Tesla se llevó lo que pagué

Thank you for your reply. With respect, it does not answer any of the questions I raised, and several of its statements are either factually incorrect or contradict Tesla’s own instructions to me. Let me address each point.

Y las preguntas que siguen sin respuesta:

• The exact warranty clause that excludes this fault from coverage.
• Who authorised the remote disablement, on what documented evidence, and on what legal basis.
• What the “unauthorized third-party device” was — make, model, log entry, and timestamp.
• The specific safety risk the device is alleged to have created, with documentation.
• The date by which the paid features will be restored, and the formal appeals process.
• The compensation Tesla will provide for the period the paid features were disabled.

I reiterate my request for a written response addressing each point within 14 days. Absent that, I will treat this as Tesla’s final refusal and escalate to the relevant consumer-protection and data-protection authorities. — Bartosz Hernas

I would like to reiterate that I would also like to have any telemetry data you used to deny my warranty claims.

My car has the Full Self-Driving package purchased, and this package has been illegally disabled by a remote configuration change — in effect tricking the car into thinking FSD had never been purchased.

I have lost legally available, previously working functionality: Traffic Light Awareness on Autopilot. This was part of a €6,200 extra payment. It was remotely disabled, with no refund.

Your reasoning was that your telemetry discovered a third-party device — even though on the day it was disabled I had telemetry opt-out enabled in my car. I would therefore like all the data associated with that telemetry.

I would also like to know whether the Tesla cars you sell are owned by their owners (me), or whether they are rented/subscribed to but owned by Tesla. If I own the car, I would like Tesla not to tell me what I can and cannot do with a car I paid full price for.

I want to ensure there are no future violations of my privacy: please remove all telemetry data sent from my cars to your servers, and ensure no future telemetry data is sent out, on all cars of which I am the owner.

I need this data to follow up on the loss of value of the car following the remote bricking of legal functionality, and Tesla’s full denial of my warranty claim to restore the car to full functionality.

Thank you for your response of 25 June 2026. I am writing to dispute the completeness of my access request and to make a further, specific request under Articles 15 and 22 of the GDPR.

Your response states that Tesla does not associate vehicle data generated by driving with my identity or account “by default,” and that linkage only occurs when a specific condition is triggered — including “a raised hardware or software issue” or “your consent.”

This is directly contradicted by Tesla’s own prior written communication to me, in which Tesla stated that an unauthorised device was detected in my vehicle and that Full Self-Driving was consequently disabled. That detection and that decision necessarily relied on vehicle telemetry linked to my specific VIN and account. By your own framework, this is exactly the kind of “specific condition” that triggers linkage — meaning the underlying data exists, is associated with my identity, and falls squarely within the scope of my access request.

Los datos que solicité, y que no se facilitaron:

• All telemetry, diagnostic, and event data from my vehicle (VIN XP7YGCEK9SB621959) that Tesla used, referenced, or relied upon to detect the alleged unauthorised device and to disable functionality. This is personal data under Article 4(1).
• The specific date(s) and time(s) this data was collected and processed.
• Under Article 15(1)(h) and Article 22, meaningful information about the logic involved in the automated decision to disable functionality, including the criteria used to classify a device as “unauthorised.”
• Under Article 15(1)(c), the recipients or categories of recipients to whom this data has been or will be disclosed.
• Under Article 15(1)(d), the retention period applied to this category of data, and confirmation of whether it is still held.

Article 15 does not permit a controller to withhold data on the basis that it is “not provided by default.” Where data has in fact been linked to my identity and used to make a decision affecting me, it is personal data and must be disclosed. If Tesla maintains that any of the requested data is not held, I request a clear statement to that effect for each item, together with the legal basis. — Bartosz Hernas

For the attention of Tesla Resolutions / Tesla International B.V.

Dear Sir or Madam,

I am writing to make a formal complaint and a formal demand for the restoration of functionality I paid for and own, together with reimbursement, compensation, and written answers to the specific questions set out below. This follows my earlier correspondence, which remains substantively unanswered.

1. What I paid for and what happened

I purchased a 2025 Model Y with the Full Self-Driving Capability package for €6,200 plus VAT, paid in full. That package — expressly including Traffic Light and Stop Sign Control — worked reliably for months after delivery. On 8 April 2026 at 22:27, a remote Tesla Cloud Config update reset my vehicle to its “original configuration,” removing features I had paid for, including the automatic stopping at red lights and stop signs. Roughly three hours later I received an email citing an “unauthorized third-party device,” naming no device, specifying no risk, and giving no timeframe for restoration. To this day, the Tesla app and the car’s own settings still list the Full Self-Driving package as “Included.”

