What this is really about
Forget, for a moment, whether what I did was right. Forget whether using FSD was legal. Neither is the point.
What matters is this: Tesla didn’t like that I modified a car I own outright — so it reached in and remotely bricked part of it. Not just the feature some people assume is illegal (it isn’t, on private roads) — but fully legal safety features the car shipped with from new, part of the very €6,200 + VAT package I had paid for.
This is not the Kindle store. It is not Steam. It is a car — a physical thing I bought and own — sold to me with a list of features, every one of which Tesla can switch off from a server. (Ask anyone who remembers the old “Winter Package.”) Break Tesla’s terms and, in effect, the car drives itself back to the factory. No refund. Tens of thousands of euros, gone.
Tesla stays silent — but it behaves as though I never bought a car at all. As though I only ever licensed the right to use one. So the real question isn’t about me. It’s about everyone who drives:
What this is costing me
I already bought FSD outright — €6,200 + VAT, paid in full. On 8 April 2026 Tesla switched it off remotely — and since then my car won’t stop for red lights or stop signs, features I paid for and can no longer use. Every month costs me the price of the subscription I shouldn’t even need — and there’s no subscription to cancel to make it stop.
01What I bought
In Tesla’s ordering system, the Full Self-Driving Capability package was listed at €6,200 (net, pre-VAT). I paid it. The screenshot below is exactly what I bought.
That last line matters. Traffic Light and Stop Sign Control was a genuine safety feature for me: it stops the car automatically at red lights and stop signs. To this day, the official Tesla mobile app still lists the Full Self-Driving Capability package as included with my vehicle.
02It worked — for months
After delivery I used the package’s advertised features throughout Europe. Traffic Light and Stop Sign Control operated alongside Autopilot, fully and reliably. The car ran without issue for months.
I own the car outright — I do not lease it from Tesla. I take the view that I am entitled to modify a car I own, the same way I might fit custom wheels, a body kit, or new suspension, without the manufacturer penalising me for it.
The “modifications,” in full
I used two CANBUS diagnostic devices — “Commander” by enhauto.com and a device called “Cybertool.” Neither modifies the car or its software. They connect only to the standard CANBUS diagnostic port — the same interface manufacturers provide for diagnostics — and send commands the vehicle already supports.
For example, Commander makes the interior LEDs turn blue when Autopilot is engaged. The car reads a supported signal, sends a supported command, and the colour changes. If the car didn’t support that command, nothing would happen. No PCB altered. No component changed. No original part modified. Tesla itself states publicly that the vehicle software is immutable by third parties.
Cybertool works the same way. Just as Commander tells the car to turn its interior LEDs blue, Cybertool sent the car a command it already supported — to switch on the Full Self-Driving package in regions where Tesla had not yet enabled it. It unlocked nothing new: it simply turned on the feature my car was built for and I had already paid for. The car either supports a command or it doesn’t; mine did, because the package was licensed to it.
This is the same category of action as Commander disabling the reversing-gear chime — something Commander openly does, even though that chime is mandatory in the EU. And to be completely fair: Full Self-Driving is not yet approved for public roads in every region, in the same way a loud exhaust or slick tyres aren’t road-approved. That doesn’t make the equipment itself illegal — you can run slicks and a loud exhaust on a track. Enabling a feature the car was built and paid for is not the same as breaking the law with it: where and how it is used is the driver’s responsibility, not something a diagnostic command decides.
No safety system — hardware or software — has been modified in any way.
03What happened
On 8 April at 22:27, my car received a remote package-configuration update via Tesla Cloud Config. In effect, Tesla remotely told my car that the €6,200 + VAT package had never been purchased.
Roughly three hours later, at 02:00, this email arrived.
It is notably vague. It does not say which device was detected, what the safety risk was, how long features would be disabled, or even whether they would return. And the phrase puzzles me: unauthorized third-party device — unauthorised by whom? Every device on my car was authorised by its owner. Me.
04The contradiction
FSD approval rolled out across Europe — the Netherlands first, then Lithuania, then Estonia on 29 May (where my car is registered), and Belgium after that. My car received update 2026.17.5, which enables the new system. This was the moment my investment should finally have paid off.
Instead, the car offers me a “Subscribe” button — as if I had never bought it.
I paid €6,200 + VAT for a package. The car confirms the package is “Included.” And the same car behaves as though it was never bought.
05How the car knows what it has
Every Tesla ships with the same software and the same full set of capabilities. Individual features are switched on or off remotely through “Tesla Cloud Config,” tied to your specific car. It’s the same mechanism that once let Tesla sell cars with the hardware for heated rear seats physically present but disabled — and later let owners pay online to unlock them.
It’s also how Tesla distinguishes Basic Autopilot from Enhanced Autopilot from Full Self-Driving. The distinction is purely software-defined. Which means a feature you paid for can be revoked with a single remote flag — exactly what happened to me.
06Warranty service was refused
My car is under warranty, so I contacted Tesla service centres in Turku, Finland and Warsaw, Poland. Both confirmed the functionality does not work. Both confirmed the car is under warranty. Both refused the claim — saying it is “not serviceable” because the car was intentionally disabled “for safety reasons.”
The Finnish centre told me they could not reactivate the feature even though the device had been removed, because “you may install it again.” By that logic, why not disable the feature on every Tesla — since any car could have such a device fitted?
I am left unable to find any explanation other than this: the “safety reasons” cited actually reduce my safety. For eight weeks my car could not detect stop signs or traffic signals — functionality I had come to rely on.
07The questions Tesla won’t answer
I put these questions to Tesla and its service centres. They remain unanswered. I’ve grouped them by theme.
A The warranty refusal
B The decision to disable
C The claimed “safety reasons”
D Restoration of the paid features
E Compensation
F Policy on modifications & third-party devices
I requested a written response within 14 days, addressing each point. I’m still waiting.
08I’m not anti-Tesla
I’m a genuine believer in this technology. I bought two Teslas and pre-paid €12,400 + VAT in total against the promise of FSD. That promise took so long to materialise that I sold one of the cars — losing the value of the package on it.
Now I finally have a working car, with FSD purchased, in a country that permits FSD. And Tesla is deliberately preventing me from using what I paid for. I just want the feature I bought, an answer to my questions, and for this not to happen quietly to anyone else.
