitting in the vehicle, when, and for how long. The cellular data know where the phone has been – when a Green Party executive board member sued his telecoms provider for his retention data in 2009, he received 35,831 data points for six months, enough for a seamless movement profile that ZEIT Online published as an interactive map. With a device that checked in every ten minutes. Today, with permanently connected smartphones, the resolution would be many times higher. Chat control knows what someone writes and to whom. Age verification – built on the same specifications as the coming European Digital Identity Wallet EUDI – provides the key that assigns all other datasets to an officially verified person.
Combined, this yields a profile encompassing movement, communication, finances, identity, and behavior. A profile that twenty years ago would have required months of intelligence work against an individual – surveillance, wiretapping, bank inquiries, informant management. Today it arises as a byproduct of measures no one calls surveillance. What the profile still lacks is the health dimension – and that comes with the electronic patient record and the EUDI Wallet, both on the EU Commission’s documented roadmap.
That the data in these systems are not secure has been proven by two incidents within one year. In December 2024, the 807,357 VW vehicles on unprotected cloud storage – nearly 900 million geocoordinates that made patrol cars, politicians’ vehicles, and vehicles in the vicinity of the Federal Intelligence Service identifiable. In January 2026, the FICOBA incident in France: a single compromised login of a government official sufficed to gain access to the central bank data register – 1.2 million accounts, bank details, identity, address, in some cases tax ID. No server was hacked, no firewall breached. One password sufficed. The greatest risk is not the technology – it is the human element. And once the data have leaked, they are no longer controllable.
The infrastructure stands. The hardware is installed. The laws have been passed – in one case against the twice-expressed explicit will of Parliament. What runs on this infrastructure is not decided by the technology. It is decided by whoever writes the laws tomorrow. And what has once been installed will not be uninstalled.
Bottom Line
Three measures, three assurances, three documented breaches.
The EU regulation assures that the camera data stay in the vehicle. Volvo, Mercedes, and Renault contradict this in response to a direct inquiry from a public broadcaster – Volvo with external servers, Mercedes with training data, Renault with partner sharing. Chat control was rejected by Parliament in March by 311 to 228 votes – and pushed through in July via an expedited procedure with reversed burden of proof on the last session day before the summer recess, after an MEP who named the procedural violation had his microphone cut after 60 seconds. The EU’s age verification app failed at both declared purposes – as an age filter it is bypassable, as a data protection system it is structurally unusable – and is nonetheless being rolled out across 27 member states, even though more than 400 scientists from 30 countries are calling for a moratorium.
The assurance reads the same every time: local, anonymous, secure, voluntary. The documented reality shows every time: external, identifiable, vulnerable, mandatory. This is not a pattern that needs interpreting. It is one that can be read – in manufacturer responses, voting records, and security reports.
There are always two reasons, my grandmother used to say: the one they give you – and the real one.
The full analysis with the Malte Spitz case (35,831 data retention points in six months), the VW data leak in detail (807,357 vehicles, CCC, Spiegel), the hacked EU age verification app, the military intelligence-picture analogy, and the FICOBA bank data incident – read more here:
Five Layers, One Profile – How the EU Is Building the Transparent Citizen
About the Author
Michael Hollister
is a geopolitical analyst and investigative journalist. He served six years in the German military, including peacekeeping deployments in the Balkans (SFOR, KFOR), followed by 14 years in IT security management. His analysis draws on primary sources to examine European militarization, Western intervention policy, and shifting power dynamics across Asia. A particular focus of his work lies in Southeast Asia, where he investigates strategic dependencies, spheres of influence, and security architectures. Hollister combines operational insider perspective with uncompromising systemic critique – beyond opinion journalism. His work appears on his bilingual website (German/English) www.michael-hollister.com and in investigative outlets across the German-speaking world and the Anglosphere.
Sources
- EU Regulation 2019/2144 – Regulation on general vehicle safety: https://eur-lex.europa.eu/eli/reg/2019/2144/oj
- VRT Investigation / Manufacturer responses – “New EU rule: camera monitors driver in the car” (Volvo, Renault, Mercedes-Benz), All About Security, July 2026: https://www.all-about-security.de/neue-eu-regel-kamera-ueberwacht-fahrer-im-auto/
- VW/Cariad data leak – auto motor und sport / CCC / Spiegel, December 2024: https://www.auto-motor-und-sport.de/verkehr/massives-datenleck-volkwagen-meb-nutzerdaten-chaos-computer-club/
- Chat control – Vote of July 09, 2026 – Junge Freiheit, July 09, 2026: https://jungefreiheit.de/politik/ausland/2026/eu-parlament-winkt-chatkontrolle-im-eilverfahren-durch-nachdem-sie-zweimal-abgelehnt-wurde/
- TKP.at – “Chat control and the end of the secrecy of correspondence,” July 07, 2026: https://tkp.at/2026/07/07/chatkontrolle-und-das-ende-des-briefgeheimnisses-eu-killt-grundrecht-der-aufklaerung-im-eilverfahren/
- Netzpolitik.org – “Surprise: Committee votes against voluntary chat control,” March 2026: https://netzpolitik.org/2026/ueberraschung-ausschuss-stimmt-gegen-freiwillige-chatkontrolle/
- FICOBA incident – Le Monde, February 2026: https://www.lemonde.fr/pixels/article/2026/02/10/ficoba-les-donnees-de-1-2-million-de-comptes-bancaires-ont-ete-consultees-par-un-pirate_6404181_4408996.html
- Malte Spitz / Data retention – heise online, February 2011: https://www.heise.de/newsticker/meldung/Vorratsdaten-Sechs-Monate-im-Leben-des-Malte-Spitz-1197178.html
- Michael Hollister – “The Protection App That Protects Nothing,” May 2026: https://www.michael-hollister.com
Complete source list and further documentation in the full-length analysis article.
© Michael Hollister – All rights reserved. Redistribution, publication or reuse of this text requires express written permission from the author. For licensing inquiries, please contact the author via www.michael-hollister.com.
