Thirteen high-resolution cameras. That's what Waymo's purpose-built 5nm ASIC reportedly processes "simultaneously" and "in real time," per Waymo, delivering more than 1,000 TOPS of machine learning performance dedicated to front-end perception.
Waymo published that number on August 21. Four days later, it named Munich as its first European city.
Read those two posts as unrelated engineering and expansion news and you miss the play entirely. They may be the same document with different covers, and the audience is arguably not a rider in San Francisco. It could be a supervisory authority in Bavaria that has not yet ruled.
They may be the same document with different covers, and the audience is arguably not a rider in San Francisco. It could be a supervisory authority in Bavaria.
Last week, this column tracked the "AV goes global" thread through Wayve in London—a startup reportedly already operating inside a foreign regulatory regime. This week the story flips: a US leader crosses the Atlantic, names a concrete city and a hard date, and in doing so walks straight into the one regulatory regime that punishes exactly the thing its cars do best.
Look at the sequence. Around this window, the consumer beats: Gemini live in the Ojai, Houston open to everyone, and, reportedly, the sixth-generation vehicle rolling in SF, PHX, and LA. Then the chips post—"We're putting our chips on the table"—with the 5nm ASIC, the 20-fold compute scaling, the roster of partners from Nvidia to TSMC.
Then, August 25, Munich. And bundled into the same window, a privacy manifesto titled "Setting the Global Standard for Privacy in Autonomous Mobility."
Three posts, two weeks, one campaign. The tell is what the chips post and the privacy post have in common, because on the surface they share nothing—one is silicon, the other is policy.
Here is the connection. Waymo's compute disclosure may be not just a flex about latency and redundancy but, arguably, the technical substrate for a legal argument, and the privacy blog could be where that argument gets made explicit.
The chips post states that "all driving decisions are processed onboard the vehicle." The ASIC "instantly extract[s] critical information from raw lidar, radar, and camera streams" before that data reaches the main processing architecture. Everything happens in the car, in milliseconds, pixel to actuation.
Now read the privacy post's load-bearing sentence: the cameras "are designed for core functions like mapping routes, delivering our services safely, and improving our technology—not to surveil people or to identify individuals through facial recognition or other biometric identification technologies."
And: "We do not sell personal information collected by our vehicles' cameras and other sensors."
Those are not marketing lines. Under the GDPR, they are claims about lawful basis, purpose limitation, and data minimization—the exact principles a European regulator will test. Waymo may be pre-writing its compliance narrative before it maps a single Munich street.
The logic runs like this. If processing happens onboard, in the moment, for the sole purpose of driving, then Waymo can argue the camera feeds are transient operational data, not a surveillance archive. If there's no facial recognition and no biometric identification, it sidesteps the GDPR's Article 9 special-category minefield. If the data isn't sold, the commercial-exploitation objection collapses.
That is a tidy story. It is also where the tension lives.
A GDPR supervisory authority's hardest question is not "do you sell it" or "do you run facial recognition." It is: on what lawful basis do you record thousands of pedestrians who never consented, every day, on public streets?
Thirteen high-resolution cameras capturing high-fidelity information in real time is, by definition, mass processing of personal data of non-riders. The person crossing at a Munich intersection arguably did not sign Waymo's terms. They are not a customer. They are a data subject, and their image is being captured, processed, and—reportedly, per Waymo's privacy post—used to "improve our technology."
This is the data-minimization contradiction that no amount of onboard-processing elegance resolves. You cannot minimize what you must, by engineering necessity, capture. A robotaxi that can't see pedestrians is a robotaxi that can't drive.
So Waymo's move may be to redefine the purpose. The cameras aren't surveilling; they're navigating. The recording isn't collection; it's a "core function." That's why the phrase "not to surveil people" is doing so much work—it appears to be an attempt to characterize the intent behind the processing, because under GDPR intent and purpose shape whether processing is proportionate.
But a Bavarian DPA is not obligated to accept Waymo's self-characterization. The regulator gets to decide whether recording every face on a public street is proportionate to the driving purpose—and whether "improving our technology" is a legitimate secondary use or an impermissible repurposing of data captured for navigation.
That is the litigation waiting to happen. And the privacy blog reads exactly like the opening brief you'd file before it starts: a public, on-the-record statement of principle you can point back to when a regulator asks what your data practices are.
Note the specific commitments buried in the post. Privacy by design "with a focus on the privacy regulations in every country." A pledge to "challenge such requests if we believe they are overly broad." A dedicated privacy team that "engages with regulatory developments." This is the vocabulary of GDPR accountability—Article 5(2)'s requirement to demonstrate compliance—rendered as a blog.
Which brings us to the timeline, and the political weather around it.
Waymo says it will begin with manual driving and HD mapping, then test with trained specialists behind the wheel, aiming to open commercial ride-hailing "towards the end of 2027." Per TechCrunch, it holds no German permits today and is working with the Federal Motor Transport Authority, the KBA.
Germany was the first EU country to build a Level 4 legal framework, more than five years ago. That framework governs the vehicle. It does not settle the data question—road-safety law and data-protection law are separate regimes with separate regulators.
And the politicians are pulling in one direction. Dr. Florian Herrmann, head of the Bavarian State Chancellery, is unambiguous: "Now we need to move quickly from testing to real-world deployment. To achieve this, we will continue to improve the framework conditions, cut red tape and remove regulatory barriers."
"Cut red tape" is the tell. That is a state government signaling it wants the deployment to happen and will smooth the path.
But a data protection authority is not red tape a state chancellery can cut. GDPR enforcement in Germany is handled by independent supervisory authorities, and their independence is the whole point—they are structurally insulated from exactly this kind of economic-development pressure.
So here is the collision, arguably already in motion. Herrmann wants speed. The KBA governs the driving. An independent DPA governs the data. And Waymo has, on its own stated timeline, until "towards the end of 2027" to convert a self-authored "global standard for privacy" into something a Bavarian regulator will accept.
That is the real gap between the two posts. The chips can be shipped tomorrow. The 1,000-TOPS ASIC is a solved engineering problem. Whether a supervisory authority accepts that "onboard, transient, non-biometric, unsold" is a lawful basis for filming a city is not solved, and it is not Waymo's to decide.
The privacy manifesto may be Waymo's attempt to decide it anyway—to set the standard before anyone else does, in the hope the regulator adopts its framing rather than writing its own.
Whether that works is the entire European bet. Waymo is wagering that radical transparency—here is our silicon, here are our data principles, in writing, in German—is a moat wide enough to carry a sensor-saturated American robotaxi through the strictest privacy regime on earth.
The chips are on the table. The harder question is who gets to define what "privacy by design" means when the design requires recording everyone. And that answer won't come from Mountain View, or from a state chancellery eager to cut red tape. It comes from a regulator who hasn't spoken yet.
The timeline to late 2027 is not a long time to wait for a ruling that Waymo, arguably, has already tried to write for someone else.