EU Vehicle Data Access: What Car Owners and Independent Repair Shops Can Access

An independent shop in the EU has two legal routes into a customer’s car, and they open different doors. The first is the type-approval regulation, which since September 2020 has obliged manufacturers to give independent operators the same repair and maintenance information, diagnostic tools and software downloads their own dealers get^[4]. The second is the Data Act, which since 12 September 2025 has given the user of a connected product, a car included, the right to the data the product generates and the right to have it passed to a third party of their choice^[1][2]. The first door gives the shop the manual. The second gives the owner the data, and the owner decides who else sees it.

The United States has no single federal law equivalent to either framework. It has a Massachusetts ballot law from 2020 that is still in court, a Maine law that was rewritten in April 2026 and gives manufacturers until September 2027 to build the access platform, a federal bill that cleared a House subcommittee in February 2026, and a Federal Trade Commission order against General Motors that is about the opposite problem: not who can get the data, but who the manufacturer sold it to^{[8][12][14][15]}. This article lays out what each of those texts actually grants, with the article numbers, so an owner or a shop on either side of the Atlantic knows what to ask for.

Two doors into the same car

Regulation (EU) 2018/858 and the Data Act cover different things and the Commission says so in the first pages of its vehicle-data guidance: the guidance “only relates to the Data Act” and does not affect the application of sector-specific legislation such as the Type Approval Regulation^[3]. Type approval is about repair and maintenance information: wiring diagrams, procedures, software, diagnostic tool references, the things a shop needs to fix a car it already has in the bay. The Data Act is about product data: the signals the car generates while it is driven, held by the data holder, often through the manufacturer’s backend, which the user can now demand and redirect. A shop that confuses the two asks the wrong regulator for the wrong thing.

Door one: repair information under the type-approval regulation

Article 61(1) of Regulation 2018/858 is the sentence independent shops have been quoting since the regulation started to apply on 1 September 2020^[4]. Manufacturers “shall provide to independent operators unrestricted, standardised and non-discriminatory access to vehicle OBD information, diagnostic and other equipment, tools including the complete references, and available downloads, of the applicable software and vehicle repair and maintenance information”, presented “in the form of machine-readable and electronically processable datasets”. The same article gives independent operators access to the remote diagnosis services the manufacturer’s own network uses, and requires “a standardised, secure and remote facility” so that independent repairers can complete work that touches the vehicle security system^[4]. The technical detail, including the fee structure, lives in Annex X of the regulation.

Annex X was rewritten this year. Commission Delegated Regulation (EU) 2026/699, adopted on 23 March 2026 under Article 61(11) and in force since 23 June 2026, twenty days after its publication in the Official Journal, extends the standardised repair-information requirements to the things a modern shop actually gets stuck on. The amended Annex adds “information about functions and capabilities necessary for calibration and repair of Advanced Driver Assistance Systems (ADAS) or Driver Control Assistance Systems (DCAS)”, the “information required to determine whether a software update or variant coding is necessary for a specific repair and maintenance operation” and to identify the correct one, the information “necessary for the diagnosis and, where applicable, the repair of traction battery systems” and their exchangeable modules, and an obligation to give makers of generic diagnostic tools the specifications needed to diagnose ADAS/DCAS systems^[18]. On the security side it writes down, in a new Appendix 4, which access conditions a manufacturer may impose in the name of cybersecurity, and states that cybersecurity measures must not restrict OBD access “beyond what is necessary and proportionate”; the recitals cite the Court of Justice’s 2023 Carglass judgment, C-296/22, which had already held that manufacturers may not make OBD access subject to conditions the regulation does not provide for^[18].

How far that obligation reaches was settled by the Court of Justice on 9 November 2023 in the Scania case, brought by the German parts-trade association. The Court held that manufacturers must provide access to all repair and maintenance information in a format that “must lend itself to direct electronic use”, that they must set up a database of replaceable parts searchable by vehicle identification number and by criteria such as engine output or trim level, and that the VIN must be in that database. A VIN becomes personal data when whoever holds it can identify the owner, and the Court ruled that the GDPR does not stand in the way of manufacturers being obliged to hand it to independent operators anyway^[5]. For a shop, that judgment is the difference between a parts catalogue you can search by the car in front of you and one you cannot.

