Give users the data from connected products

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

Chapter II of the Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025. A connected product collects data about its use and can send it, such as a smart meter or a fitness tracker. A related service is the software a product needs, or software that adds functions to it later. Article 4 asks for readily available data and its metadata on a simple electronic request, free and machine-readable. Products placed on the market after 12 September 2026 must give that access by design, under Article 3(1). Articles 3(2) and 3(3) list the facts due before a contract, such as data types, volume, storage place and retention. Data from products made by micro and small enterprises is excluded, under Article 7. Article 4(4) bans interfaces that make these choices hard. Build the access on the self-service export.

Examples

YAML example

connected_products:
  - model: thermostat-t2
    placed_on_market: 2026-11-02
    data_types: [temperature, setpoint, heating_minutes]
    continuous: true
    storage: remote, retained 24 months
    access: https://example.com/account/device-data
    pre_contract_page: https://example.com/thermostat-t2/data

JavaScript example

export const missingDataTypes = (product, exportedRecords) => {
  const exported = new Set(exportedRecords.map(record => record.type));
  return product.data_types.filter(type => !exported.has(type));
};

Python example

def missing_data_types(product: dict, exported_records: list[dict]) -> list[str]:
    exported = {record["type"] for record in exported_records}
    return [t for t in product["data_types"] if t not in exported]

How to check

An end-to-end test requests a test device's data and gets every listed data type as JSON or CSV, at no charge. Every product model has a published pre-contract page with data types, continuous generation, storage place and access method.

Sources

• Data Act Articles 3, 4, 7 and 50

Related rules

• ACC-55 Let people export their data themselves in Accounts and identity
• IOT-31 List every sensor and every field that leaves the device in Connected devices
• IOT-44 Let owners read their device's data directly in Connected devices