09Timeline
- 2025Buy a 2025 Model Y as first owner with FSD Capability — €6,200 + VAT.
- Months after deliveryFSD features, including stop-sign and traffic-light control, work reliably across Europe.
- 8 Apr 2026 · 22:27Remote Cloud Config update: “Your Autopilot package has returned to its original configuration.” Features lost.
- 9 Apr 2026 · 02:00Tesla emails about an “unauthorized third-party device” disabled “for safety reasons.”
- 8 weeksNo further information. The diagnostic device is removed; no third-party device remains on the car.
- 29 May 2026Estonia — where my car is registered — approves FSD on public roads (after the Netherlands and Lithuania, before Belgium). Update 2026.17.5 arrives.
- 15 Jul 2026Install software 2026.21.100 — FSD still does not work. Send Tesla a formal complaint and demand for restoration, reimbursement and compensation.
- 30 Jul 2026In Korea, banned HW3 cars get the full package back — and lose it again within twenty minutes, remotely, with no update in either direction.
- 31 Jul 2026Six hours after I say I will take Tesla to a data-protection regulator, its Data Protection Office grants itself two more months — see section 15.
- 3 Aug 2026I answer the extension, and lodge an Article 77 complaint against Tesla with the Estonian Data Protection Inspectorate. Accepted the same day — section 16.
- NowCar offers a “Subscribe” button for FSD it says is “Included.” Two service centres refuse warranty repair.
10Tesla replied. Here is my answer.
On 30 June 2026, Tesla Poland responded to my complaint. It didn’t answer a single one of my questions — but it did make four claims worth addressing. Here is their letter, and my reply, in full.
Tesla’s reply dodged every question. My point-by-point rebuttal, and the questions still unanswered.Read in full
Dear Mr. Hernas,
Thank you for your email and for the questions you have raised.
At the outset, we would like to note that, in the absence of any site visits carried out and any information on file regarding you, we do not see grounds to address the questions listed above.
The vehicle was purchased by you from a third party. In your message you stated that you are the first owner, which is not consistent with our records. Vehicles acquired second-hand are always outside the scope of our standard processes.
Given that the vehicle is registered in our system as being in Estonia, we ask that you await a response from the appropriate department.
Sincerely,
Tesla Poland
Thank you for your reply. With respect, it does not answer any of the questions I raised, and several of its statements are either factually incorrect or contradict Tesla’s own instructions to me. Let me address each point.
“In the absence of any site visits and any information on file regarding you, we do not see grounds to address the questions.”
That is exactly the problem: no site visit has taken place because Tesla has not carried one out. When I approached the service centres in Turku and Warsaw to have the car repaired under warranty, both confirmed the features do not work and that the car is under warranty — yet both declined to proceed, so no inspection ever happened. You cannot refuse to examine the car and then cite the absence of an examination as the reason you cannot answer my questions. I am asking for written answers to written questions; a site visit is not a precondition for that. And if you do require one, name the centre and the date, and I will attend.
“Given that the vehicle is registered as being in Estonia, await a response from the appropriate department.”
Estonia has no Tesla service centre. Tesla’s own guidance is to use any service centre in the EU — which is exactly what I did, having serviced this car in Finland several times. Please name the “appropriate department” and give me its direct contact details; I cannot await a response from a department no one will identify. Your phrasing also implies you are tracking the car’s current location. I have disabled data sharing — so I am formally requesting, under Article 15 GDPR, all location data Tesla holds on this vehicle and the legal basis for collecting it.
“You stated you are the first owner, which is not consistent with our records.”
I am the first registered owner. The car was acquired through an intermediary for leasing, but I am the first owner named on the official EU registration documents. Tesla’s internal records do not determine legal ownership — the registration does. If your records say otherwise, send me the record you are relying on so the discrepancy can be corrected.
“Vehicles acquired second-hand are always outside the scope of our standard processes.”
Please state, in writing, what this means. Are you saying that a change of ownership voids the warranty? If so, cite the exact clause. Under EU consumer law the warranty attaches to the car, not to the owner, and transfers with it on resale. A warranty that can be switched off because a car changed hands is not a warranty.
And the questions that still stand, unanswered:
- The exact warranty clause that excludes this fault from coverage.
- Who authorised the remote disablement, on what documented evidence, and on what legal basis.
- What the “unauthorized third-party device” was — make, model, log entry, and timestamp.
- The specific safety risk the device is alleged to have created, with documentation.
- The date by which the paid features will be restored, and the formal appeals process.
- The compensation Tesla will provide for the period the paid features were disabled.
I reiterate my request for a written response addressing each point within 14 days. Absent that, I will treat this as Tesla’s final refusal and escalate to the relevant consumer-protection and data-protection authorities. — Bartosz Hernas
Both letters are reproduced verbatim. The original correspondence is in English; personal details (home address) have been redacted.
11The data-privacy route
There is no way to reach anyone at Tesla above the service centre — no email, no name, no escalation path — and the service centres told me plainly that they can do nothing. So I used the one channel Tesla is obliged to answer: data protection. Under the GDPR I filed a subject-access request for the telemetry Tesla used to disable the package I paid for. Here is that exchange, in full. It did not end there — section 15 has what came next.
A GDPR subject-access request for the telemetry Tesla used to disable FSD — and Tesla’s reply claiming it holds no such data.Read in full
I would like to reiterate that I would also like to have any telemetry data you used to deny my warranty claims.
My car has the Full Self-Driving package purchased, and this package has been illegally disabled by a remote configuration change — in effect tricking the car into thinking FSD had never been purchased.
I have lost legally available, previously working functionality: Traffic Light Awareness on Autopilot. This was part of a €6,200 extra payment. It was remotely disabled, with no refund.
Your reasoning was that your telemetry discovered a third-party device — even though on the day it was disabled I had telemetry opt-out enabled in my car. I would therefore like all the data associated with that telemetry.
I would also like to know whether the Tesla cars you sell are owned by their owners (me), or whether they are rented/subscribed to but owned by Tesla. If I own the car, I would like Tesla not to tell me what I can and cannot do with a car I paid full price for.
I want to ensure there are no future violations of my privacy: please remove all telemetry data sent from my cars to your servers, and ensure no future telemetry data is sent out, on all cars of which I am the owner.