Door two: the Data Act, article by article

The Data Act entered into force on 11 January 2024 and applies from 12 September 2025^[2]. Its Article 2 defines a “connected product” as an item that “obtains, generates or collects data concerning its use or environment and that is able to communicate product data via an electronic communications service, physical connection or on-device access”, and a “user” as the natural or legal person who owns the product or holds contractual rights to use it, so a lessee counts^[1]. The Commission’s guidance leaves it to each manufacturer to assess whether a given vehicle is a connected product, and then treats the rest of the text as applying to it^[3].

Three articles do the work. Article 3(1) is a design rule: connected products “shall be designed and manufactured” so that product data and the metadata needed to interpret them are “by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible to the user”. Article 50 delays that design obligation to products placed on the market 32 months after entry into force; counted from 11 January 2024, that is September 2026, and the application date of 12 September 2025 is the 20-month mark in the same article^[1][2]. Article 4(1) covers every car that already exists: where the user cannot get the data directly from the product, the data holder “shall make readily available data” accessible “without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge” and, where technically feasible, “continuously and in real-time”, on “a simple request through electronic means”. Article 5(1) is the one a repair shop cares about: “upon request by a user”, the data holder shall make readily available data available “to a third party” on the same terms, free of charge to the user^[1].

Two limits sit inside the same chapter. Article 5(3) bars any company designated as a gatekeeper under the Digital Markets Act from being an eligible third party, and forbids it from soliciting or paying users to route their data its way. Article 6(2)(e) forbids a third party from using the data “to develop a product that competes with the connected product from which the accessed data originate”, and from using non-personal product data to derive insights about the data holder’s economic situation or production methods^[1]. And Article 9 sets the price between businesses: compensation “shall be non-discriminatory and reasonable and may include a margin”, taking into account the cost of formatting and dissemination and the investment in collecting the data^[1]. The user pays nothing; the shop receiving the data on the user’s behalf may be asked to.

What counts as vehicle data, according to the Commission

The guidance of 12 September 2025, document C(2025) 6119, is the first time the Commission has written down which signals a data holder must hand over. Raw data “may include” sensor signals such as wheel speed, tyre pressure from the TPMS valve, brake pressure, yaw rate, window and throttle positions, oxygen sensor readings, mass airflow, steering wheel angle and engine revolutions per minute. Pre-processed data include the state of a system derived from raw signals: engine running or not, stop-start active or inactive, battery charging status “in progress/finished/in failure mode and as a percentage”, and time or distance to the next service where that is a counter rather than a prediction^[3].

The line is drawn at inference. Following recital 15, data holders must give access to raw and pre-processed data with their metadata, while “information inferred or derived from such data” is out of scope. The guidance’s own example is a virtual fuel-level sensor built on a machine-learning model of driving style and trip history: the prediction stays with the manufacturer, but if a plain, less accurate fuel-level signal is readily available, that signal must be made accessible^[3]. Paragraph 42 adds the sentence independent shops should keep: the “same quality” requirement “entails a rule not to discriminate against the user or third parties such as independent repair shops”, so a manufacturer may not serve them data of lower quality than it gives its own dealers and authorised repairers^[3]. And where a manufacturer chooses to provide the data through the OBD-II port instead of over the air, paragraph 44 says the user “cannot be required to purchase a specialised access tool at their own expense or possess advanced technical skills”^[3].

What the Data Act does not give a repair shop

It does not give access to vehicle functions or resources. Paragraph 20 of the guidance says the Data Act “does not contain rules regarding access rights to vehicle functions or resources”, so sending a command to the car, unlocking a security-gated procedure or running a calibration is outside it^[3]. Those stay with the type-approval regulation and with each manufacturer’s own portal, which is why the procedures on our OEM ADAS calibration requirements page still have to be bought per brand. It does not override trade-secret protection either: the recitals let data holders identify trade secrets before disclosure and agree confidentiality measures with the user or the third party^[1].

