On January 16, Mark Carney’s government agreed to admit an initial 49,000 Chinese-made electric vehicles a year at a 6.1% tariff in a bargain that included relief for Canadian agricultural exports. The quota grows 6.5% annually. Ottawa also presented the arrangement as an opening for Chinese automakers to invest in Canadian production.
On July 2, U.S. Trade Representative Jamieson Greer publicly objected to Canada routing Chinese cars and investment into America during the dispute over USMCA renewal. His office had declined to renew the agreement in its current form the previous day, although the pact remained in force.
Article 7 of China’s National Intelligence Law requires organizations and citizens to support and cooperate with intelligence work and keep its secrets. Article 14 authorizes intelligence agencies to demand assistance. A Canadian joint venture that leaves a Chinese supplier in control of vehicle records and remote access gives Beijing a continuing opportunity to spy on Americans and Canadians.
What the fleet records
Xiaomi’s sentry mode keeps cameras and sensors active after an owner parks and locks the car. An onboard AI model evaluates nearby activity, and the owner can view the surroundings remotely. Ordinary recordings remain local, while footage of incidents the system judges dangerous can go to the cloud. Xiaomi describes these features in the privacy policy for its connected services in mainland China.
BYD’s European notice describes cloud uploads every 30 seconds for selected information about the car’s condition and every 60 seconds for other operational signals. It names a data center in Paris.
China’s 2021 automotive-data rules specifically identify traffic around military installations, defense companies and government offices as important data, alongside freight movements, charging networks and external images containing faces or license plates. Beijing requires important automotive data to stay in China, subject to a security assessment for necessary transfers abroad.
An intelligence service with access to location histories can identify an owner’s home, workplace and routine. Repeated visits to a defense contractor help identify employees and other regular visitors. Observations around a military installation reveal arrivals, departures and changes in activity, with greater detail as more vehicles pass the same places over time.
Cameras also record bystanders and nearby vehicles. Those people never accepted the car’s privacy terms, and the institutions along its route have no control over the owner’s purchase. Across a large fleet, ordinary journeys provide repeated observations of places an intelligence officer would otherwise have to visit or watch.
The FBI’s account of Salt Typhoon describes Chinese hackers stealing customer call records, private communications and sensitive law-enforcement information from American telecom networks. In August 2025, the NSA and allied agencies linked intrusions across telecommunications, transportation, lodging, government and military networks to Chinese companies supplying cyber products and services to the Ministry of State Security and People’s Liberation Army. Canadian intelligence and cybersecurity agencies joined that warning.
Beijing’s terms for technology transfers
On October 16, Beijing began requiring companies to register covered technology exports, including licensing deals and transfers of ownership or actual control. Companies with exports already underway also have to register them. The same announcement proposed restrictions on 40 technologies, 23 involving AI, and named technology for designing AI chips for autonomous driving. Those proposed bans and licensing requirements remain under consultation.
A Canadian manufacturing license can provide the right to assemble and sell a vehicle without giving the local partner enough of the underlying technology to maintain the system independently. The partner may still depend on the Chinese supplier for software, remote services and technical support after a commercial dispute or a breakdown in relations between the two governments.
A Chinese supplier with permission to retrieve records or install software retains an avenue for intelligence collection regardless of the Canadian partner’s manufacturing expertise. The venture’s Canadian operator must be able to revoke that access without leaving the cars it supports unusable.
Trucks, buses and the border
Ruter, the Oslo region’s transit authority, tested Chinese Yutong and Dutch VDL buses in 2025. The Yutong’s update connection gave its manufacturer access to battery and power-management systems. Ruter said that access could theoretically allow the manufacturer to stop or disable the bus. The cameras had no internet connection. Ruter began adding controls over incoming updates so that software could be examined before reaching the vehicle.
Commerce excluded heavier trucks and buses from its January 2025 connected-vehicle rule, which applies below a gross vehicle weight rating of 10,001 pounds. The agency said it would address heavier commercial vehicles separately. From model year 2027, the rule restricts covered software linked to China in vehicle communications and automated driving and bars unauthorized sales by Chinese-controlled vehicle manufacturers.
Volvo announced a specific U.S. authorization on May 26 after discussions about governance, technology and data security. On June 25, Polestar disclosed that Commerce had declined to authorize sales from model year 2027 onward. Both manufacturers have ties to Geely, and Polestar manufactures its Polestar 3 in South Carolina. The public announcements don’t explain the different decisions.
The American restrictions concern Chinese control of manufacturers and connected systems, including in vehicles assembled in the United States. Canada’s import quota concerns where an EV was made. Neither the manufacturing location nor the badge establishes who retains access to its records, and subsequent software updates can change its data collection or connections to outside services years after its original approval.
Americans also work and travel in Canada, where information about their movements and visits to sensitive facilities retains its intelligence value even when the car collecting it stays north of the border. Canada’s quota permits more imports each year, and the proposed joint ventures offer Chinese suppliers a longer presence in an automotive industry already integrated with the United States.
Washington should carry its restrictions on Chinese-controlled vehicle systems into the Canadian trade negotiations and finish the rules for heavier trucks and buses. Chinese intelligence has already exploited commercial networks to reach sensitive American information. A supplier allowed to retain access to a growing connected fleet gains years of opportunities to collect information about streets, facilities and people who never bought the cars.