2. Why the disablement is unlawful and unjustified

The use of third-party equipment for vehicle diagnostics and maintenance falls within the framework established by Article 61 of Regulation (EU) 2018/858. The concept of an “unauthorized third-party device” has no basis in that regulatory framework and cannot lawfully be used to determine what equipment an owner may connect to a vehicle they own outright. The devices I used are standard CANBUS diagnostic tools that modify no hardware, no component, and no software — they send only commands the vehicle already supports, through the manufacturer’s own diagnostic interface. No safety system, in hardware or software, was modified in any way.

The claim that such equipment could “potentially interfere with” Full Self-Driving does not justify remotely and unilaterally disabling features that were previously working normally. The result is paradoxical: since the intervention, my vehicle no longer stops automatically at red lights or stop signs, so presenting the removal of these features as a “safety measure” is untenable — the car is now demonstrably less safe than before. If Tesla had a genuine concern, I could simply have been asked to disconnect the device. I have now removed it. The features have still not been restored.

Since the features were disabled remotely, they can plainly be re-enabled remotely. Referring to “a future software update” under which features “may” be re-enabled guarantees neither full restoration nor any reasonable timeframe. Meanwhile, Full Self-Driving is now approved on public roads in Estonia, where my car is registered (from 29 May 2026), so I am now blocked from using a feature that is both paid for and legal.

3. Warranty

The vehicle is under warranty. Service centres in Turku (Finland) and Warsaw (Poland) each confirmed that the features do not work and that the car is under warranty, yet each refused to remedy the fault. Under EU consumer law the warranty attaches to the vehicle and transfers with it; it is not extinguished by a change of registered owner, and no site visit that Tesla itself declined to perform can be cited as a reason not to address this.

4. Questions requiring a written answer

The following questions have been put to Tesla and its service centres and remain unanswered. I require a specific written response to each.

The decision to disable:

• (i) Who authorised the remote disablement of the paid entitlement, by name or role, and on what documented evidence?
• (ii) Was the decision automatic or made manually by a person? If automatic, what specific trigger or rule caused it?
• (iii) On what legal basis does Tesla remotely disable functionality a customer has already paid for?

The detection:

• (iv) What exactly was the “unauthorized third-party device”? Provide its make and model.
• (v) Provide the specific log entries, telemetry, and timestamp that led to the detection.
• (vi) The vehicle had telemetry sharing disabled on the relevant date; explain how detection occurred and what data was transmitted, when, and under what legal basis.

The notification and the question of responsibility:

• (vii) How, and through what channel, was the owner contacted before — rather than after — the entitlement was removed?
• (viii) Tesla took no step to establish whether the registered owner installed or was even aware of any device. What process, if any, does Tesla follow to establish responsibility before penalising the owner, given that a device could be fitted by a previous keeper, an intermediary, a workshop, or a third party without the owner’s knowledge?
• (ix) On what basis does Tesla consider it proportionate to strip a paid entitlement rather than simply request that the device be removed — which I would have done, and have now done?

The “authorization” of devices:

• (x) Who at Tesla decides whether a third-party device is “authorized” or “unauthorized,” and by what published criteria?
• (xi) Is there a published list of approved and prohibited devices? If so, provide it; if not, explain how an owner is expected to know in advance.
• (xii) Does Tesla consider a standard CANBUS diagnostic device, used through the manufacturer’s own diagnostic port, “unauthorized”? If so, state that policy publicly.

The “safety reasons”:

• (xiii) Identify the specific safety risk the device is alleged to have created, with supporting documentation.
• (xiv) Explain how disabling stop-sign and traffic-light recognition — leaving the car unable to stop automatically at red lights — improves safety.

Warranty and restoration:

• (xv) State, in writing, the exact warranty clause relied upon to exclude this fault from coverage.
• (xvi) The device has been removed and no third-party device is now present — what is the remaining obstacle to restoration, and by what date will the features be restored?
• (xvii) What is the formal appeals process, and how do I begin it?

Scope of remote control:

• (xviii) What else can Tesla disable remotely on a vehicle an owner has paid for in full — could I lose app access, heated seats, charging, or other functions over a third-party part Tesla disapproves of? Where is this disclosed before purchase?

