Who Builds the Box in Your Car, and the Federal Ban on Some of It

The company whose badge is on the grille rarely builds the connectivity hardware. The modem, the telematics control unit and much of the software stack come from a supply chain that is largely invisible from the driver's seat, and often from the dealership too.

You do not have to take that on trust. In January 2025 the United States government published a rule premised on exactly that opacity, and the rule is the most concrete public document available on what the connected-car supply chain contains and why officials consider parts of it a risk.

What the rule does

The Bureau of Industry and Security, part of the Commerce Department, issued a final rule restricting the import and sale of connected vehicles and components linked to the People's Republic of China and Russia. The rule was published in mid-January 2025 and took effect on March 17, 2025.

It operates on two categories:

The test is not where a part was manufactured but who controls the supplier. Sidley's analysis of the final rule describes the prohibition as covering hardware and software designed, developed, manufactured or supplied by persons “owned by, controlled by, or subject to the jurisdiction or direction of” those two countries. A company headquartered elsewhere can still fall inside the rule.

BIS maintains its own page defining covered software and VCS hardware in detail, which is the authoritative place to check whether a given component is in scope. We are not reproducing a component list here, because the definitions are technical and the official text is the version that matters.

The timeline

• Model year 2027: prohibitions on covered software take effect
• Model year 2030: prohibitions on VCS hardware take effect
• For hardware units not sold by model year, BIS gives a calendar date of January 1, 2029

The staggering is the interesting part. Software was given roughly three years and hardware roughly five, which is a reasonable proxy for how long each takes to engineer out of a vehicle program. Hardware is designed into a platform years ahead; software can be replaced within a product cycle.

What is in scope, and what is not

The rule applies to new on-road vehicles sold in the United States. Per Sidley's summary, commercial vehicles above 10,000 pounds gross vehicle weight rating are excluded, motorcycles are included, and e-bikes and electric scooters are outside it entirely. BIS describes the covered population as vehicles under 10,001 pounds.

Several exemptions are worth knowing:

• Legacy software subcomponents produced before March 17, 2026, provided they are not subsequently maintained by a covered entity
• VCS hardware imported for repair or warranty work on vehicles from before model year 2030
• Small business exemptions
• Vehicles for display, testing or research, and vehicles not used on public roads

Importers and manufacturers that are not engaged in prohibited transactions must still file annual Declarations of Conformity with BIS. That is the enforcement mechanism: a paper trail between companies and the government.

Why the government framed this as security, not privacy

BIS states the concern directly: companies from these countries may be compelled to share data or allow remote access to connected vehicles in the United States. Two distinct risks sit inside that sentence, and they are worth separating.

The first is data exfiltration — a vehicle reporting where it has been to a party the owner never considered. The second is remote access, which is a safety question rather than a privacy one. The research record shows the second is not hypothetical: Tencent's Keen Lab documented remote paths into Tesla and BMW systems, and the 2015 Jeep demonstration reached a moving vehicle's brakes. We cover those cases in When Connected Cars Get Hacked.

It is a meaningful shift in how this subject is regulated. A privacy rule asks whether you consented. A supply-chain rule asks who could be compelled, regardless of what anyone consented to — which means it protects people who never read a privacy policy. That is also its limit.

What this does and does not do for you

Put plainly: a vehicle fully compliant with this rule can still stream your location to its manufacturer and the manufacturer can still sell behavioral data to a consumer reporting agency. California's $12.75 million settlement with GM in May 2026 concerned exactly that, and involved no foreign supplier at all. The pipeline is covered in Your Car Is Reporting on You.

A note on what we are not claiming. We are not naming individual suppliers or asserting who owns them. Ownership structures change, and a claim that a particular company is “controlled by” a foreign government is a legal determination we have no basis to make. BIS is the body that makes it, and its published guidance is the place to look. Where we cannot source a claim, we leave it out.

The practical question to ask

Since the supply chain is not visible to buyers, the useful questions are the ones a manufacturer must answer in its own documents:

1. Does the vehicle have its own cellular connection? If it transmits without your phone, it has a modem and a data path.
2. How do security updates reach it? Over the air, or only at a dealer? Keen Lab's BMW findings were explicitly not fixable over the air.
3. What does the privacy policy permit, as opposed to what the marketing says? Mozilla's 2023 review found all 25 brands it examined failed on this.
4. Can you request deletion, and does the company honour it without extra hurdles? California fined Ford $375,703 in March 2026 over friction in that process.

For the brand-by-brand answers and the request routes, see How to Stop Car Companies From Collecting Your Data.