Key Takeaways
- Since September 12, 2026, newly marketed connected products must make their data accessible to users by default (Article 3(1)); earlier devices rely on the access-on-request right in force since September 12, 2025
- The EU Data Act addresses data access/portability for connected devices — a different question from GDPR's personal-data-processing rules
- It's aimed at letting you direct your device's generated data to a third-party service, not just the manufacturer's own app
- Main obligations have applied since September 12, 2025; smart-home devices are explicitly named as in-scope "connected products" alongside connected cars and health monitors
- This article is a general orientation, not legal advice — for a specific compliance question, consult the EU's official Data Act resources or a qualified advisor
- See the GDPR-focused smart home guide already on this site for personal-data-processing questions
Data Act vs GDPR
GDPR governs how personal data is processed, stored, and protected; the Data Act governs access to and portability of the data a connected device generates — the two regulations address related but distinct questions.
- GDPR question: is my personal data (name, voice recordings, camera footage) being processed lawfully, and can I access/delete it?
- Data Act question: can I get the raw data my device generates (e.g., a thermostat's usage logs) and direct it to a different service, not just the manufacturer's own app?
- A device can be fully GDPR-compliant while still limiting data portability under the older rules the Data Act is meant to address — the two obligations are additive, not substitutes for each other.
What This Could Mean for Smart Home Data
For a local-first smart home owner, the practical relevance is mainly around devices that still rely on a manufacturer cloud service — Data Act-style portability rights could make it easier to redirect that data locally or to a third-party service instead.
- If you already run a local-first setup (Home Assistant, local storage, no cloud dependency), you may see less direct benefit since your data already stays local rather than needing a portability right to extract it from a manufacturer.
- The more relevant case is hybrid devices that still report some data to a manufacturer cloud service even in a mostly-local setup — portability rights are about that data specifically.
- The obligation has been legally in force since September 12, 2025, but this article does not track manufacturer-by-manufacturer compliance — check a specific device's current documentation rather than assuming broad industry-wide changes have already rolled out just because the deadline has passed.
What Changed on September 12, 2026
Since September 12, 2026, connected products newly placed on the EU market must be designed so their data is directly accessible to the user by default — easily, securely, free of charge and in a structured, machine-readable format, where relevant and technically feasible (Article 3(1)).
- This design obligation applies only to products and related services placed on the market after that date; devices already sold fall under the access-on-request rights that have applied since September 12, 2025.
- Sellers must also tell you before purchase what data the product generates and how to access it (Article 3(2)–(3)).
- Home Assistant: the Data Act does not require any manufacturer to ship a local API or a Home Assistant integration. It gives you a right to the data and to have it passed to a third party you choose. Whether a given brand offers a usable export is device-specific — check its documentation. Local-first setups built on open local protocols do not depend on this right.
- The Data Act changes proposed under the Digital Omnibus are still in the legislative process and are not law; this page will be updated once they are adopted.
What to Check Before Relying on This
This article is a general orientation to the Data Act's relevance to smart homes — for a specific compliance question or legal determination, check the EU's official current guidance rather than relying on this summary alone.
- Main obligations have applied since September 12, 2025 (per the European Commission's own Data Act pages) — this is already in force, not a future deadline. One related sub-deadline is still pending: full removal of cloud/data-processing-service switching charges by January 12, 2027.
- Smart-home devices are explicitly named as an in-scope "connected product" category by the European Commission's own guidance, alongside connected cars, health monitoring devices, and industrial equipment — check a specific device's own documentation for how its manufacturer has implemented the obligation, since the Commission's guidance confirms scope, not per-device compliance.
- If you're a manufacturer or run a business handling smart home data, this article is not a substitute for qualified legal advice specific to your situation.
Frequently Asked Questions
Is the EU Data Act the same as GDPR?
No — GDPR governs personal-data processing; the Data Act governs data access and portability for connected devices. They are separate regulations addressing different questions.
Does the Data Act apply outside the EU?
It is EU regulation, so its direct legal requirements target companies operating in or serving the EU market, not a global mandate. If you buy or use a connected device within the EU market, the obligation applies regardless of where the manufacturer is headquartered.
Does this mean I can force my smart thermostat manufacturer to share my data with a competitor?
Yes, in principle — since September 12, 2025, EU data holders must let users share device-generated data with a third party of their choosing (either directly or by asking the manufacturer to send it), with an exception for Digital Markets Act "gatekeeper" companies as recipients. Whether a specific manufacturer has actually implemented this smoothly for a specific device is a separate question from whether the legal right exists — check that device's current documentation.
Does a local-first smart home need to worry about the Data Act?
Less directly — if your setup already keeps data local via Home Assistant rather than a manufacturer cloud service, portability rights matter less since there's no cloud silo to extract data from in the first place.
Where can I find the official current text of the Data Act?
Check the European Union's official legislative publications directly — this article is a general orientation, not a legal reference.
Does this affect the private-smart-home-GDPR guide already on this site?
No — that guide covers GDPR compliance (personal data processing) specifically. This article covers a separate, newer regulation about data portability.
Does the EU Data Act work with Home Assistant?
The Data Act does not mention Home Assistant and does not require any manufacturer to support it. It gives you a right to your device's data and to have it shared with a third party you choose; whether that data arrives in a form Home Assistant can use depends on the manufacturer's implementation, so check the device documentation.
What changed on September 12, 2026?
Connected products placed on the EU market from that date must be designed so users can access the data they generate by default, where relevant and technically feasible (Article 3(1)). Products sold earlier fall under the access-on-request rights that have applied since September 12, 2025.