In short and in plain language
Connected means a device is linked to the internet. Connected devices in your home collect data. A thermostat measures the room's warmth. A robot vacuum records your floor plan.
The data is created in your home. But it is usually stored by the maker.
The article explains which new rules apply to this data. It also shows what you can do and where the limits are.
We come to your home and look at your devices. We ask the maker together with you. Then we explain what the data says.
A radiator thermostat measures room temperature, a robot vacuum records the floor plan of your flat, a connected television knows what runs when. These values are created in your home, but they are usually stored somewhere else: with the manufacturer, in their application, in their data centre. The European Data Act turns that relationship around. Anyone using a connected product has a right to the data it produces. The regulation has applied since 12 September 2025 (Bundesnetzagentur), and the part you will actually notice arrives a year later: from 12 September 2026, newly placed devices must be built so that you can reach your data without a detour (Regulation (EU) 2023/2854). This article explains what that means in the living room, which deadlines are genuinely binding, and where an expectation arises that the legal text does not in fact cover.
Key takeaways
- The Data Act entered into force on 11 January 2024 and has applied since 12 September 2025 (Bundesnetzagentur). The right of access has existed for a while.
- What is new from 12 September 2026 is the product design duty: devices placed on the market after that day are meant to provide direct access by themselves (Regulation (EU) 2023/2854).
- For devices already in your home the claim remains. It simply runs through the manufacturer rather than through the device itself.
- Access is free of charge, the data arrives machine-readable, and you may have it passed on to a third party of your choice - a repair business or an energy adviser, for example.
- Only data generated after 12 September 2025 has to be handed over (Bundesnetzagentur). Older measurement series stay out of scope.
Why 12 September 2026 is a particular date
Three dates appear in the text of the regulation, and reports mix them up regularly. The Data Act entered into force on 11 January 2024 (Bundesnetzagentur). It has applied since 12 September 2025 (Bundesnetzagentur) - since then the claim to the data exists in principle. And the duty to build a device so that access is possible without going through the manufacturer applies to products placed on the market after 12 September 2026 (Regulation (EU) 2023/2854). Autumn 2026 therefore does not shift the right itself, but the route to it: with new devices, access is meant to be built in rather than applied for.
„Placed on the market" is a legal term and does not mean the day you buy the device, but the moment it is first made available on the European market. A thermostat produced and shipped in the summer of 2026 therefore does not fall under the new design duty, even if it only ends up on your wall in the winter of 2027. For you that means: retail stock turns over slowly after the cut-off date, and built-in data access will be a property of future product generations rather than an update for the devices you own. If you are considering a new purchase anyway, it is worth looking at our smart home consulting first - we go through which devices you have and what information they already give you today.
The product design obligation applies to connected products and related services placed on the market after 12 September 2026, insofar as direct access is relevant and technically feasible.
No cut-off date for the devices you own
What data a connected device actually produces
The word data sounds abstract; in a household it is very concrete. A radiator thermostat knows room temperature, valve position and heating times. A robot vacuum knows the floor plan, the routes it drives and its operating hours. An electricity or water meter knows consumption curves in quarter-hour steps. A connected television knows switch-on times, volume and the applications you open. These values arise in your home and describe your daily life - which is exactly why the regulation put them at the centre. What it does not cover in the same way are the processed analyses a manufacturer builds from the raw values; those remain their product.
Measured values
Temperature, consumption, runtime, position: everything a sensor records and the device passes on. These raw values are the core of the right of access (Regulation (EU) 2023/2854).
Events and timestamps
When the light came on, when the smoke detector reported, when the cleaning run started. The picture of a household only emerges from the sequence in time.
What stays out of scope
Results a manufacturer only creates through its own analysis, and information touching trade secrets, are not covered by the claim in the same way.
There is a second limit, less well known than the September cut-off. The duty to hand data over covers only data generated or collected after the start of application on 12 September 2025 (Bundesnetzagentur). Anyone expecting a five-year consumption series in order to recheck an old heating bill will be disappointed. Anyone who needs the heat data of the coming heating season is on solid ground. In practice that means one thing above all: a request is worth making now, and if you need a longer series it is better to start early. How consumption data of this kind can be read at all is shown in our article on the intelligent electricity meter.
How much connected technology sits in German living rooms
The number of households affected can be quantified. According to the official equipment statistics, 67 % of private households had a smart TV in 2024, 23 % a smart speaker and 12 % connected security equipment such as an alarm system, smoke detector or surveillance camera (Federal Statistical Office). The technical precondition is present almost everywhere: 99 % of households had an internet connection in 2024, compared with 94 % in 2019 (Federal Statistical Office). The connected home is no longer a niche but the normal case - and each of those devices produces values that now have an addressee.