I need this data to follow up on the loss of value of the car following the remote bricking of legal functionality, and Tesla’s full denial of my warranty claim to restore the car to full functionality.
Thank you for contacting us. Our records indicate that your access request was fulfilled on 01/06/2026. As described in our Privacy Notice, from the moment you take delivery, Tesla does not associate the vehicle data generated by your driving with your identity or account by default. As a result, no one – including Tesla – would have knowledge of your activities. In order for vehicle data to be linked to your account or VIN, a specific condition must be triggered such as the occurrence of a safety event (collision or airbag deployment), service or repair appointment, a raised hardware or software issue, or your consent – in which case it is provided as part of your data request.
Additionally, Tesla’s retention guidelines and data privacy practices implement techniques designed to minimize how much data we collect, use, or store.
When data isn’t provided, this is because it is either: in a form that is not personally identifiable or linked to your Tesla Account; stored in an end-to-end encrypted format that Tesla cannot decrypt; or not customer-related.
Note: Some data may have also been held only for a very short time and is no longer on our servers.
Thank you for your response of 25 June 2026. I am writing to dispute the completeness of my access request and to make a further, specific request under Articles 15 and 22 of the GDPR.
Your response states that Tesla does not associate vehicle data generated by driving with my identity or account “by default,” and that linkage only occurs when a specific condition is triggered — including “a raised hardware or software issue” or “your consent.”
This is directly contradicted by Tesla’s own prior written communication to me, in which Tesla stated that an unauthorised device was detected in my vehicle and that Full Self-Driving was consequently disabled. That detection and that decision necessarily relied on vehicle telemetry linked to my specific VIN and account. By your own framework, this is exactly the kind of “specific condition” that triggers linkage — meaning the underlying data exists, is associated with my identity, and falls squarely within the scope of my access request.
The data I asked for, which was not provided:
- All telemetry, diagnostic, and event data from my vehicle (VIN XP7YGCEK9SB621959) that Tesla used, referenced, or relied upon to detect the alleged unauthorised device and to disable functionality. This is personal data under Article 4(1).
- The specific date(s) and time(s) this data was collected and processed.
- Under Article 15(1)(h) and Article 22, meaningful information about the logic involved in the automated decision to disable functionality, including the criteria used to classify a device as “unauthorised.”
- Under Article 15(1)(c), the recipients or categories of recipients to whom this data has been or will be disclosed.
- Under Article 15(1)(d), the retention period applied to this category of data, and confirmation of whether it is still held.
Article 15 does not permit a controller to withhold data on the basis that it is “not provided by default.” Where data has in fact been linked to my identity and used to make a decision affecting me, it is personal data and must be disclosed. If Tesla maintains that any of the requested data is not held, I request a clear statement to that effect for each item, together with the legal basis. — Bartosz Hernas
All three letters are reproduced verbatim. The correspondence is in English; personal details (home address) have been redacted.
12How the disablement is executed
Another owner who ended up in the same situation reached out with the technical detail of how this is actually done to the car. Through their own method of enabling FSD, they were also able to record — though not intercept — Tesla’s interaction with the vehicle. On 8 April 2026, around 11:00 PST, their car received a request from teleforce to update its gateway config. It is reproduced below with the contributor’s own redactions — every XXX is theirs.
The raw teleforce gateway-config command another owner captured — the exact bytes that switch FSD off, with a cryptographic signature.Read in full
odin.core.engine.handlers.message_handler - INFO - received request, request_id: XXX, product_id: XXX, message_type: command, response_topic: vehicle_service.mothership-dub_worker.teleforce, request: {'command': 'execute', 'token': {'user': 'sa-teleforce', 'principals': ['authenticated', 'tbx-service', 'tbx-internal', 'tbx-mothership', 'tbx-service-engineering', 'tbx-technical-specialist', 'odin-service-repair-and-maintenance', 'odin-service-security-operations', 'odin-research-and-development-level1', 'odin-software-update-management-system', 'odin-service-robotaxi', 'tbx-robotaxi-data'], 'product_id': 'XXX', 'expires_at': '2026-04-XXX0'}, 'tokenv2': {'token': {'user': 'sa-teleforce', 'principals': ['authenticated', 'tbx-service', 'tbx-internal', 'tbx-mothership', 'tbx-service-engineering', 'tbx-technical-specialist', 'odin-service-repair-and-maintenance', 'odin-service-security-operations', 'odin-research-and-development-level1', 'odin-software-update-management-system', 'odin-service-robotaxi', 'tbx-robotaxi-data'], 'product_id': 'XXX', 'expires_at': '2026-04-XXX0'}, 'intermediate_certificate': '-----BEGIN CERTIFICATE-----\nMIICGjCCAb+gAwIBAgIIWE8E/tPO4rYwCgYIKoZIzj0EAwIwJDEiMCAGA1UEAwwZ\nVGVzbGEgU2VydmljZXMgQ29tbWFuZCBDQTAeFw0yNjA0MDgxMjUwMjhaFw0yNjA0\nMTgxMjUwMjhaMIGJMSowKAYDVQQDDCFpbnRlcm5hbC5vZGluLnByb2QudGVzbGEu\nc2VydmljZXMxFTATBgNVBAsMDFRlc2xhIE1vdG9yczEOMAwGA1UECgwFVGVzbGEx\nEjAQBgNVBAcMCVBhbG8gQWx0bzETMBEGA1UECAwKQ2FsaWZvcm5pYTELMAkGA1UE\nBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARLEFIVmg4s93fAU9tFTuQy\nHiQYr9EBoIL8V7Pwhzg8TmBXtNucZkAT+VOJS9ua2NgXf2UL5bco9MXPoMn75gTo\no3UwczAdBgNVHQ4EFgQUEtro+JN4/jwURhxoYNqw4p9AOq0wDAYDVR0TAQH/BAIw\nADAfBgNVHSMEGDAWgBSEHWFVJ3GUwSiIrRJlO681Ad5DxTAOBgNVHQ8BAf8EBAMC\nBeAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwCgYIKoZIzj0EAwIDSQAwRgIhAMOT6W/2\naOZri1Nebjaw6H8Blyjz/0YE2d54kiTyMlfEAiEA+hmbXXD2NDMdHnA+ABcT25dY\nZFGU6Ilvv/0eTms8GyQ=\n-----END CERTIFICATE-----\n'}, 'args': {'name': 'PROC_ICE_X_SAFE-SET-VEHICLE-CONFIGS', 'kw': {'configParams': [{'configid': 29, 'data': '02', 'signature': '50XXX07'}, {'configid': 88, 'data': '0200000000', 'signature': '50XXX0f'}], 'configs_require_ice_reboot': []}}, 'allow_concurrent': True, 'request_id': 'XXX', 'message_type': 'command', 'broadcast_permanent_topics': True}, hermes_req_txid: XXX command_type: 42What the command does:
Config IDs 29 and 88 are what tell Autopilot which package you have bought:
- Config autopilot —
id 29(02= EAP,03= FSD) - Config autopilotSubscription —
id 88 - The values set in this command mean “EAP” — i.e. Full Self-Driving switched off.
