On April 16, 2026, a subcommittee of Japan's Council for Japan's Growth Strategy — chaired by Prime Minister Sanae Takaichi — released a draft public-private investment roadmap with a striking ambition: capture roughly 25% of the global autonomous-vehicle market by the 2030s. The technical bet behind that number is what makes it interesting. Rather than the sensor-and-HD-map approach that Western robotaxi firms spent a decade and tens of billions perfecting, Tokyo is wagering on "end-to-end" AI driving systems — neural networks trained on vast quantities of real-time driving data that interpret the road dynamically, sidestepping the cost of building and maintaining centimetre-accurate 3D maps for every street.
It is a credible industrial strategy. It is also a data strategy that the roadmap has not finished writing.
Why the approach changes the policy question
Map-based autonomy front-loads its data problem: you survey a city once, store the map, and the car localises against it. End-to-end systems invert that. They are hungry for continuous, fleet-scale streams of camera and sensor data from real roads — pedestrian movement, cyclist behaviour, signage, the precise geometry of an unmarked rural intersection at dusk. The more vehicles on the road, the better the model; the better the model, the more vehicles sold. That flywheel is exactly why Japan, with Toyota planning Level 4 vehicles and Nissan targeting AI driving features across roughly 90% of its models by the early 2030s, thinks it can compete.
But the same flywheel means a Japanese autonomous fleet would become one of the largest continuous collectors of public-space imagery in the country. The roadmap names a market-share target without resolving who owns that footage, who may access it, how long it persists, and whether a carmaker's training corpus can be repurposed — by the manufacturer, by insurers, or by the state.
The case for caution is real
It would be a mistake to wave this away as hypothetical. The strongest version of the privacy concern is empirical, not speculative. In the United States, the Electronic Frontier Foundation has documented how automated licence-plate-reader networks built for one purpose drifted into others entirely — school-residency checks, background screening, even noise complaints. Infrastructure justified by a narrow safety rationale tends to accrete new uses once the data exists. A nationwide camera fleet recording streets in real time is precisely the kind of capability that invites that mission creep, and regulators who ignore it would be failing their job.
Japan is not starting from zero here. The Act on the Protection of Personal Information (APPI), overhauled in 2017 and amended effective April 2022, already governs how businesses handle personal data: operators must disclose their purpose of use, may not exceed it, and generally need consent before transferring personal data to third parties, as the Global Legal Insights survey of Japanese data law details. The Personal Information Protection Commission (PPC) enforces it. The hard questions — when blurred street footage counts as "personal information," whether model weights trained on identifiable faces are regulated, how consent works when the data subject is a bystander, not a driver — are unsettled almost everywhere, and Japan is no exception.
Proportionate rules, not a moratorium
Here is where Japan's broader regulatory posture is, in our view, the right one to build on. The AI Promotion Act, enacted May 28, 2025 and in force from June 4, 2025, is deliberately light-touch: it sets national objectives and coordination structures but, as the Future of Privacy Forum's analysis notes, contains "no explicit penalties, financial or otherwise," relying instead on guidance, cooperation, and existing sector laws like the APPI for binding enforcement. That "innovation-first" design is well suited to a fast-moving field where prescriptive ex-ante mandates would freeze a target the technology hasn't reached yet.
The risk is that light-touch tips into no-touch on the one issue end-to-end autonomy makes unavoidable: data governance. The fix is not to abandon the 25% ambition or impose an EU-style risk taxonomy on cars. It is to write three narrow rules into the investment roadmap before the fleets scale:
- Purpose limitation that survives the model. Driving data collected to train and operate the vehicle should not, by default, be available for law-enforcement queries, commercial resale, or insurer risk-scoring without a separate legal basis — the APPI's purpose-of-use principle applied seriously to fleet data.
- A presumption of edge-processing and de-identification. Where safety allows, imagery should be blurred or discarded on-vehicle rather than warehoused centrally. This is also good industrial policy: it lowers the legal and breach liability that could otherwise stall deployment.
- Transparency on access. Who can request the data — manufacturer, supplier, government — and on what authority should be published, not buried in a privacy policy that bystanders never agreed to.
The stakes
Japan's demographic case for autonomy is genuine: people aged 65 and older are about 29.1% of the population, and the bus-driver shortage is projected to reach 36,000 by 2030, per the U.S. International Trade Administration. Map-free, AI-driven mobility is a serious answer to that, and a 25% global share is a goal worth chasing. But the same roadmap that names the market target should name the data rules. Settle them early, narrowly, and in public, and Japan gets both the cars and the trust. Leave them to drift, and the mission creep EFF has chronicled becomes the story instead.