On the latest episode of “The Drive,” my co-host Karl Brauer and I talked about a question that should give anyone who has ridden in a driverless car pause: Waymo is putting Chinese-built vehicles on American roads.
The robotaxi company, owned by Alphabet, is already using its new Ojai vehicles to carry passengers. The cars are built on a platform supplied by China’s Zeekr. These aren’t prototypes tucked away on a test track.
There’s nothing automatically troubling about a car being made overseas. Americans have bought foreign-built vehicles for decades. But China raises a different set of concerns. Washington has repeatedly warned about national security risks tied to Chinese connected-vehicle technology. So if some of that technology is considered risky enough to restrict, why are Chinese-built cars operating in America’s expanding driverless fleets?
Karl put it simply: “How about a Chinese computer driving you?”
There is a distinction, though. The Ojai is built in China, but Waymo says the system that drives it is American. Whether that resolves the security concerns is a separate question.
A Chinese car with an American system
Waymo’s Ojai uses a vehicle manufactured by Zeekr, part of China’s Geely Holding Group. Zeekr supplies the electric vehicle, while Waymo adds the cameras, sensors, computers, and software needed for autonomous driving.
Waymo says the cars arrive from China without connectivity hardware or self-driving sensors. The company installs its equipment in Mesa, Arizona.
It also says it doesn’t share passenger data, vehicle information, or its autonomous-driving technology with Zeekr. According to Waymo, Zeekr has no access to its source code, algorithms, or AI models.
Those assurances matter. Still, someone should be able to verify independently that the whole vehicle, including its underlying electronic components, is secure.
The Polestar question
Consider Polestar. In June, the Commerce Department’s Bureau of Industry and Security denied the automaker permission to sell vehicles in the United States beginning with the 2027 model year.
Polestar can continue selling its remaining earlier-model inventory and servicing existing customers’ vehicles. But under the current decision, it can’t bring new 2027-model-year vehicles to the U.S. market.
The issue is federal restrictions on connected-vehicle technology linked to countries viewed as national security threats.
Polestar is headquartered in Sweden, but it has ties to China’s Geely group and its founder, Li Shufu. Geely also owns Zeekr, which supplies the vehicles used for Waymo’s robotaxis.
So one Geely-linked automaker has been blocked from selling future models in the U.S. over connected-vehicle security concerns, while another is providing cars for Waymo’s growing fleet.
There is a difference between the cases. Polestar uses connected technology covered by federal restrictions. Waymo says it replaces the relevant systems with American-developed hardware and software.
But a modern vehicle is more than its navigation system or the computer doing the driving. Electronic control units handle functions such as braking and battery performance, and those systems communicate with one another. Securing the autonomous-driving equipment is one thing. Establishing that the underlying vehicle is secure is another.
That’s why independent testing of the complete vehicle matters.
What a car can access
At an international automotive test event, I was preparing to drive a Chinese-made vehicle when a Volvo representative asked to ride along. Before we set off, he told me to switch off my phone’s Wi-Fi and Bluetooth.
I asked him why. He said the car might automatically try to connect to my phone, potentially giving it access to features such as contacts, messages, and navigation.
When we started the vehicle, a notification appeared saying it couldn’t connect to my phone.
That kind of automatic connection isn’t unique to Chinese cars. Vehicles made in the U.S., Europe, Japan, and South Korea offer similar features. Still, the experience made me think about how readily we let our cars access information that used to stay on our phones.
A connected vehicle may know where you go, when you leave home, where you work, and which places you visit regularly. Depending on the car and the permissions you allow, it may also interact with contacts, messages, and other personal information.
Most of us don’t give those permissions much thought. We want the navigation to work and the music to play. I do, too.
Autonomous vehicles add another layer. They rely on cameras, sensors, computers, and communications systems to operate. Who controls the information they collect? Where does it go, and who can access it? Those questions matter no matter where a vehicle was built.
New restrictions, unresolved questions
Washington has taken steps to limit connected-vehicle technology associated with China and Russia.
In January 2025, the Commerce Department finalized rules restricting certain connected-vehicle systems and components. Some software restrictions apply to vehicles from model year 2027, with additional hardware restrictions scheduled for model year 2030.
Two senators from different parties say those protections don’t go far enough. Michigan Democrat Elissa Slotkin and Ohio Republican Bernie Moreno introduced the Connected Vehicle Security Act of 2026. It would go further by restricting vehicles made in China, rather than focusing only on connected technology controlled by Chinese interests.
The bill passed the Senate Commerce Committee in July and received bipartisan support. But an effort to move it quickly through the full Senate stalled in September after Kentucky Republican Rand Paul objected.
The disagreement centered on a provision covering automakers with more than 15% Chinese ownership. Mercedes-Benz, a German company that also has U.S. factories, has nearly 20% Chinese ownership through passive investors. Paul argued the bill could unfairly stop Mercedes from selling cars in the United States.
Moreno has recognized the concern and said he is working on changes that would protect companies such as Mercedes-Benz and Volvo. No agreement was reached before the Senate’s election recess, so the bill will have to wait until lawmakers return in November.
For now, Waymo’s Chinese-built robotaxis can continue operating as long as they comply with federal connected-vehicle requirements.
There are concerns beyond Congress, too. Missy Cummings, an autonomous-vehicle researcher at George Mason University, has called for independent examination of the cars to determine exactly what equipment they contain.
In an October 29 report, Waymo said its completed robotaxis have no Chinese software or connectivity and that Zeekr cannot contact the vehicles remotely or send them software updates. The company also said its vehicle platforms undergo rigorous security audits.
But the report didn’t establish whether the complete Chinese-built vehicle had received independent hardware security testing, or whether the results of such testing had been made public. That seems worth clarifying. If the vehicles are as secure as Waymo says, independent verification would offer some reassurance.
Convenience comes with trade-offs
I understand the appeal of autonomous cars. For people who can’t drive because of age, disability, or another limitation, a dependable robotaxi could offer real independence. And for others, it means getting somewhere without dealing with parking or finding a designated driver. Those are meaningful benefits.
This isn’t only a China issue. American automakers and technology companies also gather huge amounts of information about vehicles and drivers. Consumers should be told plainly what is collected, how long it is kept, and who can see it.
Still, when vehicle components are connected to a country the U.S. government considers a national security threat, the questions become more serious. I’m not saying Waymo has been shown to send Americans’ personal information to China. Nothing here establishes that.
My concern is whether the safeguards are adequate, and whether anyone outside Waymo has thoroughly checked them.
If Washington considers Polestar’s Chinese connections serious enough to block future vehicle sales, it should clearly explain why Waymo’s Chinese-built robotaxis meet the government’s security standards.
Perhaps Waymo has addressed the risk by installing its own technology. But shouldn’t that be independently confirmed before thousands more of these vehicles appear on American streets?
When you get into a driverless car, you’re trusting more than the computer behind the wheel. You’re trusting everyone involved in building it.
