After U.S. Restrictions, Chinese Connected Vehicles Face Growing Scrutiny in Europe

After U.S. Restrictions, Chinese Connected Vehicles Face Growing Scrutiny in Europe

In one month, between mid-September and mid-October, Chinese technology attached to new cars – mostly EVs, but not all – were called out in two European countries for essentially being data vacuums for China. In some cases, the data is collected for the companies to understand how the driver uses their product, and to make adjustments over time. But in other cases, they were used as on-board recording devices.

During a September 14–18 military exercise at Oslo airport in Norway, soldiers discovered onboard recordings showing their personal movements, travel routes and access codes to military facilities. They were reportedly driving at least two Deepal-brand rental vehicles manufactured by Chinese state-controlled car giant Changan.

Norwegian Home Guard spokesperson Lt. Col. Per Gunnar Grosberghaugen confirmed in the press that soldiers found videos stored in the vehicles’ systems. Norwegian National Security Authority official Andreas Skjold-Lorange later warned about the uncertainty over where the vehicle data actually goes when collected by Chinese manufacturers.

More recently, France sounded its own alarm on the matter. Industry Minister Sébastien Martin said on Oct. 13 on Radio Monte-Carlo that, “We’d be better off not having vehicles that could be controlled remotely from China.” That radio segment was later followed by BFMTV, France’s 24-hour news network, interviewing a cybersecurity expert and hacker named Gael Musquet who included other connected equipment as a vulnerability, including refrigerators. He said, “What has already happened to refrigerators could happen to our vehicles next.”

France has been tracking this issue since 2017. France’s independent data-protection regulator, known by the acronym CNIL, issued connected-vehicle location-data recommendations back in June. The central rule is consent, meaning the users of the product generally must agree to the use of their location data and other info, unless that data is necessary to provide a service they have expressly requested. It is not a proposed ban on connected vehicles or Chinese cars, but it could easily be used by the state to instill a measure of caution among buyers – it says, if you want (Chinese) multinationals to collect your data and maybe share it with the government, buy this product and sign on the dotted line that you consent.

Washington’s Actions Against Chinese Connected Cars

U.S. legislators have been thinking about this issue since at least 2024. At the time, Sherrod Brown, a Democrat Senator from Ohio, introduced the Countering Adversary Reconnaissance Act (S. 4763). The bill never became law, perhaps because it did not go far enough. It would have banned operation of connected vehicles or their components manufactured in foreign-adversary countries – as in China – but only within a 25 miles radius of military installations, federal facilities or sensitive infrastructure. That would be hard to track and regulate. New bills extended Brown’s restrictions, upping the ante so much so that it essentially led Polestar, a Chinese competitor to Tesla, to consider shutting down its assembly line in South Carolina. A new Commerce ruling is what is really threatening the Polestar line.

Last month on Sept. 3, the Alliance for Automotive Innovation, lobbied Congress to pass permanent restrictions on Chinese cars equipped with wifi and any onboard data collection equipment that could be sent back to the mainland. This is not some small advocacy group. It is made up of major U.S. and foreign automakers based in the U.S. It was formed in 2020 through the merger of the Alliance of Automobile Manufacturers and the Association of Global Automakers.

The Senate’s new bill, the Connected Vehicle Security Act (S. 4429), places restrictions on Chinese cars equipped with China-made software and hardware in statute. It’s not law yet for now, as the Commerce Department has put its foot down on that. And the actions, as indicated by former Senator Brown, are bipartisan.

It was the Biden administration’s Commerce Department in 2025 that outright restricted imports or domestic sale of connected vehicles, certain vehicle software and communications hardware, like onboard modems made by China. The stated purpose of the rule was to reduce the risk of foreign access to sensitive vehicle data or – in a worse case scenario – remote manipulation of vehicles; in this case one could imagine Washington worried about diplomatic vehicles, or high security personnel. The Commerce rule is final, published in the Federal Register on January 16, 2025, and it went into effect on March 17, 2025. Unlike France’s guidance on connected cars, the Biden-era rule hits products and supply chains directly rather than asking for consumer consent to data collection and then greenlighting the business relationship.

The Trump administration kept the Biden administration’s rule.

The crucial language is that “even if the vehicle was made in the United States,” its connection to Chinese telecommunications equipment makes it nearly impossible to do business here beginning with 2027 models. The rule covers specified software and hardware, plus covered manufacturers with Chinese or Russian ties, even for U.S.-built vehicles. It also provides authorizations to keep selling in a best case scenario for them.

As a result of that rule, the Polestar 3 electric SUV, made in Ridgeville, South Carolina, faces serious uncertainty about its future here. Volvo Cars operates the factory and is majority owned by Geely.

In its first-half results release, Polestar said that Commerce’s Bureau of Industry and Security (BIS) denied authorization for U.S. sales beginning with model year 2027. The company counts Volvo as an investor, and Volvo also makes the EX90 at that Ridgeville factory. Volvo Cars, which is majority owned by Geely, said the company would make sure there was “no leakage of information, or customer data to Chinese companies and Chinese people.”

Hakan Samuelsson, President and Chief Executive Officer of Volvo Cars said on Sept. 17 that the company has “introduced an absolute firewall,” and that they have approval to keep making and selling cars in the U.S.  Polestar 3 already shares Volvo’s SPA2 architecture with the EX90; so changing hardware alone would not resolve the separate ownership and Chinese entity control issue to permit sales authorization.

The connected vehicles story – taking place not only in a hawkish Washington but also in a more lenient Europe – might set the table for other machines to face similar scrutiny. As the U.S., and numerous multinationals, as seen by the Alliance for Automotive Innovation, worry that China’s rise across advanced technologies could wipe out legacy names, expect more companies to ask for similar evaluation of the data vacuums hiding inside their manufactured goods as well.

For example, on July 28, 2026, the Federal Communications Commission (FCC) added “foreign-produced advanced robotic devices” to its national-security Covered List. That means those products would need authorization for imports effective immediately. Six months before the FCC action, iRobot announced that Shenzhen Picea Robotics and Santrum Hong Kong acquired 100% of the company as it emerged from Chapter 11. Picea had been iRobot’s principal contract manufacturer, but now iRobot, which is based in Bedford, Massachusetts, is fully China owned despite its products, like the Roomba, likely being considered by most consumers today as an American brand. Newly manufactured Roombas can still enter if they consist of a previously authorized model; the restriction targets new product lines, which will need approval.

The Roomba Max 875 Combo, unveiled in September, was paused for sale here because of the FCC rule. iRobot’s chief engineer reportedly said the company was working with advisers on ways to continue bringing new Roombas to the U.S.

The FCC rule serves as an example of scrutiny extending beyond cars into household goods. Commerce’s vehicle rule addresses specified China connections. Meanwhile the FCC robotics action reaches all foreign-produced devices more broadly. The trend, however, has been set.

MADE IN AMERICA.

CPA is the leading national, bipartisan organization exclusively representing domestic producers and workers across many industries and sectors of the U.S. economy.

The latest CPA news and updates, delivered every Friday.

NEWSLETTER

WATCH: WORTH FIGHTING FOR

Get the latest in CPA news, industry analysis, opinion, and updates from Team CPA.