And it is not the sector-specific law the aftermarket has been asking for. In January 2023 the Independent Service Providers group wrote to the Commission President to “put an end to the repeated delays” on a dedicated in-vehicle data regulation, noting the Commission had promised one by the end of 2021^[16]. The manufacturers’ association ACEA argued the opposite a month later: that the Data Act would make additional legislation unnecessary and the proposal should be postponed^[17]. The Commission’s Automotive Action Plan of 5 March 2025 landed closer to ACEA: it committed to the guidance and said the Commission “will, upon assessment of the effects of the Data Act, consider further action, including a legislative proposal on access to in-vehicle data”^[6]. Since then the Data Act itself has gone back into the legislative machine. The Digital Omnibus tabled on 19 November 2025 proposes to merge the Data Governance Act, the Open Data Directive and the free-flow-of-data regulation into a restructured Data Act; Parliament’s rapporteurs published a draft report on 22 June 2026 and faced more than 1,750 amendments by mid-July, while a Council vote scheduled for 26 June was cancelled^[7]. None of that changes Articles 3 to 5 today, but a shop building a business on them should watch the file.

The US comparison: Massachusetts, Maine and a federal bill

The American version of door two is a state ballot question. Massachusetts voters approved Question 1 in November 2020, and its text is narrower than the Data Act in scope but sharper in mechanism: from model year 2022, a manufacturer that “utilizes a telematics system shall be required to equip such vehicles with an inter-operable, standardized and open access platform across all of the manufacturer’s makes and models”, capable of “securely communicating all mechanical data emanating directly from the motor vehicle”, accessible to the owner “through a mobile-based application” and, with the owner’s authorization, to an independent repair facility for the time it takes to complete the repair. The same text adds what the Data Act leaves out: “the ability to send commands to in-vehicle components if needed for purposes of maintenance, diagnostics and repair”^[8].

That command clause is why the law spent years in federal court. NHTSA’s letter of 13 June 2023 had set out its safety objection; on 22 August 2023 it wrote to the Massachusetts Attorney General with a way through: the agency’s concern was “the ability to, at scale, remotely access and send commands that affect a vehicle’s critical safety systems”, and a solution that gives owners and authorised shops wireless access “from within close physical proximity to the vehicle”, for instance over Bluetooth, “would not be preempted”^[9]. The manufacturers’ trade group Auto Innovators kept litigating. The First Circuit heard argument in February 2026, its panel suggested mediation, and on 25 February 2026 the Attorney General declined, writing that mediation “will be unproductive and dilatory”; as of late August 2026 the decision is still pending^[10].

Maine copied the model by ballot in 2023 and then adjusted it. Title 29-A, section 1810 requires standardized OBD access without manufacturer authorization, an independent entity to administer access to vehicle-generated data, and for model year 2018 and later cars, access to the on-board diagnostic and repair information system through a non-proprietary interface complying with SAE J2534, SAE J1939 or ISO 22900^[11]. LD 2211, signed on 13 April 2026 as Public Law chapter 660, creates a Motor Vehicle Right to Repair Commission and moves the deadline for the owner-authorization access platform to 1 September 2027^[12]. Auto Innovators told the federal court in Maine on 14 August 2026 that it intends to keep challenging that law too^[10].

The federal REPAIR Act, H.R. 1566, would make the state approach national. Its text gives vehicle owners or their designees access to vehicle-generated data “through and including the interface ports of the motor vehicle (including OBD port and J-1939)” and, where the car transmits it, “over wireless technology via any telematics system”, and requires manufacturers to make critical repair information and tools available to owners, parts makers, tool makers and repair facilities “in or at the same manner, time, method, cost (less discounts and rebates), data content set” as any dealer or authorised service provider^[13]. On 10 February 2026 the House Energy and Commerce subcommittee on commerce, manufacturing and trade agreed to forward the bill to the full committee^[14]. That is a subcommittee vote, not a law.

The other US front: who the manufacturer sold the data to

The Data Act treats the car’s data as something the user controls. American law has no general rule of that kind, and the one federal case on point was about the opposite flow: not who may obtain the data, but whom the manufacturer sold it to. The Federal Trade Commission alleged in January 2025 that General Motors and OnStar sold precise geolocation and driving-behaviour data from millions of vehicles to third parties, including consumer reporting agencies, without informed consent; the final order of 14 January 2026 bans that disclosure to consumer reporting agencies for five years and, for the order’s 20-year life, requires affirmative express consent before collecting, using or sharing connected-vehicle data, plus a way to request a copy of the data and its deletion^[15]. That is a privacy remedy against one company, not an access right, and it deserves its own page.