5. What I require

• (a) Immediate restoration of the full Full Self-Driving Capability package to my vehicle, given that the device concerned has been removed and no third-party device is now present.
• (b) A specific, dated commitment for that restoration — not a conditional reference to an unspecified future update.
• (c) Reimbursement for loss of use. Tesla’s own published subscription price for this functionality is approximately €99 per month. On that basis, the value of the functionality withheld from 8 April 2026 to the date of this letter (15 July 2026, 98 days) is approximately €319, increasing by approximately €99 for each further month until full restoration. I require reimbursement on this basis for the entire period of deprivation.

(d) Compensation for damages, in addition to (c). Separately from loss-of-use reimbursement, I require compensation for:

• (i) Diminution in value of the vehicle resulting from the remote removal of a paid, functioning package. The package was purchased for €6,200 + VAT; a vehicle whose paid features can be, and have been, remotely revoked is worth materially less than one where they cannot. I reserve the right to quantify this by independent valuation, but put its floor at the unamortised value of the package.
• (ii) Loss of a safety-relevant function — automatic stopping at red lights and stop signs — over a period now exceeding three months.
• (iii) Time, effort and costs incurred pursuing a matter Tesla can resolve with a single remote configuration change.

I invite Tesla to propose a figure for (d); failing agreement, it will be quantified with supporting evidence in any subsequent proceedings.

• (e) If the Service Centre does not have the means to resolve this, direct contact from a person at Tesla with the authority to re-enable the functionality, together with the identity of the department responsible.

6. Timeframe

Please provide a written response addressing each numbered question and each lettered requirement within 14 days of this email. Absent a substantive response, I will treat this as Tesla’s final refusal and escalate to the competent consumer-protection and data-protection authorities, and pursue the matter further as advised. To my knowledge, several hundred European owners are affected by the same practice.

This complaint, and Tesla’s responses to date, form part of a documented public record at TeslaTookWhatIPaidFor.com.

Yours faithfully, Bartosz Hernas — Tesla shareholder, Owner of 2025 Tesla Model Y · VIN XP7YGCEK9SB621959

I refer to my email of 1 July 2026 (your reference J27NGDL), to which I have received no response.

That email set out five specific items requested under Articles 15 and 22 GDPR, none of which have been answered. Under Article 12(3) your response was due within one month, i.e. by 1 August 2026. No extension has been notified to me at any point, so no extension under Article 12(3) is available to Tesla.

I also note that your reply of 25 June 2026 did not inform me of my right to lodge a complaint with a supervisory authority or to seek a judicial remedy, as required by Article 12(4).

If I do not receive a substantive response to each of the five items by 1 August 2026, I will lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) under Article 77 GDPR, for onward handling with the Autoriteit Persoonsgegevens as Tesla’s lead supervisory authority.

For the avoidance of doubt, a restatement of your general Privacy Notice will not be treated as a response. If Tesla holds none of the requested data, I require a clear statement to that effect for each of the five items individually, together with the legal basis relied upon.

Thank you for your email of 31 July 2026. I note that you now require two further months under Article 12(3) GDPR. My position on that is as follows.

1. Scope of the extension

Items 1 and 2 of my email of 1 July 2026 — the telemetry, diagnostic and event data relied upon to detect the alleged unauthorised device and to disable Full Self-Driving, and the dates and times on which that data was collected and processed — were already expressly requested in my email of 1 June 2026. In respect of those items the one-month period under Article 12(3) expired on 1 July 2026 and no extension was notified within it. An extension cannot be applied retrospectively to a period that has already expired. I therefore do not accept that the extension operates in respect of items 1 and 2, and I require those items now. As to items 3 to 5, which were first raised on 1 July 2026, I accept that your notice of 31 July 2026 was given in time.

2. A specific date

Your email gives no date. Please confirm in writing the precise date by which you will respond, and the date of receipt from which you are calculating the extension.

3. Reasons for the delay

Article 12(3) requires you to inform me of the reasons for the delay. That my inquiry “has been submitted across several departments” and that you are “reconciling those requests” describes Tesla’s internal routing, not the complexity or number of my requests. If Tesla maintains that the request is complex within the meaning of Article 12(3), please state the specific reasons.

4. Applicable law

For the avoidance of doubt, the applicable instrument is Regulation (EU) 2016/679, not “local regulations”. Tesla International B.V. is the controller and the extension available is that in the second sentence of Article 12(3).

