Since 12 September 2025, the user of a connected car (whether the owner or under a renting or leasing contract) has the legal right to access the data their vehicle generates and to decide which company to share it with. In addition, as we discussed in our definitive guide to the Data Act, new vehicles sold in Europe since 12 September 2026 must provide this access by design.

If you run a dealership, an independent workshop, a fleet or an insurance platform, this regulation radically changes your starting point: access to vehicle telemetry and data no longer depends solely on the manufacturer’s will.

What is a mobility data space?

A mobility data space is a trusted environment in which transport stakeholders can share data securely and under common rules, without giving up control over the information.

At European level, this infrastructure takes shape as the European Mobility Data Space (EMDS). The European Commission describes it as a technical and governance framework to achieve interoperability in transport.

At national level, this ecosystem lands in strategic projects such as the Integrated Mobility Data Space (EDIM), which drives the transport ecosystem in our country by connecting public and private infrastructures.

In both cases, the approach is purely decentralised: the aim is not to create a giant central database or data lake, but a network to connect ecosystems (public and private) that are isolated today.

However, for these spaces to work, they need raw material. The connected vehicle is one of the largest sources of mobility information, and thanks to the Data Act, we now have the legal layer that was missing for these closed silos to open up in a regulated way and feed the network.

What connected vehicle data does the regulation cover?

The European Commission has published guidance on applying the Data Act to vehicle data, which clarifies the scope of the regulation on the basis that the information is generated through the use of the vehicle. It affects any product whose main function is not to process data but which, when used, collects information about its operation or environment, as well as connected digital services that exchange data bidirectionally.

Which data is covered and which is not

The law covers data generated through the use of the vehicle (raw or pre-processed), such as battery charge, charging cycles, AdBlue level, kilometres driven or whether the lights are on.

By contrast, manufacturing and scrapping data are excluded, as is inferred data (that which the manufacturer produces with its own algorithms, such as predictive breakdown reports, range in km or driving style assessments).

It is also important to stress that the scope is not limited to the information the manufacturer is collecting today, but extends to data that the manufacturer can lawfully obtain without disproportionate effort: even if the brand’s official app does not report the fuel level, it is very likely an easily accessible data point, and they will simply have to enable it if the user demands it.

Two access routes to the information

There is also a relevant exception regarding which third parties can access this data: companies designated as gatekeepers under the Digital Markets Act cannot be third-party recipients (Art. 5.3). This was established to promote the competitiveness of SMEs and prevent abuse of a dominant position.

As a third-party recipient, depending on the design of the car, you will be able to receive the data through two regulated channels:

• Direct access: when the vehicle is designed so that the user can consult their data without intermediaries, for example through the interface or the OBD-II port. This is the preferred route for vehicles placed on the market from September 2026.
• Indirect access: when there is no direct access, the manufacturer (as custodian or Data Holder) must provide remote access to the readily available data, for example through an API on its server.

The data flow in four steps

For your company to be able to receive this data, the process follows a strict circuit:

1. Generation: the connected vehicle generates data as a result of its use.
2. Request and consent: the user asks to access that data or authorises it to be shared with their workshop, their fleet manager or an insurer.
3. Making available: the manufacturer delivers the data with the same quality it uses internally, without discriminating against independent providers.
4. Use by the third party: your company can now use the data, but only for the purpose agreed with the user, and in compliance with the GDPR.

Implementation challenges: the grey areas of current regulation

Every new regulation brings undefined areas that the market has to clarify empirically. Moving from a closed model to an interoperable one currently raises three open debates for automotive companies:

• What does “easy access” mean? The regulation requires access to be simple and of good quality. The technical debate centres on how this is interpreted in practice. If access is channelled through the OBD-II port, is it lawful to require the user or the workshop to buy a specialised tool to extract it?
• Calculating reasonable compensation: when data is delivered to a third party designated by the user, the manufacturer may ask for reasonable compensation (Art. 9). Although there are drafts and Commission guidelines on how to calculate it (published in early 2026), they are not binding. The debate over the applicable margin is still alive, although the law protects SMEs by specifying that they cannot be charged beyond direct technical costs.
• Overlap and supervision: the Data Act coexists with the GDPR and with deeply rooted sectoral regulations, such as Regulation 2018/858 on access to repair and maintenance information. The hierarchy and coexistence of these rules remain the subject of legal analysis.