For other owners

Requesting your data from Tesla after FSD was remotely disabled

A template for owners whose paid Autopilot or Full Self-Driving functionality was remotely disabled after Tesla reported detecting an “unauthorized third-party device”.

Anyone may copy, adapt and republish this. It is not legal advice.

Read this first — five things learned the hard way

1. The portal export is not a GDPR response. Requesting your data from your Tesla Account gives you a standard archive. Tesla may then treat your access request as “fulfilled”. It is not the same as an Article 15 request made in writing to [email protected], and it does not contain the records that explain why your features were switched off. Do both: click the portal button and send the email below.

2. There appears to be a rolling window of roughly 60 days. In one documented case the portal export covered exactly the 60 days ending on the date of the request — no more. If your features were disabled more than about two months ago, the telemetry from that day may already be outside what Tesla will export to you. This is why the preservation paragraph is the most important part of the letter, and why you should send it today rather than next month.

3. Ask Tesla to preserve the data before you argue about anything else. You can dispute scope later. You cannot un-delete.

4. Keep the notification email. The archive Tesla sends is password-protected and the password — the “Access Code” — appears only in the “Your Data is Ready for Download” email. The download link expires after 14 days. Save the archive somewhere permanent the day it arrives, and record a checksum of it:

Recording a checksum

# macOS / Linux
shasum -a 256 "yourfile.zip"

# Windows (PowerShell)
Get-FileHash "yourfile.zip" -Algorithm SHA256

Keep that value with the file. If the data ever matters in a dispute, being able to show the file has not been altered since you received it is worth a great deal.

5. Keep every service chat. The in-app service conversation is often where Tesla staff state plainly what was done and by whom. In one case the exported communication logs contained Tesla writing “The detection is reliable and we do not have any reason to question the decision” — which speaks directly to whether any human ever reviewed the decision. Screenshot your chats as you go; do not rely on the app keeping them.

The email

Send to [email protected]. Replace everything in [SQUARE BRACKETS] — they are highlighted below so none slip through. Delete any paragraph that does not apply to you.

To: [email protected]Data subject access request under Articles 15 and 22 GDPR — VIN [YOUR VIN]

Dear Tesla Data Protection Office,

I am the owner of the vehicle below and the data subject in respect of the data associated with my Tesla Account. I make the following request under Regulation (EU) 2016/679 (GDPR).

Name: [FULL NAME]
Tesla Account email: [EMAIL ON THE ACCOUNT]
Vehicle: [MODEL], VIN [VIN]
Country of residence: [COUNTRY]

Background. On or around [DATE], Full Self-Driving and/or other driver assistance functionality on my vehicle was remotely disabled. I received a notification stating that my vehicle had “detected an unauthorized third-party device”. I did not consent to the removal of functionality I had purchased, and I have received no explanation of the data or reasoning behind that decision.

1. Preservation

Before anything else: please preserve, and do not delete, alter or allow to be overwritten by any routine retention process, all data relating to VIN [VIN] for the period [ONE MONTH BEFORE THE DATE] to [ONE MONTH AFTER THE DATE], and all records relating to the decision to disable functionality on my vehicle. Please confirm in writing that this has been done. I am aware that your customer-facing export appears to cover only a limited recent period, and I ask you to distinguish clearly between what your export tool produces and what Tesla actually retains.

2. Data requested

Please provide a copy of the following personal data (Article 15(1) and 15(3)):

All telemetry, diagnostic and event data recorded, transmitted or held in respect of VIN [VIN] that Tesla used, referenced or relied upon to detect the alleged unauthorised third-party device, and to disable functionality.
The specific date(s) and time(s) at which that data was collected, transmitted to Tesla, and processed for that purpose.
All records of the change itself: the entitlement, licence, configuration or feature-flag records for my vehicle before and after the change, and the log of the change being applied.
In particular, the recorded values for the following signals for the period at 1 above — these are the field names Tesla itself uses in its customer data exports:

State of Self-Driving features
Driver Monitoring Detection for Self-Driving features
UI Setting - Autosteer and UI Setting - Navigate on Autosteer
Bluetooth Device 0 Status, and the equivalent fields for devices 1 to 3

Any internal ticket, case, work order, engineering record or communication concerning my vehicle and this decision, including who authorised it.
All service communications concerning my vehicle, including in-app messages, SMS and email logs.