The car applied those configs and rebooted Autopilot — landing in exactly the state this whole site is about: the UI still shows FSD as “Included,” but the features are gone.
The contributor’s point: with the signature in the command, they say they can prove cryptographically that Tesla itself issued it. The token’s user is sa-teleforce — “sa” meaning service account, i.e. an automated system rather than a named employee. When a person issues the command, they say an actual name appears in that field instead. Shared here in case it helps other owners; reproduced verbatim with the contributor’s redactions.
13The formal complaint
On 15 July 2026 I sent Tesla a formal complaint and legal demand — for immediate restoration of the package I paid for, reimbursement for loss of use, compensation for damages, and written answers to eighteen specific questions. It went to Tesla Resolutions / Tesla International B.V. and was copied to Tesla’s press, legal, privacy, investor-relations and executive addresses. Here it is in full.
A formal legal demand: restore the package, reimburse loss of use, compensate for damages, and answer eighteen questions within 14 days.Read in full
For the attention of Tesla Resolutions / Tesla International B.V.
Dear Sir or Madam,
I am writing to make a formal complaint and a formal demand for the restoration of functionality I paid for and own, together with reimbursement, compensation, and written answers to the specific questions set out below. This follows my earlier correspondence, which remains substantively unanswered.
1. What I paid for and what happened
I purchased a 2025 Model Y with the Full Self-Driving Capability package for €6,200 plus VAT, paid in full. That package — expressly including Traffic Light and Stop Sign Control — worked reliably for months after delivery. On 8 April 2026 at 22:27, a remote Tesla Cloud Config update reset my vehicle to its “original configuration,” removing features I had paid for, including the automatic stopping at red lights and stop signs. Roughly three hours later I received an email citing an “unauthorized third-party device,” naming no device, specifying no risk, and giving no timeframe for restoration. To this day, the Tesla app and the car’s own settings still list the Full Self-Driving package as “Included.”
2. Why the disablement is unlawful and unjustified
The use of third-party equipment for vehicle diagnostics and maintenance falls within the framework established by Article 61 of Regulation (EU) 2018/858. The concept of an “unauthorized third-party device” has no basis in that regulatory framework and cannot lawfully be used to determine what equipment an owner may connect to a vehicle they own outright. The devices I used are standard CANBUS diagnostic tools that modify no hardware, no component, and no software — they send only commands the vehicle already supports, through the manufacturer’s own diagnostic interface. No safety system, in hardware or software, was modified in any way.
The claim that such equipment could “potentially interfere with” Full Self-Driving does not justify remotely and unilaterally disabling features that were previously working normally. The result is paradoxical: since the intervention, my vehicle no longer stops automatically at red lights or stop signs, so presenting the removal of these features as a “safety measure” is untenable — the car is now demonstrably less safe than before. If Tesla had a genuine concern, I could simply have been asked to disconnect the device. I have now removed it. The features have still not been restored.
Since the features were disabled remotely, they can plainly be re-enabled remotely. Referring to “a future software update” under which features “may” be re-enabled guarantees neither full restoration nor any reasonable timeframe. Meanwhile, Full Self-Driving is now approved on public roads in Estonia, where my car is registered (from 29 May 2026), so I am now blocked from using a feature that is both paid for and legal.
3. Warranty
The vehicle is under warranty. Service centres in Turku (Finland) and Warsaw (Poland) each confirmed that the features do not work and that the car is under warranty, yet each refused to remedy the fault. Under EU consumer law the warranty attaches to the vehicle and transfers with it; it is not extinguished by a change of registered owner, and no site visit that Tesla itself declined to perform can be cited as a reason not to address this.
4. Questions requiring a written answer
The following questions have been put to Tesla and its service centres and remain unanswered. I require a specific written response to each.
The decision to disable:
- (i) Who authorised the remote disablement of the paid entitlement, by name or role, and on what documented evidence?
- (ii) Was the decision automatic or made manually by a person? If automatic, what specific trigger or rule caused it?
- (iii) On what legal basis does Tesla remotely disable functionality a customer has already paid for?
The detection:
- (iv) What exactly was the “unauthorized third-party device”? Provide its make and model.
- (v) Provide the specific log entries, telemetry, and timestamp that led to the detection.
- (vi) The vehicle had telemetry sharing disabled on the relevant date; explain how detection occurred and what data was transmitted, when, and under what legal basis.
The notification and the question of responsibility:
- (vii) How, and through what channel, was the owner contacted before — rather than after — the entitlement was removed?
- (viii) Tesla took no step to establish whether the registered owner installed or was even aware of any device. What process, if any, does Tesla follow to establish responsibility before penalising the owner, given that a device could be fitted by a previous keeper, an intermediary, a workshop, or a third party without the owner’s knowledge?
- (ix) On what basis does Tesla consider it proportionate to strip a paid entitlement rather than simply request that the device be removed — which I would have done, and have now done?
The “authorization” of devices:
- (x) Who at Tesla decides whether a third-party device is “authorized” or “unauthorized,” and by what published criteria?
- (xi) Is there a published list of approved and prohibited devices? If so, provide it; if not, explain how an owner is expected to know in advance.
- (xii) Does Tesla consider a standard CANBUS diagnostic device, used through the manufacturer’s own diagnostic port, “unauthorized”? If so, state that policy publicly.