Side by side: a European owner has a statutory right to obtain the car’s data and hand it to a shop, with the data holder’s own use still governed by the GDPR, which the Data Act leaves untouched^[3]; a GM owner in the United States has, by consent order, the right to stop one manufacturer selling driving data to a credit bureau. The one thing the American texts do that the European ones do not is spell out the right to send a command to the car, and that is exactly the clause NHTSA fought over. How insurers use driving data on the pricing side is on our insurance and parts prices page.

What to actually ask for

• An EU owner asks the data holder, which is the manufacturer for most cars but not by definition, in writing and by electronic means, for the “readily available data” under Article 4(1), and names the shop as the third party under Article 5(1). Free of charge to the owner and of the same quality the dealer sees. For connected products placed on the market after 12 September 2026 the Article 3(1) design obligation also applies: the data must be made directly accessible where relevant and technically feasible^[1].
• An EU shop wanting the repair procedure, the software or the security-gated function goes to the manufacturer’s repair-information portal under Article 61 of Regulation 2018/858, and can insist on a VIN-searchable parts database after the Scania judgment^[4][5]. Fault codes read through the port, as on our ADAS DTC codes page, are the starting point either way.
• A US owner outside Massachusetts and Maine has the OBD port, whatever the manufacturer’s app shows, and the consent and deletion rights the FTC has so far imposed on one company. In Massachusetts the open-access platform is law but still on appeal; in Maine the platform is due by 1 September 2027^[10][12].
• Under the EU Data Act, inferred or derived data are outside the mandatory access scope. A predicted service date or a modelled fuel range stays with the data holder; the raw signal behind it does not^[3].

Related TheFixCar guides

• OEM ADAS calibration requirements: the static, dynamic and scan-only procedures a shop still has to buy per brand
• ADAS DTC codes: what comes out of the OBD port and what to check first
• Check engine light flashing: the fault codes behind it and why a scan is step one
• Why your insurance and parts prices keep going up, including what insurers do with driving data
• Door opening warning systems: how the Euro NCAP 2026 protocol and China’s GB/T 44173-2024 test them
• EV won’t charge at home: the charging-status data the guidance lists is the same data your car reports