3. Information requested

Please also provide, under Article 15(1):

(c) the recipients or categories of recipients to whom this data has been or will be disclosed, including any recipient outside the EU/EEA;
(d) the retention period applied to each category of data at 2 above, and confirmation of whether each is still held;
(h) the existence of automated decision-making, and meaningful information about the logic involved, together with the significance and envisaged consequences for me.

On the last point, I am aware of the judgment of the Court of Justice in Case C-203/22 (CK v Dun & Bradstreet Austria, 27 February 2025), in which the Court held that Article 15(1)(h) requires the controller to explain the procedure and principles actually applied to reach the specific result, in a concise and intelligible form, and that a claim of trade secrecy does not justify a blanket refusal.

4. Automated decision-making — Article 22

The disablement appears to have been an automated decision that significantly affects me: I have permanently lost functionality I paid [AMOUNT] for, with no refund and no restoration. I therefore request, under Article 22(3):

Human intervention — a review of this decision by a person with authority to reverse it, not a restatement of the outcome;
The opportunity to express my point of view, which I do by this letter;
The means to contest the decision.

Please also state which condition in Article 22(2) Tesla relies upon in taking the decision, and identify the specific criteria by which a device is classified as “unauthorised”.

5. Questions about your export process

Is the period covered by your customer data export a retention period, or only a limit on what the export tool produces?
If it is only an export limit, what is the actual retention period for vehicle telemetry associated with a VIN, and how do I obtain data older than the export window?
By what technical means was the alleged third-party device detected, and via which signal or data channel?

6. Deadline and formalities

I look forward to your response within one month, as required by Article 12(3). If you consider an extension necessary, please note that Article 12(3) requires you to inform me of that extension and of the reasons for it within that same one-month period, and to state the specific date by which you will respond. An extension notified after the month has expired is not effective.

If you decline any part of this request, Article 12(4) requires you to inform me of the reasons, and of my right to lodge a complaint with a supervisory authority and to seek a judicial remedy.

Please provide the data in a commonly used electronic format under Article 15(3). Please confirm receipt of this request and the date from which you are calculating the one-month period.

I reserve my rights under Articles 77 and 79 GDPR.

Yours faithfully, [FULL NAME] [DATE]

After you send it

Diary the deadline. One month from the day you send it. Put it in your calendar now.

If nothing arrives within a month, send one short chaser stating that the period has expired and that you will complain to your data protection authority if you do not receive a substantive response. Keep it to three sentences.

If Tesla claims two extra months, check the date their notice arrived. The extension is only effective if notified within the first month, with reasons. “Your request has been submitted across several departments” describes Tesla’s internal routing, not the complexity of your request — you are entitled to say so and to demand a specific date.

If Tesla says the request is “fulfilled” because you were sent the standard portal export, reply that the export does not contain the records at section 2 and ask, item by item, whether each is held. If Tesla says data is not linked to your identity “by default”, note that the export you received is stamped with your VIN on every row, and that Tesla’s own explanatory document lists “a raised hardware or software issue” among the conditions that cause data to be linked to your account.

Complaining to your regulator. You may complain to the data protection authority of the country where you live (Article 77). Tesla’s main EU establishment is in the Netherlands, so the Dutch Autoriteit Persoonsgegevens is the lead authority, but you do not need to go there directly — your own national authority will coordinate. Most authorities require that you tried the controller first, so keep the full correspondence. Filing is free.

A note on tone. Understandable frustration is not an argument. Keep your letters short, factual and dated, and let the record do the work — a regulator reading a calm chronology alongside an evasive reply reaches the obvious conclusion without being told.

This template describes one owner’s experience and the questions it produced. It is not legal advice, and nothing in it should be taken as a finding about Tesla’s conduct. If money or a vehicle’s value is at stake, consult a lawyer in your own jurisdiction — data protection law can get you the explanation and the records, but compensation and restoration of functionality are matters of contract and consumer law.

← Back to the article