The “safety reasons”:
- (xiii) Identify the specific safety risk the device is alleged to have created, with supporting documentation.
- (xiv) Explain how disabling stop-sign and traffic-light recognition — leaving the car unable to stop automatically at red lights — improves safety.
Warranty and restoration:
- (xv) State, in writing, the exact warranty clause relied upon to exclude this fault from coverage.
- (xvi) The device has been removed and no third-party device is now present — what is the remaining obstacle to restoration, and by what date will the features be restored?
- (xvii) What is the formal appeals process, and how do I begin it?
Scope of remote control:
- (xviii) What else can Tesla disable remotely on a vehicle an owner has paid for in full — could I lose app access, heated seats, charging, or other functions over a third-party part Tesla disapproves of? Where is this disclosed before purchase?
5. What I require
- (a) Immediate restoration of the full Full Self-Driving Capability package to my vehicle, given that the device concerned has been removed and no third-party device is now present.
- (b) A specific, dated commitment for that restoration — not a conditional reference to an unspecified future update.
- (c) Reimbursement for loss of use. Tesla’s own published subscription price for this functionality is approximately €99 per month. On that basis, the value of the functionality withheld from 8 April 2026 to the date of this letter (15 July 2026, 98 days) is approximately €319, increasing by approximately €99 for each further month until full restoration. I require reimbursement on this basis for the entire period of deprivation.
(d) Compensation for damages, in addition to (c). Separately from loss-of-use reimbursement, I require compensation for:
- (i) Diminution in value of the vehicle resulting from the remote removal of a paid, functioning package. The package was purchased for €6,200 + VAT; a vehicle whose paid features can be, and have been, remotely revoked is worth materially less than one where they cannot. I reserve the right to quantify this by independent valuation, but put its floor at the unamortised value of the package.
- (ii) Loss of a safety-relevant function — automatic stopping at red lights and stop signs — over a period now exceeding three months.
- (iii) Time, effort and costs incurred pursuing a matter Tesla can resolve with a single remote configuration change.
I invite Tesla to propose a figure for (d); failing agreement, it will be quantified with supporting evidence in any subsequent proceedings.
- (e) If the Service Centre does not have the means to resolve this, direct contact from a person at Tesla with the authority to re-enable the functionality, together with the identity of the department responsible.
6. Timeframe
Please provide a written response addressing each numbered question and each lettered requirement within 14 days of this email. Absent a substantive response, I will treat this as Tesla’s final refusal and escalate to the competent consumer-protection and data-protection authorities, and pursue the matter further as advised. To my knowledge, several hundred European owners are affected by the same practice.
This complaint, and Tesla’s responses to date, form part of a documented public record at TeslaTookWhatIPaidFor.com.
Yours faithfully, Bartosz Hernas — Tesla shareholder, Owner of 2025 Tesla Model Y · VIN XP7YGCEK9SB621959
Reproduced verbatim. Personal details (home address) have been redacted; the recipient addresses are listed as sent.
14Korea: given back, then taken away again
On 30 July 2026, Korean owners who were banned in April — banned by VIN, exactly as I was — watched Tesla switch Full Self-Driving back on. Then, within twenty minutes, watched it switch off again. No software update in either direction. A flag, flipped twice in one afternoon.
The tip came from another owner who lost his package the same month I lost mine. He pointed me at the Korean channel of the ev-open-can-tools Discord, where several HW3 cars running the Korean-market build 2026.20.6.3 — the “v14 lite” release — had suddenly been un-banned. They had been using CAN dongles, exactly as I had. And, as he was careful to point out, the reprieve did not come from the update itself: it landed abruptly, some time after the update, in precisely the manner the ban had. Like a cron job.
That detail matters, because the Korean cars are the hard cases. In China, a block of this kind can be cleared by transferring the car to a different Tesla account. In Korea — as in Europe — it is attached to the VIN, and changing hands does not lift it. These were the same locks as the one on my car.
What happened that afternoon, Korean time:
- 30 Jul 2026 · 15:46First report: FSD is simply there again — in the app and on the car, with the release notes listing Full Self-Driving properly. Autopark and the full feature set confirmed working.
- Minutes laterMore banned cars light up, including ones that had received the FSD-less 2026.20.6.3 build. Owners assume a formal Korean launch, or that the sheer volume of complaints has forced a reversal.
- ~16:00“다시 뺏어갔습니다” — “they’ve taken it away again.” The first owner’s FSD is revoked remotely, in the app and on the car. No message, no notice: it simply disappears.
- 18:31A second owner drives briefly on the restored FSD, parks, goes upstairs. Five minutes later the FSD version has vanished from the app and the car. Again with no warning of any kind.
- That eveningNobody reports having done anything to provoke it — no tool reconnected, no SIM reinserted, no commands sent. The one pattern anyone can see: cars with no ownership transfer in their history lose it fastest.
Tesla told me the features “may be enabled again in a future software update.” Korea watched them go on and off inside twenty minutes, with no update at all.
That is the part every European owner should read twice. Four months of refusals rest on one claim: that this cannot be undone from where the person in front of me is sitting — that it needs a firmware release, another department, an inspection, a process. On 30 July, in Korea, the entitlement was granted remotely and withdrawn remotely inside the same hour. It is a server-side flag. Restoring it is a single config write — section 12 has the exact command, down to the byte.
The second thing it shows is that this is not a forgotten April sweep. It is actively maintained. Something noticed, within twenty minutes, that cars which were not supposed to have FSD had FSD — and put them back. Whoever or whatever is watching that closely is perfectly capable of answering my emails.
Banned HW3 cars in Korea got the full package back on 30 July — and lost it again within twenty minutes. Proof the switch works both ways, with no update.Read in full
Hi Bartek — I’m in much the same situation as you. I was banned in April too.
On the ev-open-can-tools Discord, in the Koreans’ channel, several people with HW3 cars on update v14 lite 2026.20.6.3 — from what I can see, an update for the Korean market — have been un-banned. They had been using CAN dongles, the same as us. Not un-banned by the software update itself, even though it happened after the update, but presumably by some cron job — the same way we got banned, i.e. suddenly.
The Koreans were blocked in the same way we were, by VIN — not like the Chinese, where changing the owner of the Tesla account helps.
