A strategy built on data, with a gap in the middle
On 3 September 2026 the US Department of Transportation released America Leads: DOT's National Strategy for Automated Vehicles, Fiscal Years 2026-2030. According to Holland & Knight's analysis, it is guidance, not a rulemaking, and creates no new binding obligations. It replaces DOT's AV policy statements going back to 2016 and builds on NHTSA's April 2025 AV Framework.
The strategy has four objectives: safety, regulatory certainty, American innovation and interoperable corridors. Its data agenda is the most concrete part. DOT says it will promote cross-state data interoperability and digital infrastructure along the interstate system. Per Holland & Knight, an Interstate Corridor Modernization initiative aims at real-time sharing of events such as emergency closures and roadway realignments. The document also supports machine-readable traffic rules for automated driving systems.
We think this is the right direction. A driverless truck that crosses three states should not have to interpret three different sets of work-zone signage and closure notices. Shared, machine-readable infrastructure data is a cheaper path to safe deployment than more vehicle-side mandates, and it favors small developers who cannot afford bespoke state-by-state integrations.
The strongest case for more rules
Critics have a fair point. A strategy with no binding force can be rewritten by the next administration. Trade press has noted that it names goals without laying out a path to them. And NHTSA's 2025 changes did loosen the crash-reporting regime. According to Sidley Austin, the Third Amended Standing General Order, effective 16 June 2025, stretched the initial report deadline for serious crashes from one calendar day to five, dropped monthly filings for companies with no reportable crashes, and let one entity file where several are responsible.
If you want public trust in automated driving, the argument goes, you want more data about failures, not less. That argument has merit, and it is why the strategy's statement that crash-reporting obligations remain fully in force matters. Reporting continues, and the five-day clock still gives NHTSA the data it needs for defect investigations.
What the strategy does not say
The more consequential omission is passenger privacy. Interstate data exchange and machine-readable rules are largely about roads and traffic. But the vehicles themselves generate data about people: precise location, driving behavior and, in many models, in-cabin camera feeds. The strategy does not address passenger privacy or in-cabin camera data.
That gap is not hypothetical. In January 2026 the FTC finalized its order against General Motors and OnStar over the collection and sale of drivers' geolocation and driving-behavior data. The order bars GM from giving that data to consumer reporting agencies for five years. For 20 years, GM must obtain affirmative express consent before collecting, using or sharing connected-vehicle data, with exceptions such as sharing location with emergency responders. The FTC voted 2-0.
The case shows who currently polices vehicle data: a consumer-protection agency acting after the fact, under general deception and unfairness authority. The AV strategy, written by the agency that sets safety expectations for these vehicles, says nothing about how its new data-sharing pipes should treat personal information.
A proportionate path
We do not argue for a sweeping federal privacy statute attached to AV policy. That would be slow and could freeze a still-maturing technology. A lighter approach would work better:
- Separate operational data from personal data. Corridor feeds on closures, lane geometry and traffic rules should be designed to carry no passenger-identifying information. DOT can say so in its interoperability work without any new rule.
- Adopt the FTC's consent model as a baseline. The GM order is a workable template: express consent for collection and sharing, deletion and access rights, and a narrow safety carve-out. Operators can follow it voluntarily.
- Address in-cabin cameras explicitly. Driver-monitoring and cabin cameras can serve real safety purposes. Guidance on retention limits and on-device processing would let developers keep those benefits without building a surveillance record.
- Keep crash reporting tight. The five-day window is defensible, but DOT should publish how it uses SGO data so the public can judge whether the lighter regime works.
Bottom line
DOT is right to treat data as AV infrastructure and right to keep crash reporting in force. But a strategy that connects states and vehicles without saying how personal data is handled leaves the question to enforcement actions after the fact. A short privacy annex, voluntary and modeled on the FTC order, would cost developers little and strengthen the public confidence the strategy depends on.