Data flows unnoticed
However, it is often unclear what information is sent to the manufacturer and when. Is it just technical data about the car’s performance, so that, for example, preventive maintenance can be scheduled? Or does the manufacturer use aggregated data from many cars of the same model to design a better successor to that model? Does the manufacturer perhaps also collect information about driving behavior, and why? Does the car also send audio and video streams from the cameras and microphone back to the factory?
Presumably, there’s a mention of this in the privacy statement you received when picking up your new car, but who actually reads through those lengthy documents from cover to cover? And do you have any say in which data is sent and which isn’t?
The European Data Act is intended to ensure that users of connected products and related services have more control over the data they generate through the use of those products and services. This applies not only to cars and other vehicles, but also to industrial machinery, medical and fitness equipment, and other smart devices, such as those found in buildings.
New requirement
The Data Act is being implemented in phases. The Data Act has been in effect since September 12, 2025. However, starting September 12 of this year, “access by design” will be mandatory for every connected device covered by the regulation at that is placed on the market after that date. The usage data covered by the Data Act must be accessible to the user by default in a usable, machine-readable format.
In principle, the manufacturer is required to make all this data available securely , free of charge, and without undue delay. As an end user, you may sometimes have to request it: the data is not always provided automatically. For example, some automakers offer the option to export data or submit a request to do so via a privacy portal linked to the online user account. This may involve a one-time data export, a periodic download, an API, or a continuous data stream.
As an end user, you are given the option in some cases to disable data flows to the manufacturer, but certainly not always. In the case of cars, some services based on telemetry data are even required by law, such as eCall for incident information. However, the Dutch Data Protection Authority states that systems not required by law must, in principle, be disabled by default. They may only be enabled after the user has actively chosen to do so. Examples include personalized in-car navigation, voice assistants, vehicle tracking, and systems that process communication data. If you refuse to give consent for such data to be sent to the manufacturer, this may affect the proper functioning of certain apps.
Shift in the default setting
“Access by design” does not mean that all devices will suddenly become privacy-friendly. The Data Act does, however, ensure that the default principle shifts: if data is collected, the user must, in principle, be able to view and use that data—and, if desired, share it with independent third parties.