So, as you can see, “it can be done.” But I wouldn’t count on European concrete: they’ll probably go on saying that no such possibility exists.
What the Korean owners observed:
- The entitlement is a pure remote toggle. FSD was enabled and disabled with no firmware push in between — flatly contradicting what customer service tells owners, that a software update is required.
- Nobody re-offended. No one reported plugging a device back in, reinserting a SIM, or sending any CAN commands before the features were taken away again.
- Cars with no recent ownership or account transfer lost FSD quickest.
- Cars with a transfer in their history held on longer — including one that had spent time on a Canadian account before returning to a Korean one — at least for as long as the conversation was logged.
- The owners’ own reading: that Tesla lifted the flag briefly — a test, a response to used-car complaints, or an internal error — and re-applied it after spotting the unlocks through telemetry or by reading the community’s own posts. Simply driving with the restored package may have been enough to be flagged again.
A word on what this is. It is a community account, from a chat log in Korean, about cars that are not mine; I have not sat in them and I am not the source. I am publishing it because it is the first time I have seen the mechanism demonstrated in both directions on the same day, by several people independently — and because Tesla could confirm or deny it in one sentence.
Source: the Korean channel of the ev-open-can-tools Discord, 30 July 2026 (direct link to the channel). The tip is translated from Polish and reproduced with the sender’s name and one aside withheld; the Korean owners’ handles are omitted.
15The deadline that moved
On 31 July 2026 — thirty days after I asked five specific questions, and six hours after I told Tesla I would take them to a regulator — Tesla’s Data Protection Office replied. Not with answers: with an extension. The request has been open since 1 June. It is now due 1 October.
The sequence matters, so here it is plainly. On 1 June I asked for the telemetry Tesla used to disable the package I paid for. On 25 June Tesla replied that the request had been “fulfilled” on the day I made it, and restated its Privacy Notice — section 11 has that letter in full. On 1 July I disputed it and put five specific questions under Articles 15 and 22, which restarted the one-month clock: answers were due 1 August. Then thirty days of nothing. At 11:44 on 31 July I wrote that no extension had been notified and that I would lodge a complaint with the Estonian Data Protection Inspectorate. At 18:30 the same day, Tesla took two additional months.
An extension is not a formality a company grants itself. Under Article 12(3) it is available where a request is complex or where there are numerous requests; it must be notified within one month; and the reasons for the delay must be given. Tesla’s stated reason is that my inquiry “has been submitted across several departments” and that it is “reconciling those requests.” That is a description of Tesla’s internal filing, not of my request’s complexity. I asked five questions about one automated decision, taken on one VIN, on one afternoon. I answered on 3 August, and my position is this: two of those five items I had already asked for on 1 June, and for those the month ran out on 1 July with no extension notified. An extension cannot be applied backwards to a deadline that has already passed. Those two items are due now.
Thirty days of silence, then — six hours after I named a regulator — Tesla granted itself two more months. The request is now four months old.Read in full
I refer to my email of 1 July 2026 (your reference J27NGDL), to which I have received no response.
That email set out five specific items requested under Articles 15 and 22 GDPR, none of which have been answered. Under Article 12(3) your response was due within one month, i.e. by 1 August 2026. No extension has been notified to me at any point, so no extension under Article 12(3) is available to Tesla.
I also note that your reply of 25 June 2026 did not inform me of my right to lodge a complaint with a supervisory authority or to seek a judicial remedy, as required by Article 12(4).
If I do not receive a substantive response to each of the five items by 1 August 2026, I will lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) under Article 77 GDPR, for onward handling with the Autoriteit Persoonsgegevens as Tesla’s lead supervisory authority.
For the avoidance of doubt, a restatement of your general Privacy Notice will not be treated as a response. If Tesla holds none of the requested data, I require a clear statement to that effect for each of the five items individually, together with the legal basis relied upon.
Thank you for your follow-up and for providing the additional information.
Please be assured that we are actively working on your request. We have identified that your inquiry has been submitted across several departments, and we are currently reconciling those requests to ensure that we provide you with a complete and accurate response.
Given the scope of your request, we require additional time to complete our review. We will get back to you as soon as possible and, in any event, within the legally prescribed time period of two additional months permitted under local regulations.
We appreciate your patience and understanding. If we require any further information to process your request, we will promptly contact you.
Thank you for your email of 31 July 2026. I note that you now require two further months under Article 12(3) GDPR. My position on that is as follows.
1. Scope of the extension
Items 1 and 2 of my email of 1 July 2026 — the telemetry, diagnostic and event data relied upon to detect the alleged unauthorised device and to disable Full Self-Driving, and the dates and times on which that data was collected and processed — were already expressly requested in my email of 1 June 2026. In respect of those items the one-month period under Article 12(3) expired on 1 July 2026 and no extension was notified within it. An extension cannot be applied retrospectively to a period that has already expired. I therefore do not accept that the extension operates in respect of items 1 and 2, and I require those items now. As to items 3 to 5, which were first raised on 1 July 2026, I accept that your notice of 31 July 2026 was given in time.
2. A specific date
Your email gives no date. Please confirm in writing the precise date by which you will respond, and the date of receipt from which you are calculating the extension.
3. Reasons for the delay
Article 12(3) requires you to inform me of the reasons for the delay. That my inquiry “has been submitted across several departments” and that you are “reconciling those requests” describes Tesla’s internal routing, not the complexity or number of my requests. If Tesla maintains that the request is complex within the meaning of Article 12(3), please state the specific reasons.
4. Applicable law
For the avoidance of doubt, the applicable instrument is Regulation (EU) 2016/679, not “local regulations”. Tesla International B.V. is the controller and the extension available is that in the second sentence of Article 12(3).
5. Your position of 25 June 2026
You informed me on 25 June 2026 that my access request “was fulfilled on 01/06/2026”. That is inconsistent with now requiring three months in total to answer it. Please confirm whether Tesla withdraws the statement that the request was fulfilled.
6. Right to complain
Your response of 25 June 2026 declined to provide the data requested but did not inform me of the reasons for not acting, of my right to lodge a complaint with a supervisory authority, or of my right to seek a judicial remedy, as Article 12(4) requires. I note that failure.