5. Your position of 25 June 2026

You informed me on 25 June 2026 that my access request “was fulfilled on 01/06/2026”. That is inconsistent with now requiring three months in total to answer it. Please confirm whether Tesla withdraws the statement that the request was fulfilled.

6. Right to complain

Your response of 25 June 2026 declined to provide the data requested but did not inform me of the reasons for not acting, of my right to lodge a complaint with a supervisory authority, or of my right to seek a judicial remedy, as Article 12(4) requires. I note that failure.

I reserve all rights, including the right to lodge a complaint under Article 77 GDPR and to seek a judicial remedy under Article 79, and I am proceeding on that basis in parallel with this correspondence. — Bartosz Hernas

Summary of the complaint

On 1 June 2026 the complainant made a request under Article 15 GDPR for, among other things, the telemetry, diagnostic and event data that Tesla relied upon when it remotely disabled Full Self-Driving functionality on the complainant’s vehicle — functionality purchased for EUR 6,200 — on the stated ground that an unauthorised third-party device had been detected. Tesla supplied only a standard account-data export, which contained none of that data.

On 25 June 2026 Tesla asserted that the request had been “fulfilled on 01/06/2026” and that vehicle data is not associated with the complainant’s identity “by default”. That position is irreconcilable with Tesla’s own conduct. A remote decision to disable a specific feature on a specific VIN, taken because of what Tesla says its systems detected in that vehicle, necessarily involved personal data linked to the complainant. Tesla’s own reply lists “a raised hardware or software issue” as a condition that triggers precisely such linkage. That reply also declined the request without informing the complainant of his right to complain to a supervisory authority or to seek a judicial remedy.

On 1 July 2026 the complainant set out five specific items under Articles 15 and 22 GDPR. On 31 July 2026 Tesla stated that it requires two further months. This complaint is nevertheless lodged now, because the infringements are already complete and do not depend on the outcome of the extension.

The controller’s own notifications

The notification is itself proof of linkage. Tesla could not have generated and sent the email of 8 April 2026 unless the detection event had been transmitted from the vehicle to Tesla and associated there with the complainant’s account and email address. Tesla’s statement of 25 June 2026 that “no one – including Tesla – would have knowledge of your activities” cannot stand alongside a notification that Tesla itself sent to him about an event in his vehicle.

A second Tesla department describes a centrally imposed decision. On 25 June 2026, the same day as the privacy response, Tesla’s Warsaw service centre wrote to the complainant in Polish that “Blokada została nałożona odgórnie i jest software’owa, z powodów bezpieczeństwa po wykryciu modyfikacji systemów FSD” — “the block was imposed centrally and is software-based, for safety reasons, after detection of modification of FSD systems”. A block imposed centrally by Tesla following detection is a decision taken by the controller on the basis of vehicle data attributed to this vehicle and this account. It is not an autonomous act of the car, as the wording “your vehicle has detected” implies.

The notifications were dispatched in bulk. An identical notification was sent twenty-three seconds later, at 23:00:23 UTC on 8 April 2026, in respect of a different vehicle, to a further email address controlled by the complainant. The complainant advances no claim in respect of that vehicle or its owner and refers to it only as evidence that these notifications, and the disablements they announced, were dispatched as an automated bulk action rather than following any individual assessment of the vehicle concerned.

Infringements alleged

Article 12(4) — failure to inform of remedies. Tesla’s reply of 25 June 2026 declined to provide the data requested but did not inform the complainant of the reasons for not acting, of the possibility of lodging a complaint with a supervisory authority, or of seeking a judicial remedy. This infringement is complete and is unaffected by the extension of 31 July 2026.

Article 15(1) and 15(3) — incomplete access, and an untenable ground for withholding. A generic account-data export was supplied in place of the personal data actually identified in the request, and Tesla declared the request “fulfilled”. Data that has in fact been linked to the complainant and used to take a decision affecting him is personal data within Article 4(1) and cannot be withheld on the ground that linkage does not occur “by default”.

Article 12(3) — failure to respond within one month as to items 1 and 2. The telemetry data and the dates and times of its processing fell due on 1 July 2026. No extension was notified within that period. These items remain outstanding.

Article 15(1)(c), (d) and (h) — failure to supply required accompanying information. Recipients, retention period, and information on the logic of the automated decision were all requested and none has been provided.

