An 84-page research paper from the Max Planck Institute for Innovation and Competition, shared today on LinkedIn by privacy lawyer Rosalia Anna D'Agostino, argues that the European Union's Data Act gives connected-device makers protection resembling intellectual property while leaving the third parties it was meant to help without any access claim of their own. The author, emeritus professor Hanns Ullrich, concludes that the regime "systematically impairs the emergence of liquid and effective markets" for the data that smart products generate.

In Short

A law professor read the EU's rules on who gets to use the data produced by smart devices, such as connected cars or fitness machines, and concluded that the rules work against their own goal of getting that data shared more widely. The rules give device makers strong control and shield them from competition, while the companies that might want to build new services on the data can only get it if the device owner asks for it and the maker agrees on terms. If you work with data from connected products, the paper suggests the law may produce more data silos, not fewer, and it proposes a lighter regime that only steps in when a maker refuses access.

The paper and where it comes from

The document is Max Planck Institute for Innovation and Competition Research Paper No. 26-12, titled "Mandatory Access to IoT Data under the EU Data Act - A Regime in Conflict with its Purpose." Its author, Hanns Ullrich, is listed as Prof. (em.) Dr. iur., Dr. h.c., MCJ (NYU), and honorary professor at the College of Europe in Bruges, Belgium. The paper carries no explicit publication date on its pages. The most recent source it cites is a Commission technology transfer block exemption regulation dated April 16, 2026 and published in the Official Journal on April 21, 2026, which places its completion after that point. It reached a wider audience on October 15, 2026, when D'Agostino posted it.

Ullrich presents the work as a follow-up to an earlier Max Planck paper, No. 24-15, on the Data Act's rules on access to and use of data. The institute had also published a position statement on the Commission's original proposal on May 25, 2022, three months after the proposal of February 23, 2022.

The regulation under examination is Regulation (EU) 2023/2854 of December 13, 2023, on harmonised rules on fair access to and use of data. According to the paper, it has applied generally since September 12, 2025, with some rules entering into application on a graduated basis. Ullrich deliberately leaves aside several chapters: public-sector access in emergencies (Chapter V, Articles 14 to 22), international governmental access (Chapter VII, Article 32), and the cloud switching rules in Chapter VI, Articles 23 to 29. The paper focuses on what it calls "the regime of reference": mandatory access by users to data from connected products and related services.

That narrowing matters. PPC Land has covered the Data Act's broader architecture, including the September 12, 2025 applicability date and the cloud switching fee phase-out, and Germany's designation of the Bundesnetzagentur as its national enforcer. Ullrich's paper does not catalogue obligations. It questions whether the core mechanism can deliver what the legislature promised.

A triangle with distributed roles

The Data Act, according to the paper, sets up two fundamentally different regimes. One provides mandatory access to particular categories of private-sector data, chiefly data on the "performance, use and environment of connected products and related services." The other governs voluntary data sharing between businesses and does little beyond policing unfair contract terms through Article 13.

The mandatory regime rests on three base lines. First, unless a product lets users reach their data directly, the user holds a non-waivable claim against the data holder to obtain "readily available data" easily, securely and free of charge, in a "comprehensive, structured, commonly used and machine-readable format." Second, the data holder - normally, but not necessarily, the manufacturer - may itself use that data only if the user agrees by contract under Article 4(13). Third, only the user can claim access. Third parties have "no access claims, not against the data holder and not against the user."

A third party that wants the data must therefore persuade the user to request it from the data holder, and then negotiate its own agreement with the data holder. Ullrich calls this "a triangular relationship with distributed roles, where the user and the data holder are placed in mutually dependent positions, and where third parties, potential competitors of the data holder, are caught in between the user's and the data holder's positions."

What the regulation does not do, the paper argues, is decide who owns anything. "Instead of introducing some form of a data-specific property regime, the legislature systematically relies on contract as the basis for allocating control over the use of such data," the abstract states. The paper traces this choice to a sentence in the Commission's 2022 proposal, which said the text "takes as its starting point the control that the data holder effectively enjoys, de facto or de jure." That sentence was deleted from the final text, but Ullrich says it is "still telling enough." In his reading, it means "legalizing the acquisition and exploitation of any non-personal data by simply taking and exercising control over them."

Non-compete rules: exclusivity in all but name

The most concrete criticism concerns two non-compete provisions. Article 4(10) bars the user from using its own product data to develop a connected product that competes with the one that generated the data. Article 6(2)(e) imposes the same restriction on third parties that receive data at the user's request.