I reserve all rights, including the right to lodge a complaint under Article 77 GDPR and to seek a judicial remedy under Article 79, and I am proceeding on that basis in parallel with this correspondence. — Bartosz Hernas
All three letters are reproduced verbatim; greetings, signature blocks, the repeated vehicle and account identifiers, and quoted history have been removed. The correspondence is in English. “J27NGDL” is Tesla’s own reference number for the request.
Five questions about a single automated decision. If the answer existed and was written down, it would take an afternoon.
Here is what I take from that — and it is my reading, not something I can prove. A company that switches a feature off by remote command has the record of why somewhere: the telemetry it matched, the rule it applied, the account that signed the command. Section 12 shows what that command looks like on the wire. If that record were ready to hand, answering me would be an afternoon’s work. Four months and an extension is not what having an answer looks like; it is what deciding on an answer looks like. I would rather be wrong about that — and I will publish whatever arrives on 1 October. I did not wait for it, though: I lodged a complaint with the Estonian data-protection authority the same day, and section 16 sets out what it says.
16The complaint to the regulator
I did not wait for 1 October. On 3 August 2026 I lodged a complaint against Tesla International B.V. under Article 77 GDPR with the Estonian Data Protection Inspectorate — the Andmekaitse Inspektsioon. It was accepted the same day.
The complaint alleges seven infringements: failure to inform me of my remedies, incomplete access and an untenable ground for withholding, missing the one-month deadline on the two items I asked for on 1 June, failure to supply the recipients, retention period and decision logic, an automated decision under Article 22 taken with no human assessment, failure to facilitate my rights at all, and no answer whatsoever to my erasure request. It asks the Inspectorate to work with the Dutch Autoriteit Persoonsgegevens — Tesla’s lead authority in the EU — under the Article 60 cooperation procedure. I lodged it now rather than in October because those infringements are already complete: whatever Tesla sends in two months cannot un-fail to tell me I had a right to complain.
Filed with the Estonian DPA on 3 August and accepted the same day: seven alleged infringements, and a request that the Dutch lead authority be brought in.Read in full
Summary of the complaint
On 1 June 2026 the complainant made a request under Article 15 GDPR for, among other things, the telemetry, diagnostic and event data that Tesla relied upon when it remotely disabled Full Self-Driving functionality on the complainant’s vehicle — functionality purchased for EUR 6,200 — on the stated ground that an unauthorised third-party device had been detected. Tesla supplied only a standard account-data export, which contained none of that data.
On 25 June 2026 Tesla asserted that the request had been “fulfilled on 01/06/2026” and that vehicle data is not associated with the complainant’s identity “by default”. That position is irreconcilable with Tesla’s own conduct. A remote decision to disable a specific feature on a specific VIN, taken because of what Tesla says its systems detected in that vehicle, necessarily involved personal data linked to the complainant. Tesla’s own reply lists “a raised hardware or software issue” as a condition that triggers precisely such linkage. That reply also declined the request without informing the complainant of his right to complain to a supervisory authority or to seek a judicial remedy.
On 1 July 2026 the complainant set out five specific items under Articles 15 and 22 GDPR. On 31 July 2026 Tesla stated that it requires two further months. This complaint is nevertheless lodged now, because the infringements are already complete and do not depend on the outcome of the extension.
The controller’s own notifications
The notification is itself proof of linkage. Tesla could not have generated and sent the email of 8 April 2026 unless the detection event had been transmitted from the vehicle to Tesla and associated there with the complainant’s account and email address. Tesla’s statement of 25 June 2026 that “no one – including Tesla – would have knowledge of your activities” cannot stand alongside a notification that Tesla itself sent to him about an event in his vehicle.
A second Tesla department describes a centrally imposed decision. On 25 June 2026, the same day as the privacy response, Tesla’s Warsaw service centre wrote to the complainant in Polish that “Blokada została nałożona odgórnie i jest software’owa, z powodów bezpieczeństwa po wykryciu modyfikacji systemów FSD” — “the block was imposed centrally and is software-based, for safety reasons, after detection of modification of FSD systems”. A block imposed centrally by Tesla following detection is a decision taken by the controller on the basis of vehicle data attributed to this vehicle and this account. It is not an autonomous act of the car, as the wording “your vehicle has detected” implies.
The notifications were dispatched in bulk. An identical notification was sent twenty-three seconds later, at 23:00:23 UTC on 8 April 2026, in respect of a different vehicle, to a further email address controlled by the complainant. The complainant advances no claim in respect of that vehicle or its owner and refers to it only as evidence that these notifications, and the disablements they announced, were dispatched as an automated bulk action rather than following any individual assessment of the vehicle concerned.
Infringements alleged
Article 12(4) — failure to inform of remedies. Tesla’s reply of 25 June 2026 declined to provide the data requested but did not inform the complainant of the reasons for not acting, of the possibility of lodging a complaint with a supervisory authority, or of seeking a judicial remedy. This infringement is complete and is unaffected by the extension of 31 July 2026.
Article 15(1) and 15(3) — incomplete access, and an untenable ground for withholding. A generic account-data export was supplied in place of the personal data actually identified in the request, and Tesla declared the request “fulfilled”. Data that has in fact been linked to the complainant and used to take a decision affecting him is personal data within Article 4(1) and cannot be withheld on the ground that linkage does not occur “by default”.
Article 12(3) — failure to respond within one month as to items 1 and 2. The telemetry data and the dates and times of its processing fell due on 1 July 2026. No extension was notified within that period. These items remain outstanding.
Article 15(1)(c), (d) and (h) — failure to supply required accompanying information. Recipients, retention period, and information on the logic of the automated decision were all requested and none has been provided.
Article 22 — automated decision-making. The disablement appears to have been an automated decision producing a significant effect on the complainant (loss of paid functionality valued at EUR 6,200, with no refund and no restoration under warranty). Tesla has provided no information about the logic applied and no meaningful route to human intervention or to contest the decision. The bulk dispatch of identical notifications seconds apart in respect of different vehicles indicates that no individual human assessment preceded the decision.
Article 12(1) and 12(2) — failure to facilitate the exercise of rights. Tesla’s substantive reply restated its general Privacy Notice and redirected the complainant to Customer Support rather than answering the request. Tesla has since attributed the delay to the request having been spread across its own departments, having itself directed the complainant to a further department.