Article 22 — automated decision-making. The disablement appears to have been an automated decision producing a significant effect on the complainant (loss of paid functionality valued at EUR 6,200, with no refund and no restoration under warranty). Tesla has provided no information about the logic applied and no meaningful route to human intervention or to contest the decision. The bulk dispatch of identical notifications seconds apart in respect of different vehicles indicates that no individual human assessment preceded the decision.

Article 12(1) and 12(2) — failure to facilitate the exercise of rights. Tesla’s substantive reply restated its general Privacy Notice and redirected the complainant to Customer Support rather than answering the request. Tesla has since attributed the delay to the request having been spread across its own departments, having itself directed the complainant to a further department.

Article 17 — no response to the erasure request. The request of 1 June 2026 for erasure of telemetry data and cessation of further transmission has never been addressed in any reply.

Action requested

• That the Inspectorate register this complaint and investigate it, in cooperation with the Autoriteit Persoonsgegevens under Article 60 GDPR.
• That the Inspectorate find the infringement of Article 12(4) in respect of the response of 25 June 2026, which does not depend on the extension.
• That the Inspectorate order Tesla under Article 58(2)(c) to comply forthwith as to items 1 and 2, which fell due on 1 July 2026.
• That the Inspectorate require Tesla to state, in writing and to the complainant, the specific date by which it will respond and the reasons for the delay required by Article 12(3).
• That, if Tesla has not fully answered items 3 to 5 by the expiry of the extended period, the Inspectorate proceed on those items without requiring a fresh complaint.
• That the Inspectorate require Tesla to provide the information owed under Article 15(1)(h) and Article 22 concerning the logic and criteria of the automated decision to disable purchased functionality.
• That the Inspectorate examine whether Tesla processed vehicle telemetry from the complainant’s vehicle at a time when telemetry sharing was set to opt-out, and on what legal basis under Article 6.
• That the Inspectorate consider whether the practice complained of extends beyond the complainant, Tesla having reportedly applied the same remote entitlement change to a substantial number of other vehicles.
• That the complainant be informed of the progress and outcome of the complaint under Article 77(2).

I confirm that the information given in this complaint is true and complete to the best of my knowledge, and that I have attempted to resolve the matter directly with the controller. — Bartosz Hernas, 3 August 2026, signed digitally (ID-card / Mobiil-ID)

To Tesla Privacy, Resolutions, EU Customer Happiness, and Legal teams,

I am the registered first owner of a Tesla Model Y, VIN XP7YGCEK9SB621959, registered on 05.05.2025, equipped with Full Self-Driving (FSD).

My vehicle was purchased through an Estonian intermediary, rather than directly from Tesla or through a lease/financing arrangement with an Estonian bank. As a result, I have never been presented with, signed, or explicitly accepted any Tesla Motor Vehicle Order Agreement, Terms of Service, or FSD-specific purchase agreement. My understanding of any contractual relationship with Tesla is based solely on Tesla’s general assertion that use of the vehicle constitutes acceptance of unspecified terms.

Given that Tesla has disabled the FSD functionality on my vehicle, I am requesting that you provide me directly with:

• 1. The specific, complete Terms of Service, Motor Vehicle Order Agreement, and/or FSD Purchase/License Agreement that Tesla contends governs my relationship with Tesla as the first registered owner and end user of this vehicle;
• 2. Confirmation of the legal basis on which Tesla asserts these terms apply to me, given that I did not purchase the vehicle directly from Tesla nor sign any agreement with Tesla or a Tesla-affiliated financing entity;
• 3. The version of the FSD terms that was in effect at the time of vehicle registration (05.05.2025), together with any documentation showing how or when I was notified of, or deemed to have accepted, those terms;
• 4. Confirmation of whether any different or additional terms apply because the vehicle was acquired through a third-party intermediary rather than directly from Tesla;
• 5. The specific clause(s) of the Terms of Service Tesla is relying on to justify remotely disabling FSD functionality that I paid for and had active on my vehicle;
• 6. The specific clause(s) of the Terms of Service Tesla is relying on to decline to respond substantively to my prior contact attempts, and/or to decline a refund for the disabled FSD functionality.

This request also constitutes a request for personal data and related processing information concerning me under Article 15 of the GDPR, insofar as it relates to records of my account, my acceptance (or lack thereof) of any agreement, and any internal records associating me with specific contractual terms. Under Article 12(3) GDPR, I expect a substantive response without undue delay and in any event within one month of the date of this email — i.e., by 11 September 2026. If Tesla considers this request complex and intends to invoke the further two-month extension permitted under Article 12(3), please notify me of that fact, and the reasons for it, within the initial one-month period.