| Device group | Germany | European Union |
|---|---|---|
| At least one connected device | 48 % of people aged 16 and over (Bitkom) | 70 % of those aged 16 to 74 (Eurostat) |
| Connected television | 67 % of households, survey year 2024 (Federal Statistical Office) | 58 % of those aged 16 to 74 (Eurostat) |
| Connected security equipment | 12 % of households (Federal Statistical Office) | 12 % of those aged 16 to 74 (Eurostat) |
| Heat and energy in the home | 35 % use smart radiator thermostats (Bitkom) | 14 % use connected energy management (Eurostat) |
The view across the border points the same way. In the EU, 70 % of those aged 16 to 74 used at least one connected device in 2024 (Eurostat), most often the connected television at 58 % (Eurostat). The spread between countries is striking: from 95 % in the Netherlands to 46 % in Poland (Eurostat). So is the age gap: 84 % of those aged 16 to 24 use such a device, against 45 % of those aged 65 to 74 (Eurostat). In that second group much depends on whether an answer arrives in an understandable form - which is why the topic belongs in the conversation in our tech help for seniors. Incidentally, among people who use no connected device, privacy concerns are not the main reason: only 8 % name them, far less often than a simple lack of need (Eurostat).
The four deadlines that matter
Anyone following the debate around the Data Act trips over a whole series of dates. Four of them genuinely matter for a household, and they do not all sit in the same chapter of the regulation. Two concern the data from the device, two concern switching the service the device depends on. The order matters, because the later deadline does not replace the earlier one.
- 12 September 2025: the Data Act starts to apply. From here on the data your devices produce counts - older values are not covered by the duty to hand data over (Bundesnetzagentur).
- 12 September 2026: the product design duty takes effect. Connected products and related services placed on the market after that day are meant to provide direct access, insofar as it is relevant and technically feasible (Regulation (EU) 2023/2854).
- 12 January 2027: providers of data processing services may no longer charge switching fees for carrying out a change of provider (Regulation (EU) 2023/2854). That concerns the cloud where many smart home applications keep their data.
- 12 September 2027: for open-ended legacy contracts concluded on or before 12 September 2025, the switching rules only apply from that day (Regulation (EU) 2023/2854).
One uncomfortable but useful insight follows from this list: the date in the headlines is rarely the date that helps you. For everyday life at home, 12 September 2025 is the more important marker, because that is when your claim came into being. September 2026 makes it more convenient, and January 2027 makes moving between services cheaper. If the basics of connected devices still feel unfamiliar, our piece on the Matter standard provides the technical underpinning: only once devices speak a common language does a data export across manufacturer boundaries become practical.
What you can ask for and in what form
The claim is not phrased in the regulation as a vague declaration of intent but with four properties against which an answer can be measured. Anyone filing a request should know these four points, because in a dispute they make the difference between an actual disclosure and a friendly letter. A written request works best, with a date, the device designation, the serial number and the period you want - and a note on the format in which you expect the data.
- Free of charge: no fee may be charged for access to the data from your own device (Regulation (EU) 2023/2854).
- Machine-readable: a file a program can process - a table or a structured data set, not a screenshot and not a printed list.
- Continuously and in real time where relevant and technically feasible: for devices whose value lies in ongoing operation, a single snapshot is not what the regulation envisages.
- Passing on to third parties: at your request the data goes to a person or company of your choice, who may use it only for the agreed purpose.
- Complete enough for the purpose: the disclosure includes what is needed to understand the values - the unit, the time reference and the meaning of the fields.
The most common misunderstanding
Bringing in a third party: trades, repair shops, energy advice
The part of the regulation likely to change the most in a household is the passing on of data to third parties. You can require that your device data goes not only to you but to a party who can do something with it. That is not a marginal case: a quarter (25 percent) of smart home users brought in professional support from a service or trade business for the installation (Bitkom 2023). Anyone who hands over the installation will not want to take on the analysis either. That is exactly what the channel is for - and it is tied to your request, not to a general release.
In practice that means, for example: your heating company receives the temperature and valve data of the past heating season and sees which room is systematically overheated. An energy adviser receives the consumption curve and works out whether a change pays off. Neither needs access to your account or a password - they receive a bounded data stream for a bounded purpose. That compatibility is the sticking point is something users say themselves: for 75 percent, compatibility with other smart home products decides the purchase (Bitkom 2023), and 87 percent look at data security and privacy (Bitkom 2023). What that means for heating specifically is set out on our page on smart heating.
Switching the service: deadlines, fees, legacy contracts
The second large block of the regulation concerns not the device but the service behind it. Almost every smart home application stores its data in a cloud, and that is precisely where the dependency arises: anyone wanting to switch has so far often lost the history or paid for the move. The Data Act sets fixed deadlines against this and phases the fees out. For private households that matters indirectly, because many applications in the home rest on such services and because a change of provider becomes plannable. If you want to secure your data locally first, the approach is described on our page on data backup.
| Rule on changing provider | Measure | Reference |
|---|---|---|
| Binding transitional period for the move | no more than 30 calendar days | Article 25(2) (Regulation (EU) 2023/2854) |
| Notice period for initiating the switch | no more than two months | Article 25(2) (Regulation (EU) 2023/2854) |
| Alternative period if 30 days are not technically feasible | no more than seven months, with reasons within 14 working days | Article 25(4) (Regulation (EU) 2023/2854) |
| Period for retrieving data after the transition | at least 30 calendar days | Article 25(2) (Regulation (EU) 2023/2854) |
| Switching charges | not permitted from 12 January 2027 | Article 29 (Regulation (EU) 2023/2854) |
Two details are worth keeping in mind. First: the seven months are not the standard case but an exception the provider must justify within 14 working days of the request (Regulation (EU) 2023/2854). Naming a long period without a word of explanation does not follow the rule. Second: after the transition you retain a minimum retrieval period of 30 calendar days at the old provider (Regulation (EU) 2023/2854) - and that period only starts once the agreed transitional period has expired. For open-ended contracts concluded on or before 12 September 2025, the chapter applies only from 12 September 2027 in any case (Regulation (EU) 2023/2854). If you are touching the home network during the switch, the right order is described in our piece on securing the home network.