Article 17 — no response to the erasure request. The request of 1 June 2026 for erasure of telemetry data and cessation of further transmission has never been addressed in any reply.
Action requested
- That the Inspectorate register this complaint and investigate it, in cooperation with the Autoriteit Persoonsgegevens under Article 60 GDPR.
- That the Inspectorate find the infringement of Article 12(4) in respect of the response of 25 June 2026, which does not depend on the extension.
- That the Inspectorate order Tesla under Article 58(2)(c) to comply forthwith as to items 1 and 2, which fell due on 1 July 2026.
- That the Inspectorate require Tesla to state, in writing and to the complainant, the specific date by which it will respond and the reasons for the delay required by Article 12(3).
- That, if Tesla has not fully answered items 3 to 5 by the expiry of the extended period, the Inspectorate proceed on those items without requiring a fresh complaint.
- That the Inspectorate require Tesla to provide the information owed under Article 15(1)(h) and Article 22 concerning the logic and criteria of the automated decision to disable purchased functionality.
- That the Inspectorate examine whether Tesla processed vehicle telemetry from the complainant’s vehicle at a time when telemetry sharing was set to opt-out, and on what legal basis under Article 6.
- That the Inspectorate consider whether the practice complained of extends beyond the complainant, Tesla having reportedly applied the same remote entitlement change to a substantial number of other vehicles.
- That the complainant be informed of the progress and outcome of the complaint under Article 77(2).
I confirm that the information given in this complaint is true and complete to the best of my knowledge, and that I have attempted to resolve the matter directly with the controller. — Bartosz Hernas, 3 August 2026, signed digitally (ID-card / Mobiil-ID)
Reproduced verbatim from the complaint as lodged. The sections setting out my contact details, the chronology, the five requested items and the annex list are omitted here — my home address and telephone number are redacted throughout, and the rest is already set out in <a href="#privacy">section 11</a> and <a href="#deadline">section 15</a>. Twelve annexes were filed with it, including the complete email thread.
Two things in the filing have not appeared on this page before, and both came out of assembling the evidence. First: the notification I received at 23:00 UTC on 8 April was not sent to me alone. An identical one went out twenty-three seconds later, for a different car, to another address of mine. Whatever made that decision was working through a list. Second: on 25 June — the same day the privacy team told me my vehicle data isn’t linked to my identity — Tesla’s Warsaw service centre wrote to me that “the block was imposed centrally and is software-based, for safety reasons, after detection of modification of FSD systems.” One Tesla department describing plainly what another was denying.
17Spain: no email, no notice, months after the wave
A second owner, in Spain, who bought Full Self-Driving outright — €7,500, lifetime. His car has stopped braking for red lights and stop signs too. What is different is how he found out: he was not told at all. No email, no notification in the car. He noticed the car sailing through traffic lights, went looking, and found the option gone from the Autopilot settings and absent from the car’s own manuals — “like never existed”. And it did not happen in April: in his words, “it happened recently, not months ago like the ‘wave’.”
What led him to look started with a noisy boot. He booked a service appointment for it, and the agent messaging him asked — unprompted, for a trunk repair — whether he had made any vehicle modifications, installed a third-party app or monitoring, intervened to install anything in the car, or modified the wiring. He was, in his words, shocked: nobody had asked him that before. He answered honestly. Two things are fitted to his car: a set of S3XY stalks — his Model 3 Highland ships without stalks — and a modification to drive with hands only, for reduced mobility. Both registered and road-legal for more than two years. Tesla’s summary back to him was: “Please remove everything if possible or not legal, to avoid warranty issues.”
Then more than an hour on the phone with the service manager for his area, which produced “I don’t know” and “I don’t have this information” — while it was plain to him that the manager knew more and would not say it. He was sent a link to a Tesla page with nothing relevant on it, called back, and booked into another service centre. The theory eventually offered was that because fitting S3XY stalks is illegal, it voids the warranty, and so Autopilot was disabled — and that a future update would give it back. That last promise is the sentence I was given in April, and the one Korean owners were given before the flag went off and on inside twenty minutes — section 14. What nobody will give him is a list. His phrase for it: a “secret” cherry pick.
“I have no mail, no notifications… nothing. The function just vanished and that’s it, silently.”
A second owner, €7,500 of lifetime FSD, gone with no email and no notification at all — and not in the April wave. Tesla blamed stalks fitted to a car that ships without them.Read in full
The guy who was typing me said: Did I made any vehicle modifications? Have you got a third party app or monitoring? Did you made any intervention to install something to the car? Did you modified the wiring?
I was shock. They never asked me that and they was saying all the time. And just for a trunk noisy service.
I said the S3XY stalks (model 3 highland stalkless). And a modification to drive with hands only (reduced mobility). All registered and legal for over 2 years.
The summary is: Please remove everything if possible or not legal, to avoid warranty issues.
I have no mail, no notifications… nothing. The function just vanished and that’s it, silently. Even in the car manuals it’s not appearing, like never existed.
And it happened recently. Not months ago like the “wave”.
Basically he said that is it possible that, because installing s3xy stalks it’s illegal, voids my warranty and they disabled the autopilot, and soon in new updates they’ll give me that back.
My car is adapted to a reduced mobility person so it’s not a choice and was fully homologated over 2 years ago.
So angry right now, they are not giving me details, list of what is banned or not, what’s wrong or not, it’s a “secret” cherry pick and it happened. They don’t know anything, poor guys.
It’s so annoying, I’m worried about if they remove functions silently what’s next? Remove automatic brake collision?
Three things here are worse than my own case. A set of stalks fitted to a stalkless car cannot switch Full Self-Driving on — whatever was matched, it was not an unlock. He received no notification of any kind; I at least got an email at two in the morning. And it happened recently, not in the April sweep — which means this is not a historical episode being cleaned up but a practice still running. He has since sent Tesla a long written complaint about the silent removal, about having paid for the feature, and about customers being treated differently from one another, and says he will ask for a refund if nothing is resolved. His own worry goes further than his car: if features paid for can be removed silently, what stops automatic emergency braking being next?
This is another owner’s account of another owner’s car. I have not sat in it and I am not the source. It is published with his permission, with his identity and location withheld at his request, and his messages are reproduced as written. Tesla could confirm or deny the reason given to him in one sentence.