The EU Data Act and your car: who owns the data your vehicle generates

Your car knows where it has been, how hard it was driven, how its battery is ageing, and when its next component will fail. Historically that data flowed to the manufacturer and stopped there.

The EU Data Act changes the default.

Related: connected car data privacy and right to repair and diagnostic data access.

What the Act establishes

In broad terms, and for connected products generally rather than cars specifically:

Users can access the data their use of a product generates. If your driving produced it, you can get it.

Users can direct that data to a third party. An independent workshop, an insurer, a service of your choosing.

Manufacturers cannot use exclusive access to shut out competitors in aftermarket services.

Access should be provided without disproportionate barriers — not buried behind an interface designed to discourage use.

Why it matters for repair

The practical case is straightforward.

A manufacturer with exclusive access to a vehicle’s telemetry knows a component is failing before the owner does, and can contact the owner to book the work. An independent workshop, with no access, cannot compete for that job.

That is not about repair quality. It is about who gets to know first.

Choosing a good workshop.

The security counter-argument

Manufacturers make a real argument against unrestricted access, and it deserves acknowledgement.

A vehicle network reachable by third parties is a network reachable by attackers. Theft using diagnostic access is documented and increasing, and regulation now requires manufacturers to demonstrate control of the vehicle’s attack surface.

Car cybersecurity and CAN injection theft, UN R155 and R156 vehicle cybersecurity and security gateway modules and OBD access.

Both things are true simultaneously. Security is a genuine reason to control access, and controlled access is also commercially convenient. Distinguishing the two in any specific case is the hard part.

The privacy dimension

Separate from repair, and arguably more consequential.

Vehicle data is personal data when it relates to an identifiable person. Location history, driving behaviour, journey timing and destinations are all sensitive.

Questions worth asking about any vehicle or service:

• What is collected, and at what frequency?
• Where does it go, and for how long is it kept?
• Who else receives it — insurers, marketing, data brokers?
• Can you switch it off without losing functionality you paid for?
• What happens when you sell the car?

That last one is routinely overlooked. A vehicle sold with paired accounts, saved locations and app connections still active hands the next owner your data — and sometimes hands you continued access to theirs.

Selling a car: preparation and telematics insurance and driving data.

What you can do today

Independent of how the legislation settles:

1. Read your own data locally. A generic OBD adapter reads codes, live data and freeze frame without anyone’s permission: best OBD PIDs to log on a daily driver.
2. Keep your own records. A dated scan log is yours, and no one can restrict access to it: digital service records and OBD.
3. Review the connected services on your vehicle and switch off what you do not use.
4. Ask before signing up to insurance telematics — what is recorded, and what happens to it.
5. Reset everything before selling.

The EDR, which is separate

Event data recorders capture a short window around a collision — speed, braking, throttle, belt status. They are mandated in several markets and governed by their own rules, distinct from general data access.

EDR event data recorder in cars and car insurance claim evidence.

Where this goes

Diagnostics is moving to authenticated access over Ethernet: DoIP explained.

Whether the legislated minimum remains genuinely open — enough for an owner to diagnose their own car and an independent workshop to compete — is being decided now.

For an owner, the durable position is the same as it has always been: know your own vehicle’s data, keep your own records, and understand what you are agreeing to.

Try it on the free tier of the app — pair an ELM327 adapter and build your own history. Data you hold locally is data nobody has to grant you access to.