Sources

1. Council of the European Union, PE-CONS 49/23, Regulation on harmonised rules on fair access to and use of data (Data Act), text as adoptedArticle 2 definitions of connected product, user, data holder and readily available data; Articles 3(1), 4(1), 5(1), 5(3), 6(2)(e) and 9; Article 50 with the 20-month and 32-month application periods; the trade-secret recital. Accessed Sep 15, 2026.
2. European Commission, Data Act policy pageEntry into force on 11 January 2024 and application from 12 September 2025; the user’s right to access data and share it with third parties; cars named among connected devices. Accessed Sep 15, 2026.
3. European Commission, Guidance on vehicle data, accompanying the Data Act, C(2025) 6119 final, 12 September 2025Scope limited to the Data Act; connected-product assessment left to the OEM; raw, pre-processed and inferred data with the listed examples and the virtual fuel-sensor case; paragraph 20 on functions and resources; paragraph 42 on non-discrimination against independent shops; paragraph 44 on the OBD-II route; paragraph 46 on compensation. Accessed Sep 15, 2026.
4. Regulation (EU) 2018/858, current consolidated version of 2 August 2026, EUR-LexArticle 61(1) on unrestricted, standardised and non-discriminatory access to OBD information, tools, software and repair and maintenance information, remote diagnosis services and the secure remote facility; Article 91 on application from 1 September 2020; Annex X as amended. Accessed Sep 15, 2026.
5. Court of Justice of the European Union, press release No 168/23, judgment in Case C-319/22 Gesamtverband Autoteile-Handel v Scania, 9 November 2023Access to all repair and maintenance information in a format lending itself to direct electronic use, the VIN-searchable parts database, and the GDPR finding. Accessed Sep 15, 2026.
6. European Commission, COM(2025) 95 final, Industrial Action Plan for the European Automotive Sector, 5 March 2025The section on access to vehicle data, functions and resources: guidance at the start of application of the Data Act, and a legislative proposal on in-vehicle data to be considered after assessing the Data Act’s effects. Accessed Sep 15, 2026.
7. European Parliament, Legislative Train Schedule, Digital Omnibus packageTabled 19 November 2025; consolidation of data rules into a restructured Data Act; draft report of 22 June 2026, amendments deadline 15 July 2026, cancelled Council vote of 26 June 2026. Accessed Sep 15, 2026.
8. Massachusetts Secretary of the Commonwealth, Information for Voters 2020, Question 1 full textThe model year 2022 platform requirement, mechanical data, mobile-based application, owner authorization, the command clause and the standardized OBD authorization rule. Accessed Sep 15, 2026.
9. NHTSA, letter of 22 August 2023 to the Massachusetts Attorney General on the Data Access LawThe agency’s remote-command concern, the short-range wireless compliance path and the statement that it would not be preempted; copy hosted by the Auto Care Association. Accessed Sep 15, 2026.
10. Nelson Mullins, “Automotive Right to Repair Proceeds Cautiously While Awaiting First Circuit Decision”, 24 August 2026First Circuit argument in February 2026, the panel’s mediation suggestion, the Attorney General’s letter of 25 February 2026, and Auto Innovators’ 14 August 2026 notice in the Maine case. Accessed Sep 15, 2026.
11. Maine Revised Statutes, Title 29-A, section 1810, Right to repairStandardized OBD access, the independent entity, and the model year 2018 and later interface requirements citing SAE J2534, SAE J1939 and ISO 22900. Accessed Sep 15, 2026.
12. Maine Legislature, LD 2211 (SP 899), An Act Implementing the Recommendations of the Automotive Right to Repair Working GroupEnacted and signed 13 April 2026 as Public Law chapter 660; bill text creating the Motor Vehicle Right to Repair Commission and setting the 1 September 2027 platform deadline. Accessed Sep 15, 2026.
13. US Congress, H.R. 1566, REPAIR Act, 119th Congress, introduced textAccess to vehicle-generated data through interface ports and telematics, and the same-terms requirement for critical repair information and tools. Accessed Sep 15, 2026.
14. Auto Care Association, “REPAIR Act (H.R. 1566) Advances to Full Congressional Committee Consideration”, 10 February 2026The subcommittee vote forwarding the bill to the full House Energy and Commerce Committee. Accessed Sep 15, 2026.
15. Federal Trade Commission, “FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers’ Informed Consent”, 14 January 2026The January 2025 complaint, the five-year ban on disclosure to consumer reporting agencies, and the consent, copy, deletion, geolocation and opt-out requirements over the 20-year order. Accessed Sep 15, 2026.
16. CLEPA, “The Independent Service Providers urge the EU Commission to end the delay on access to in-vehicle data legislation”, 24 January 2023The ISP group’s letter and the December 2020 commitment to legislate by the end of 2021. Accessed Sep 15, 2026.
17. ACEA, “Access to in-vehicle data: latest developments”, 15 February 2023The manufacturers’ position that the Data Act makes sector-specific legislation unnecessary and the proposal should be postponed. Accessed Sep 15, 2026.
18. Commission Delegated Regulation (EU) 2026/699 of 23 March 2026 amending Regulation (EU) 2018/858 as regards the standardised access to vehicle OBD information and repair and maintenance information, and the requirements and procedures for secure access to OBD information, EUR-LexLegal basis in Article 61(11); the amended Annex X points on ADAS/DCAS calibration information, software updates and variant coding, traction-battery diagnosis and safe handling, information for generic diagnostic tool makers, the cybersecurity proportionality clause and Appendix 4; the recital on the Carglass judgment C-296/22; date of effect 23 June 2026. Accessed Sep 15, 2026.

Technically reviewed Sep 2026 by Jamie Kowalski, Vehicle Safety Editor. Primary references include the adopted Data Act text, Commission guidance and action-plan documents, EU type-approval legislation and its 2026 delegated amendment, a Court of Justice press release, state ballot and statute texts, a NHTSA letter, a congressional bill text and an FTC order.