From 12 September 2026, one sentence in a European regulation starts applying to connected products, and it asks a question the smart-camera industry has spent a decade routing around: can the person who owns the device get the data off it without going through you?
The sentence is Article 3(1) of the Data Act, Regulation (EU) 2023/2854. Most of the Data Act has applied since 12 September 2025. Article 3(1) is the part that got an extra year, because it is not a paperwork obligation — it is a design obligation, and you cannot retrofit a design obligation into a product that already shipped. Article 50 sets the boundary precisely: "The obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026."
What Article 3(1) actually requires
Here is the text, which is worth reading slowly because every clause is doing work:
Connected products shall be designed and manufactured, and related services shall be designed and provided, in such a manner that product data and related service data, including the relevant metadata necessary to interpret and use those data, are, by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible to the user.
Four things in there matter more than the headline.
"By default." Not on request, not behind a support ticket, not as a premium tier. The accessible state is the shipping state.
"Free of charge." A vendor cannot meter access to the data your own device produced about you.
"Machine-readable." A viewer inside the vendor's app is not an answer. The obligation contemplates data you can actually take somewhere.
"Where relevant and technically feasible, directly accessible." This is the load-bearing qualifier, and anyone telling you the Data Act mandates local access everywhere is overselling it. Direct access is conditional. Where it is not feasible, Article 3 does not vanish — the data holder must make the data available on a simple electronic request instead. So the floor is access; direct access is the preferred shape, not a universal command.
The disclosure clauses are the sharper edge
Article 3(2) is getting less attention than 3(1) and is arguably more awkward for the cloud camera model. Before you buy, rent, or lease a connected product, the seller must tell you, in clear and comprehensible terms, among other things:
(c) whether the connected product is capable of storing data on-device or on a remote server, including, where applicable, the intended duration of retention;
(d) how the user may access, retrieve or, where relevant, erase the data, including the technical means to do so, as well as their terms of use and quality of service.
Read (c) and (d) together and you get a pre-purchase label for the thing that is normally discovered only after an outage: where does the footage live, for how long, and what exactly do I do to get it or destroy it. That is a hard disclosure to write vaguely.
Who this binds — and who it does not
This is where a lot of commentary goes wrong, so let me be exact about our own position rather than vague about it.
The obligation lands on manufacturers of connected products placed on the EU market and providers of related services, regardless of where they are established. A "connected product" in the Data Act's sense is a physical item that obtains, generates, or collects data about its use or environment and can communicate it. A doorbell camera is one. A standalone Android application is not.
Background Camera RemoteStream is a software app, not a connected product, and Super Funicular LLC is not a manufacturer placing hardware on the EU market. Article 3(1) does not impose obligations on us, and we are not claiming compliance credit for a rule we are outside of. If anyone sells you an app on the basis that it is "Data Act compliant," ask them which Article they think applies to them.
What we can honestly say is narrower and, I think, more interesting.
The architecture the law is describing already exists
The questions Article 3(2) forces a vendor to answer in advance are questions a local-first design answers structurally, because there is no second party in the path to ask.
Where is the data stored? On the device, on your storage. For how long? Until you delete it; there is no retention schedule because there is no retention. How do you access or retrieve it? The files are files. What are the terms of use and quality of service for that access? There are none to state, because no service stands between you and the recording.
Background Camera RemoteStream stores locally, requires no account, and runs with no backend of ours in the path. That is not us being diligent. It is a consequence of the architecture — an app with no server has nothing to disclose about a server, in the same way that an app with no backend has no API keys to leak. Architecture removes whole categories of question rather than answering them well.
And to be clear about the competitive landscape: local-first camera software is not something we invented or hold alone. There are capable open-source Android camera apps that also keep everything on device. The point is not that one app is unique; it is that the EU has now written the preference for direct, default, no-intermediary access into a design obligation for hardware, and a lot of shipping products were built on the opposite assumption.
What to actually watch
Three practical notes, none of which are legal advice — I build cameras, not cases, and if you are shipping a connected product in the EU you want a lawyer, not a blog post.
- This is not retroactive. Products already on the EU market before 12 September 2026 are not pulled into 3(1) by this date. The obligation attaches at placing-on-the-market.
- "Technically feasible" will be litigated. The gap between "we can't" and "we'd rather not" is where the next few years of this go.
- The disclosure duties bite before the access duties do. 3(2) obligations run at the point of sale and are easy for a regulator to check against a product page.
If the part of this you care about is simply not having your footage depend on somebody else's uptime, that problem is solvable today without waiting for enforcement.
- Google Play: https://play.google.com/store/apps/details?id=com.superfunicular.digicam
- Website: https://superfunicular.com
Related, from a regulation that started its own clock one day earlier: The EU's Reporting Clock Starts When Somebody Tells You.
Top comments (0)