When a manufacturer does not play along
A right is worth what its enforcement is worth. The competent authority in Germany is the Bundesnetzagentur; the German implementing act, the Data Regulation Application and Enforcement Act, sets out the powers and the fine framework. For a household these figures are less useful as a threat than as an indication: they show that the legislator treats the access duty as a serious obligation and not as a recommendation. The first step nevertheless remains a written request to the manufacturer with a date and a reasonable deadline.
- For breaches of the access duty the implementing act provides for a fine of up to 500 000 euros - section 15 paragraph 2 number 2 in conjunction with paragraph 4 (Federal Law Gazette).
- The higher range of up to five million euros, and for legal entities with a total turnover of more than 250 million euros up to 2 percent of total turnover, applies solely to a different breach: an undertaking designated as a gatekeeper soliciting users or commercially incentivising them to hand the data over to it (Federal Law Gazette).
- If a company fails to implement an order, a penalty payment of up to 500 000 euros can be imposed (Federal Law Gazette).
- No costs arise for you: access to your own device data is free of charge (Regulation (EU) 2023/2854).
What the Data Act does not cover: security and updates
Access to data is one thing, the security of the device another. There is a second regulation for that, the Cyber Resilience Act, and it answers the question usually asked first in the living room: how long will my device still receive security updates? The two frameworks interlock but have their own deadlines - and the difference is worth understanding, because it explains why a device has to hand over data and yet may end up without updates. If you want to know when a repair beats a new purchase, the legal side is covered in our article on the right to repair.
Updates over years
The support period for products with digital elements is at least five years (Regulation (EU) 2024/2847). That is a floor, not a ceiling.
Applying from late 2027
The regulation applies from 11 December 2027 (Regulation (EU) 2024/2847). The reporting duty for actively exploited vulnerabilities already takes effect on 11 September 2026 (Regulation (EU) 2024/2847).
Reporting within hours
An actively exploited vulnerability must be reported as an early warning within 24 hours (Regulation (EU) 2024/2847), with a final report no later than 14 days after a corrective measure becomes available (Regulation (EU) 2024/2847).
For a household a simple purchasing rule follows: ask about the support period before buying and have the figure shown to you rather than assuming it. A device that stops receiving updates after three years is a problem on your network regardless of any right of data access. And a second point belongs here: voice-controlled devices collect a particularly large amount, because they have to listen in order to react. How to configure that sensibly is covered in our article on voice assistants in everyday life.
Your roadmap to autumn 2026
From all of this a sequence can be derived that works without legal training. It costs perhaps two hours of an afternoon and is then done for years. The first step matters most, because without a list of the connected devices in the house every request stays vague.
- Draw up an inventory: device, manufacturer, model designation, year of purchase, associated application. A sheet of paper will do; if you would rather keep the list digitally, the right filing structure is described in our piece on digital paperwork.
- For each device note which values it produces and where they are held - on the device, in the manufacturer's application or in a cloud. The manual usually answers this in an inconspicuous place.
- For the two or three devices whose data you genuinely need, request access in writing: date, device, serial number, period, desired format, reasonable deadline.
- Open the delivered file and check whether the unit, the time reference and the meaning of the fields are recognisable. If they are missing, the disclosure is incomplete and a follow-up question is justified.
- Before every new purchase ask two questions: how long will there be security updates, and how do I reach the data? What consulting and installation cost with us is stated openly on the pricing page; the installation itself is described under smart home setup.
The Data Act will not turn your home into an open data source overnight, and it does not take away your decision about which devices to connect at all. What it does shift is the starting position: a polite request for information becomes a claim with a deadline, a form and an addressee. Anyone who knows their own equipment and what values sit inside it can use that claim right away - without waiting until autumn 2026. How lower bills eventually follow from such data is shown in our article on heating and electricity in the smart home.
Sources and studies
Related Articles
The digital wallet: your ID moves to your phone
From 24 December 2026 every EU state has to provide a digital wallet. What applies today, what becomes mandatory and what is only announced.
Secure Your Home Router: Safer Home Network in 2026
Secure your router and smart-home devices against outside access: WPA3, a guest network for IoT, firmware updates and strong passwords - explained step by step.
Video Doorbell: Guide to Choice and Setup
Choose and set up a video doorbell correctly: what matters for image quality, data privacy and neighbor law, and why on-site mounting makes the difference.