On paper the two rules are identical. Their economic reach is not. A single user typically holds data from one product. A third party, by contrast, "most probably will obtain access to the data of a large number of the connected products and services that a large number of users generate." According to Ullrich, "it is the truly effective potential competitors of the data holder that Art. 6(2), lit. e) Data Act excludes from the data holder's market."

The paper compares the outcome to patent protection. "In short, by both the range and the nature of the data at issue and by its personal reach the non-compete rule for third parties virtually has an exclusionary effect that is similar to the exclusivity resulting from intellectual property rights, such as patents." Breaches of the third-party rule are also met with remedies modelled on intellectual property enforcement under Article 11(2).

The asymmetry runs in one direction. The data holder can call on "a broad spectrum of rigorous remedies of tort law" if the user does not respect its technical protection measures, under Article 11(4). The Act provides no equivalent remedy "in case the data holder uses the data without or outside the limits of the user's consent." In the conclusion, Ullrich writes that the non-compete rules "asymmetrically favor the data holder mainly to the disadvantage of third parties."

Head start on the aftermarket

Opening aftermarkets for repair, maintenance and complementary services is one of the Data Act's stated aims. The paper argues the access mechanism tilts that competition toward the manufacturer from the moment of sale.

A footnote borrows a hypothetical from other commentators to illustrate the point. When selling a car, the manufacturer can already obtain the buyer's consent to connect warning signals to automatic information about the manufacturer's own repair offer. A rival repair shop "may come in with a competitive offer only once the user takes the initiative to seek and ask for such offer," and can only calculate its costs after negotiating a making-available agreement with the manufacturer under Articles 8 and 9.

Those agreements must be on FRAND terms under Article 8(1), and the compensation the data holder may charge is regulated in Article 9. Ullrich notes that Articles 8(1), 8(2) and 9(1) appear to set different benchmarks: fair terms, the absence of unfair terms, and compensation that is non-discriminatory and reasonable. "The issue needs further inquiry," the paper states. Even so, "the mere existence of these conditions and their loose criteria are enough to enable the data holder to keep the third party at a distance."

Small companies receive a cap. Under Article 9(4), an SME that is a third party pays only the costs of making the data available, without a margin. The paper argues this rule rests "on grounds of industrial policy rather than on grounds of rebalancing the parties unequal bargaining positions," as the recitals claim. In January 2026, the Commission published draft guidelines on reasonable compensation under Article 9, according to the paper, which warns that the criterion of investment in producing the data "almost invites too extensive an interpretation."

The paper also points out a practical gap in the Commission's support material. Its recommendation on non-binding model contractual terms, C(2025) 7750, was published on November 19, 2025, "and only in English; there is no translation in the other EU languages." The annexes focus on business-to-business contracts. As a result, Ullrich writes, "the recommendations miss the objective of facilitating access to repair and maintenance markets for consumers."

Free of charge, on paper

Article 4(1) requires the data holder to give users access free of charge. Ullrich calls that "a legislative misrepresentation." The anticipated cost of providing access "most likely form part of the data holder/manufacturer's calculation of the price of the connected product." He proposes that, for the sake of price transparency, at least industrial users should be able to choose between a product price that includes access and a separate charge when they request data.

The "readily available data" limitation is another constraint. The regulation defines such data as data a holder can obtain "without disproportionate effort going beyond a simple operation." The paper notes that the German-language version of that definition is misleading, and that the practical importance of the limitation "may be considerable." Where a user needs data for repair or maintenance that is not readily available, the limitation "may even run counter to the Data Act's main objective."

At the centre of the regime sits what the paper calls the user's "privilege of consent": the right to allow or refuse any use of product data by the data holder or a third party. The abstract describes it as "an unrestricted statutory privilege to contractually consent or not to consent," enforceable "only inter partes."

Ullrich questions both its justification and its effect. The recitals justify user access on the grounds that "the data represent the digitization of user actions and events." The paper counters that saying the user "generates" the data "is a euphemistic term for at best a simple causal effect," which may justify an access right but "is not a sufficient ground to additionally grant it the power to control their use."

The practical problem is scale. "End-consumers of mass products will hardly be particularly active and sophisticated traders of or consenters to the use by other market actors of the product data they generate," the paper states. A single consumer typically controls raw or preprocessed data whose value is limited and hard to judge, and "it mostly is the aggregated data of large or at least of statistically relevant numbers of connected products that matter for trade in data."

Industrial users are not much better placed, according to the analysis. Those with their own interest in exploiting the data are likely to be "as reluctant to share the data with other market actors as the data holders are presumed to be." Those without such interest find themselves "in the uncomfortable position of an arbiter of the possibly conflicting business interests of the data holder and third parties."

