The EU Data act is coming

The EU is set to unleash a transformative regulation on 12 September 2025: the EU Data Act — an ambitious effort to unlock data, stimulate innovation, and give users more control over connected products and related services. 

The reasoning behind the EU Data Act hinges on innovation and interoperability. By introducing and implementing a regulation designed to harmonize the access to and use of data within the EU, the Union aims to create a single data market, reduce lock-in, and elevate Europe’s global digital footprint. 

Why is data sharing important to European digital innovation goals? Data is valuable, but according to European Commission estimates, about 80% of European industrial data goes unused. By opening the door to fair data access and use, it becomes possible to exploit the economic value of this data to the tune of up to an additional 270 billion EUR in GDP by 2028. 

The EU Act: Driving competition and innovation 

The EU Data Act, through its data sharing mandates, holds potential for benefiting both consumers and businesses.  

For consumers, the Data Act prevents contractual and technical lock-ins that stop users from switching service providers. This means that businesses, such as manufacturers of connected devices, cloud service providers, and other IoT-related companies that collect or use data generated by IoT products like EVs and wearables, will be affected and have to unlock their previously locked-up data and start sharing. This will improve choice and competition for consumers. They will need to adopt new data governance strategies and contractual frameworks to meet these new requirements.  

But businesses across industries also benefit, as they gain increased access to data generated by their connected products and services (even if they don’t own the product), which can lead to opportunities to develop new services and business models. The openness of access to data can disrupt markets and help businesses compete on a more level playing field, which may be especially valuable for small and medium-sized businesses. Organizations can also benefit from better data portability and interoperability, as they too can avoid vendor lock-in. 

An often overlooked yet key consideration, particularly as the Data Act is all about data, is how the Data Act intersects with cookies and consent. What do organizations need to do to be prepared for consent in the EU Data Act era? The primary takeaway is that cookie and consent mechanisms must be fully aligned with technical data-access processes and legal obligations under both the Data Act and GDPR. As such, as a part of becoming Data Act compliant, organizations will need to conduct a thorough cookie and consent audit, keeping the following principles in mind: 

The EU Data Act introduces sweeping changes, giving users rights to their own data, and making manufacturers and service providers build systems to support this level of data access and transparency. Cookie consent interfaces must adapt accordingly. 

Getting ahead requires not just legal reviews, but real changes in technical architecture, contractual frameworks, and cookie-consent flows. The joint lens of Data Act, GDPR, and the UK’s Privacy and Electronic Communications Regulations (PECR) means organizations are on the hook for clarity, fairness, and transparency in their data handling and sharing.