Your Next Car Is a Computer. Washington Just Decided Whose Computer Counts.

If you have shopped for a new car in the last year, you have already met the issue, even if nobody used the words “Connected Vehicle Rule.” The salesman talked about the app that starts the car from the grocery lot, the subscription that keeps the maps fresh, the hands-free highway system that wants a camera on your eyes. All of that travels over a modem. That modem is why Polestar is leaving the U.S. market after the 2026 model year, why Volvo got a pass from the same parent company, and why Ford and GM are in a quieter fight with their own customers over insurance data.

Start with the shopping list, because that is what a buyer feels first.

Polestar will keep selling leftover 3s and 4s and will keep servicing cars already on the road. It will not sell model-year 2027 and newer vehicles in the United States. The cars were not banned because they are unsafe or because the Polestar 3 is built in China — it is built in South Carolina, next to Volvos. The Commerce Department denied Polestar an authorization under a 2025 rule that restricts vehicles whose connectivity software, or whose manufacturer, has a sufficient link to China or Russia. Software limits hit in 2027; hardware limits come later. Volvo, also controlled by China’s Geely, received that authorization in May after talks about how it governs technology and where vehicle data goes. Same owner, same factory campus, different plumbing. If you like the Polestar, the practical question is resale and parts five years out, not whether the hood will fly off on I-95.

The rule’s official fear is not subtle. A modern car knows where you sleep, which gate you use at work, how hard you brake, and, in some systems, what the cabin camera sees. Over-the-air updates mean the company that signs the software can change the car after you drive it home. Washington’s claim is that a government which can legally compel a company — China’s intelligence law is the example they cite — could demand that data or that update channel. “Remote access” is the door. “Remote control” is using the door to act on the car, not just read it. You do not need a spy novel. You need to notice that the same pipe that finds a stolen F-150 can, in theory, be pointed the other way.

That is the foreign-adversary story. It is not the whole story sitting in your driveway.

American brands already collect a great deal of the same information. Ford’s privacy notice lists vehicle diagnostics, driving behavior, precise location, and some voice and camera data, depending on the trim and whether a Ford account is tied to the VIN. Turning it off in a serious way often means a factory reset or unlinking the vehicle — which also kills the features the sticker price assumed you wanted. General Motors was the ugly public case: OnStar driving and location data sold into the insurance-scoring market, followed by an FTC ban on sharing that class of data with consumer reporting agencies and a record California penalty. Ford drew a smaller California fine in 2026 for making the opt-out harder than the law allows. So if the government’s theory is that this data is sensitive enough to keep away from Beijing, it is also sensitive when an insurer or a data broker in Omaha has it. The difference is who can force the lock and what they are likely to do with the key. A buyer can sue Ford in a U.S. court. That is not nothing. It is also not privacy.

You will hear a third story this month, and it is the one Detroit wants in the headline. Auto groups have written President Trump ahead of a meeting with Xi Jinping: keep Chinese firms from selling, importing, or manufacturing here. They mention data. They also mention cheap, subsidized cars and a “foothold” that would steal share from companies that already build in the United States. There is already a roughly 100 percent tariff on Chinese-built vehicles. The software rule is a second wall. Industry wants both poured into permanent law. Trump has floated the Japanese-plant model — build here, hire here. Incumbents do not want that deal. Protection of jobs and protection from spies are being sold as one product. A careful reader can separate them. If a Chinese brand put U.S. data, signing keys, and updates in a structure American courts could actually reach, and still got refused, you are looking at market share. If Volvo can rewire its pipeline and stay, you are looking at architecture. Both happened.

What should you do on the lot?

Ask what happens to the car if the brand leaves. Ask whether location sharing is on when you create the app account — it usually is. Read the one-page connected-services summary, not the 18,000-word policy. If you care about insurance scoring, assume telematics are on until you have proof they are not. If you care about the national-security case, ownership and whose lawyers can reach the server matter more than the assembly badge on the door jamb.

The car is already a spy in the mild, commercial sense. Washington has decided some spies are unacceptable and some are a subscription. That is the article a buyer can use. The rest is trade policy wearing a seatbelt.