The predicted outcome is not a liquid market. Manufacturers will usually secure broad consent at the point of sale. Third parties, knowing users have limited interest, are "unlikely to enter into a consent agreement with the user on a true quid pro quo basis" and more likely to ask for consent "as being necessary for supplying it an adequate product or service or for granting it an allegedly special rebate." Ullrich warns this "is just as likely to serve primarily the interests of some particular third parties in building data silos of their own rather than benefit users."

The paper also challenges the Commission's November 2025 model terms on one point. Annex II reads into Article 7(2) a distinction between business users and consumers, under which business users - including SMEs - could accept limits on their rights in exchange for compensation. Ullrich argues "there are no criteria for determining what constitutes the non-negotiable core" and that the approach "blurs the lines between mandatory access and voluntary data sharing."

What would the consent requirement be for, then? The paper's answer is defensive. It should be understood "as a statutory guarantee of user freedom," protecting users against exploitation, not as "some sort of a minor property right in disguise." On that reading, a refusal to consent where no legitimate user interest is at stake, possibly including research use or a manufacturer's work to improve the product, could amount to misuse.

Trade secrets: protected less than personal data

The paper identifies an asymmetry between two categories of protected information. Article 4(6) obliges the data holder to give users access to its trade secrets irrespective of need, and Article 5(9) can require disclosure to third parties the data holder did not choose, subject to confidentiality measures. Personal data, by contrast, receive priority under Articles 1(5), 4(12) and 5(7), which refer data holders to the detailed rules of the GDPR.

Ullrich does not object to treating personal data and trade secrets differently. His objection is that the Data Act "provides for a rule of priority for protecting the personal data as a matter of personality rights," but "ignores trade secrets as a matter of protecting entrepreneurial identity and integrity." A general access rule with "rather narrow exceptions," instead of a weighing of interests, "is likely to be counterproductive."

The analysis goes further on what the trade secret rules actually protect. Counter-intuitively, it is not only data the manufacturer generated during development or testing, but "the very product data that the user generates when using the connected product." Typical examples are data that reveal "the manner of manufacture of the connected product, its operational loading capacity or power capacity and their breaking points, the optimal and/or maximal running temperature." The consequence: users must respect the confidentiality even of data they themselves generated. For data holders, the paper concludes, the regime "renders trade secret protection more costly and less secure," while for users "actual access becomes more expensive and less effective."

This is a moving target. The Commission's Digital Omnibus proposal of November 19, 2025, COM(2025) 837, would amend the narrow exceptions in Articles 4(8) and 5(11), the paper notes, though it does not analyse those changes. The Council's negotiating mandate has since gone further: PPC Land reported that the October 2 text strengthens a "handbrake" on trade secrets under Articles 4(6) and 5(9) and lowers the risk threshold in Articles 4(8) and 5(11). If that text survives trilogue, some of the asymmetry Ullrich describes would shift in the data holder's favour.

Personal data: where the regime may stall

For advertisers and data businesses, the section on personal data is probably the most consequential. Connected products rarely generate purely non-personal data. The paper lists examples: staff working with a firm's industrial machinery, visitors to a video-surveilled site, a supplier delivering food into a connected refrigerator, a learner driving a driving school's connected car, clients of a fitness centre using connected equipment.

Article 1(5) of the Data Act states that the regulation is without prejudice to data protection law, and that in a conflict, data protection law "shall prevail." Access and sharing of personal data then need a legal basis under the GDPR. Ullrich walks through each one and finds them narrow. Contractual necessity under Article 6(1)(b) applies only where processing is "objectively indispensable," citing the Court of Justice's July 4, 2023 judgment in Meta Platforms v Bundeskartellamt (C-252/21). Legitimate interest under Article 6(1)(f) has been read by the Court as requiring that the interest "cannot reasonably be achieved just as effectively by other means less restrictive," a standard the paper says treats a private controller "as if the data controller were a public authority."

Consent therefore becomes the practical route, as the legal literature suggests. But consent can be withdrawn at any time, must be specific to purposes that may be unknown before a product is used, and is presumed invalid where there is "a clear imbalance" between the parties. The result, according to the paper, is that the user's market freedom over non-personal data "becomes dependent on the awareness of data subjects regarding their personality rights in data and the way they exercise these rights."

The identification problem compounds this. The Court of Justice's case law on identifiability, from Breyer (2016) to EDPS v SRB (September 4, 2025), requires controllers to investigate whether data relate to identifiable people. Ullrich argues that in the IoT context this duty should fall primarily on the user, not the manufacturer, because the user "is equally well if not better placed to identify the persons that, due to its use of the product, may become data subjects." He adds that "respecting the protection of personal data primarily ought to be the user's responsibility, with the data holder/manufacturer being held only to a (subsidiary) co-responsibility."

