When the United States, Mexico and Canada formally open the USMCA joint review on July 1, 2026, the auto chapter will dominate the room. But the most consequential fight is no longer about regional value content or steel sourcing. As Automotive News reported on May 13, 2026, the talks now turn on a question that the 2020 agreement never anticipated: who controls the data flowing out of a connected car, and where its software was written. Mexico, where Chinese brands like SAIC's MG now occupy prime showroom space, has become the place where that question gets answered.
The security case is real, and worth stating plainly
The strongest version of Washington's argument deserves to be made before it is criticized. A modern connected vehicle is a rolling sensor platform: cameras, microphones, precise geolocation, cellular and satellite modems, and over-the-air software that the manufacturer can update remotely. The U.S. Commerce Department's Bureau of Industry and Security, in its final rule finalized January 16, 2025 and effective March 17, 2025, defines the Vehicle Connectivity System (VCS) to include telematics, Bluetooth, cellular, satellite and Wi-Fi modules, and the Automated Driving System (ADS) as the components that let a vehicle operate without a driver (bis.gov). A fleet of such vehicles, built or remotely maintained by a company subject to a foreign government's direction, is a plausible surveillance and disruption surface. That is not paranoia; it is the same logic that governs telecom equipment.
The BIS rule therefore prohibits VCS and ADS software, and later the hardware, that is "designed, developed, manufactured, or supplied" by entities under Chinese or Russian jurisdiction. The software prohibitions and the manufacturer-sales ban bite from model year 2027; the hardware prohibitions from model year 2030. The concern animating the USMCA review is that a Chinese automaker could assemble cars in Mexico, qualify for USMCA's preferential treatment, and route embedded Chinese connectivity into the U.S. market through the back door.
Why Mexico is the pressure point
The numbers explain the anxiety. Five Chinese brands sold a combined 101,078 vehicles in Mexico in 2025, with MG alone moving 48,816 units, according to Mexico's RAIAVL registry as reported by Mexico Business News. By the first quarter of 2026, Chinese brands had reached an 11.2% market share, matching German manufacturers for the first time (mexicobusiness.news). These cars are visible on Mexico City's main shopping streets in a way that makes the abstract trade debate concrete.
Crucially, Mexico has so far positioned itself as Washington's preferred partner rather than its problem. It has imposed tariffs on roughly 1,400 product categories aimed at Chinese imports, in pointed contrast to Canada's deal admitting Chinese EVs. So the connected-vehicle question is not Mexico defying the U.S.; it is Mexico being asked to police a data-governance standard it did not write and is not equipped to administer.
The proportionality problem
Here the rule's design starts to strain. The BIS prohibition is a categorical, ownership-based ban: it asks who controls the supplier, not what the specific vehicle actually does with data. That is administratively clean but analytically blunt. A connectivity module's risk depends on its data flows, update channels and access controls — properties that can be audited, encrypted, localized and independently certified. An ownership test treats a thoroughly audited, data-localized telematics unit as identically dangerous to an unaudited one, purely on the basis of corporate nationality.
For an open-internet, pro-innovation framework, that matters for three reasons. First, it imports a security model that scales poorly: every tier-two and tier-three supplier in a Mexican assembly line now carries nationality-of-origin compliance risk, raising costs across a deeply integrated regional supply chain that USMCA's own rules of origin were built to encourage (trade.gov). Second, it offers Mexican consumers fewer, more expensive vehicles while doing little to address the underlying issue — what data any car collects and transmits — which a Chinese-nexus ban leaves entirely unregulated for every other manufacturer.
Third, and most overlooked, Mexico's own data-governance capacity has just been weakened at exactly the wrong moment. In 2025 Mexico dissolved INAI, its autonomous data-protection and transparency regulator, transferring its functions to a body inside the federal executive branch (iapp.org). A connected-vehicle data regime ideally rests on a credible, independent privacy authority that can certify how telematics data is handled. Mexico has moved in the opposite direction, leaving the U.S. to fill the vacuum with a blunt import rule.
A better trade is available
The constructive path is not to wave Chinese hardware into the U.S. market. It is to make the standard about verifiable behavior rather than passport. A USMCA-wide connected-vehicle framework could require any vehicle sold in the bloc — regardless of where its parent company sits — to meet data-localization, encryption, third-party-audit and update-transparency obligations, with a trusted regional certification body. That would catch genuine surveillance risk from any source, give Mexican assemblers a compliance path instead of a closed door, and preserve consumer choice.
The July 1 review will not resolve this; U.S. Trade Representative Jamieson Greer has already said the parties "probably will not resolve all the issues by July 1." That is fine. The goal should be to replace a nationality test with a security test — one that protects drivers' data without quietly converting a trade agreement into an instrument for shrinking the cars Mexicans are allowed to buy.