Who owns the data your car collects? From 12 September, the EU answers that
Any connected product placed on the European market from that date must be built so the user can reach the data it generates. The right has existed since 2025 — what changes is that it stops depending on the manufacturer's goodwill.
Your car logs how hard you brake, where you park, how often the driver’s door opens and the moment a sensor started misbehaving. A tractor counts engine hours. A watch counts steps. For years all of that sat somewhere the owner of the machine could not reach. The manufacturer could reach it. So could whoever the manufacturer let in.
That changes status on 12 September.
From that date, the part of Regulation (EU) 2023/2854 known as the Data Act requires connected products and related services placed on the European market to be designed and manufactured so that the data they generate is easily, securely and, where relevant, directly accessible to the user.
The right isn’t new. The engineering is
Worth separating those two, because most coverage runs them together.
The right to get at your own device’s data has applied since 12 September 2025. If you drive a connected car today, you can already ask for what it produces. In practice, asking does not always work. The manufacturer replies that the information sits in a proprietary format, that extraction is complex, that no interface exists. The regulation is formally satisfied. The user gives up.
What September 2026 adds is the requirement that access be designed in from the drawing board. A product launched after 12 September 2026 has to ship with that door already built. It stops being an after-sales favour and becomes a design specification — and a manufacturer who skips it is not being unhelpful, it is in breach.
What this is actually for
The clearest example is the repair shop. If your car’s diagnostic data is accessible and can be shared with a third party of your choosing, an independent garage can do the work without waiting on whatever the brand’s own network decides to release. The same logic covers farm equipment servicing, home medical devices and connected appliances.
There is a second date worth marking, and it matters most to anyone running systems rather than driving them. The fees cloud providers charge a customer who wants to move to a competitor are capped at the direct cost of the switch, and disappear entirely on 12 January 2027. Same intent as the first rule: make leaving technically possible and economically painless.
What doesn’t change
There is no universal button. The regulation fixes the outcome rather than the interface, so the first months will be uneven from sector to sector and brand to brand. It also does not replace the GDPR — where product data is personal data, both apply at once, and the Data Act is nobody’s shortcut to information about you.
Because it is a regulation rather than a directive, it applies directly in Portugal with no national transposition, which means the date lands here exactly as it lands in Germany or Ireland. Brussels has been legislating on digital faster than member states manage to enforce, as we saw when France’s under-15 social media ban collapsed on method rather than substance, and enforcement remains the hard part — the same gap running through national files such as the mobile spectrum renewal now under consultation.
For anyone buying a car this autumn, though, the reading is simple. From 12 September, whatever the vehicle knows about you is born with a way out.
By Oliver Grant
Image: Mariordo (Mario Roberto Durán Ortiz) / Wikimedia Commons (CC BY-SA 4.0)