That position sits in tension with how European regulators have been approaching connected devices. Two days before D'Agostino's post, the European Data Protection Board said smart glasses makers "should not rely on the users' actions to meet their own GDPR obligations". The two documents address different questions - the EDPB statement concerns makers' own processing, while Ullrich addresses data holders asked to hand data to users - but they point in opposite directions on who should carry the burden for bystanders' data.

The paper also notes that the Digital Omnibus proposal aims to consolidate the definition of personal data in Article 4(1) GDPR but "in the legislative process has become controversial." That controversy was visible in February, when the EDPB and the European Data Protection Supervisor said the change would "significantly narrow the concept of personal data". Any change to that definition through the Omnibus would directly alter how much connected-product data falls under the GDPR override.

Ullrich's conclusion on this section is stark. Whenever an economically meaningful exercise of the user's consent over non-personal data requires the consent of all data subjects, "the Data Act's consent requirement mutates into a privilege of a few users." Only "the bigger industrial users" will be able to manage it, through "a complex digital system of managing the data subjects' consent."

Data outside the IoT regime

The paper's critique extends beyond connected products. Because the Data Act protects a data holder's technical protection measures only for data subject to mandatory access, it creates "a split system." For all other data, the holder relies on de facto control without legal protection against circumvention, and without any access rights for others.

This, according to Ullrich, "is likely to produce the perverse effect of the holder of such data being led to reinforce its de facto control as much as possible and/or to limit data sharing to, if any, clearly trustworthy partners." Under an intellectual property regime, market actors would at least benefit from "permitted uses." By contrast, "however counterintuitive, de facto control is a rigid form of absolute 'protection'." Unless lawmakers act, "only the happy few will have access to the data that the data holder selects for voluntary data sharing."

The paper cites survey data to frame the scale of the problem. According to figures it attributes to Eger and Scheufen, 42% of German firms participate in some data sharing, with medium-sized and large enterprises at 52% and 58% respectively in 2023. Legal obstacles appear far more important than economic, organisational or technical ones: up to 80% compared with around 39%. Among legal obstacles, a 2022 Fraunhofer ISST study cited in the paper found personal data protection mattered most at 87.8%, followed by risks of unlawful data capture by third parties at 77.2%, liability risks at 74.1%, uncertainty about the right to use data at 62.6%, and uncertainty about contract terms at 52.1%. A separate 2021 study by the Institut der Deutschen Wirtschaft found 77% of firms saw uncertainty about the use potential of data as an obstacle, and 63% cited uncertainty about pricing. Firms generally share "only a small part (often less than 20%)" of the data they generate or hold, according to a 2018 study for the European Commission.

What the paper proposes

Ullrich does not call for repeal. "The Data Act is here with us and substantial reform not in sight," the conclusion acknowledges. His proposals are framed as directions for interpretation and future research.

The central one is structural. "The mandatory character of the access regime is unnecessarily strict," the paper argues. It should be "transformed into one of default properly speaking," applying only where a data holder expressly or implicitly refuses users access, and combined with incentives for voluntarily granting access. As things stand, a user has unconditional access and an absolute consent privilege "regardless of whether or not the data holder/manufacturer voluntarily grants open access at reasonable conditions."

The paper also suggests that both the data holder's control and the user's consent privilege should be subject to exceptions specific to the IoT context, applying by law as they do in intellectual property, for instance for research use. Competition law cannot fill that gap, it argues, because it "comes in only ex post once legal dependency has mutated into actual market power."

More provocatively, Ullrich argues that the legislature dismissed intellectual property too quickly. The prevailing argument was that data are not scarce, so no exclusive rights are needed. He accepts that as a general proposition but says it misses the point. As an example, he floats a "purpose-bound right" that would take effect only once a data holder agrees to share data by contract, covering only the data and purpose specified, and giving the contractual limits effect against third parties who obtain the data without authorisation. He describes it as an "off-hand concept" worth testing.

On timing, the paper is sceptical that welfare effects can be measured quickly. Article 49(1) sets a first Commission evaluation after three years. According to Ullrich, gains or losses cannot be assessed reliably "before a reasonably long period of practical application and experience has elapsed, and certainly not already at the end of the three years period."

The final paragraph addresses the larger stakes: "In these times of data greed, it needs to be recalled that data allow parties to de facto appropriate common knowledge by encapsulating it into a machine-processable form that makes it inaccessible to all people that do not have access to the privately owned machine."

The LinkedIn post that circulated it

D'Agostino, who describes herself on LinkedIn as a "Privacy and Digital Law Expert" and host of the Legal4Tech podcast, shared the PDF with a short summary. Her profile lists Munich as her location and 13,881 followers. According to the post, the Data Act "entered into force in early 2024 and became directly applicable within the EU27 member states starting September 2025." That matches the paper's date of application. PPC Land's December 2025 coverage used December 22, 2023 as the in-force date, which is the date the regulation was published in the Official Journal; its formal entry into force followed in January 2024.

Her summary frames the problem from the data holder's side: "on the one hand, data holders ought to make the data collected available to any user and/or third-party requesting access, given the user's consent; on the other, this sharing of information is to happen within the boundaries set by data protection and trade secret protection law." She adds that the obligation to share "can lend an advantage to one of the data holder's competitors."

"Navigating the Data Act represents a challenge for all IoT device manufacturers and IoT-embedded software providers," D'Agostino wrote. "This paper published by the Max Planck Innovation and Competition Research is a good place to start." Her post tagged Joost Gerritsen and Enrico Glerean, noting it "seems like a life ago" that the Data Act was discussed on her podcast.

Her reading and Ullrich's diverge in emphasis. The post presents the data holder as the party under pressure from access and sharing obligations. The paper agrees the data holder carries burdens but concludes the overall structure favours it, through recognised de facto control, protected technical measures, the head start on consent and the non-compete rules.

Why this matters for marketers and ad tech

For most of the advertising industry, the Data Act has registered as a cloud-contract and connected-device compliance issue. Ullrich's paper suggests a different lens: the regulation determines who can build businesses on data from cars, appliances, fitness equipment and industrial machinery, and on what terms.

Several of the paper's points have direct commercial relevance. Manufacturers that plan products to generate secondary data - the paper's examples include traffic, weather and accident data - "may wish to offer these data to other industries that are interested in their commercial exploitation, for instance broadcasters or insurance companies." This is one reason manufacturers condition sales on broad ex-ante consent. Under the Act, that consent route is open to the manufacturer at the point of sale but available to independent data businesses only later, at the user's initiative, and on terms negotiated with the manufacturer.

The gatekeeper exclusion adds another layer. The paper notes the Act categorically cuts off users from any demand for data by designated gatekeepers "regardless of the market position of the user, the nature of the data or the purpose of the use asked for," under Articles 5(3) and 6(2)(d). PPC Land's earlier coverage listed Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft among the excluded companies.

The September 12, 2026 deadline for designing products with direct user access has already passed. PPC Land noted this week that when Apple's Home Collection products are built so neither manufacturer nor platform can read the data, the design sits awkwardly with these sharing rules. Ullrich's work explains why that tension exists: the regulation assumes data flows through a holder that can be compelled to share.

The analysis of GDPR's role also echoes regulators' own findings on how difficult the alternatives to consent are in practice. An EDPB-commissioned case digest found that most controllers in a set of 62 One-Stop-Shop decisions failed at the balancing stage of the legitimate interest test. Ullrich's paper argues the same narrow reading leaves IoT data sharing hostage to individual consent.

Timeline

Summary

Who: Hanns Ullrich, emeritus professor and honorary professor at the College of Europe, writing for the Max Planck Institute for Innovation and Competition. Rosalia Anna D'Agostino, a Munich-based privacy and digital law specialist, circulated the paper on LinkedIn.

What: An 84-page research paper, No. 26-12, argues that the EU Data Act's mandatory access regime for IoT data conflicts with its own purpose. It finds that non-compete rules give manufacturers patent-like exclusivity against third parties, that third parties have no independent access claim, that the user's consent privilege is too broad for most users to exercise, that trade secrets get less respect than personal data, and that the GDPR override can reduce the consent mechanism to a privilege of a few large users.

When: The paper cites sources up to April 21, 2026 and carries no explicit publication date. D'Agostino shared it on October 15, 2026, about a year after the Data Act became generally applicable on September 12, 2025.

Where: The European Union, covering all sectors using connected products and related services. The Data Act is Regulation (EU) 2023/2854.

Why: The Data Act aims to create "liquid, fair and efficient markets" for non-personal data. Ullrich argues it does so by assigning functional roles instead of tradable rights, which entrenches dependencies and risks producing new data silos. For marketers and data businesses, the paper explains why access to connected-product data may remain concentrated with manufacturers, and why the GDPR and the ongoing Digital Omnibus negotiations will shape how much of that data can move at all.