Please provide the actual requested documents rather than a general link to Tesla’s public website, since those pages are subject to change and do not establish what applied to me at the relevant time.

For context, I am documenting this dispute publicly at TeslaTookWhatIPaidFor.com, which covers the remote disablement of FSD functionality I purchased. This correspondence, including Tesla’s response or lack thereof, will be published there as part of that record. I am not asking for anything beyond clarity on which specific terms Tesla is relying on: I simply want to know which Terms of Service Tesla is invoking to (a) remotely disable FSD I paid for, and (b) avoid responding to or refunding affected customers.

I look forward to your response within the timeline set out above.

Regards, Bartosz Hernas — [email protected] · VIN XP7YGCEK9SB621959

I confirm that following your last message the Full Self-Driving Capability package has been restored to my vehicle. Thank you.

The restoration is welcome, but it also settles the central point of my complaint: the functionality was Tesla’s to restore at any time, by remote configuration, and was restored once challenged. That confirms it was withdrawn unilaterally and could have been reinstated at any point during the period it was withheld. Restoration therefore resolves the feature, but not the complaint. Two matters remain outstanding, and your last message addressed neither.

1. Reimbursement and compensation

From 8 April 2026 until its restoration — a period of over three months — I was deprived of functionality I had paid for in full. In particular, my vehicle lost Traffic Light and Stop Sign Control: it no longer recognised or stopped automatically at red lights and stop signs. This is a safety-relevant driver-assistance function that was working normally before Tesla’s intervention.

Crucially, I was never informed in advance that this feature would be removed. The remote change was applied first, on 8 April 2026 at 22:27, and only afterwards did I receive an email — which itself did not clearly state that stop-sign and traffic-light recognition specifically would cease to function. I was therefore driving a vehicle whose safety behaviour had been silently altered, without notice. That is the basis of my claim: not an abstract inconvenience, but the uncompensated loss of a paid safety function, removed without warning.

I therefore require:

• (a) Reimbursement for loss of use over the full period. Tesla’s own published subscription price for this functionality is approximately €99 per month, and I ask that reimbursement be calculated on that basis for the entire duration of the deprivation.
• (b) Compensation, separately, for the diminution in value of the vehicle caused by the demonstrated fact that paid features can be and were remotely revoked, and for the time and cost incurred in obtaining a restoration Tesla could have performed at any moment. I invite Tesla to propose a figure; failing agreement, it will be quantified with supporting evidence.

2. The “Terms” you rely upon

Your message states that such use “may result in the restriction or disablement of certain features... as set out in our Terms.” Before Tesla relies on any such Terms, I require you to establish that they bind me at all:

• (i) Identify the exact document and the exact clause relied upon.
• (ii) State when, and by what act, I am said to have agreed to those Terms. I did not agree to any term permitting Tesla to remotely disable a paid safety feature, and Tesla has not shown otherwise.
• (iii) State where, before purchase, it was disclosed that paid features could be remotely disabled over the presence of a third-party device.

A clause a customer never agreed to, and was never shown before purchase, cannot be the basis for removing something that customer paid for.

3. The questions that remain unanswered

My previous letter put eighteen specific questions to Tesla. Your reply answered none of them. The following in particular require a written answer, because they concern whether this will recur, to me or to others:

• (iv) Who authorised the disablement of the paid entitlement, and on what documented evidence? Your latest message states that no automated processing occurred — which means a person made this decision. I ask again who, and on what basis.
• (v) What specifically was the detected device (make and model), and what log or telemetry entry, with timestamp, led to its detection?
• (vi) Who at Tesla determines whether a device is “authorized” or “unauthorized,” by what published criteria, and is there a list an owner can consult in advance? Does Tesla regard a standard CANBUS diagnostic tool, used through the manufacturer’s own diagnostic port, as “unauthorized”?
• (vii) What process does Tesla follow to establish whether the registered owner installed or was even aware of a device before penalising that owner — given that a device may be fitted by a previous keeper, an intermediary, or a workshop without the owner’s knowledge?

Your reference to “our Terms” and to “local road authorities” in the abstract is not an answer. I ask you to identify the specific clause and the specific authority relied upon.

Please respond in writing within 14 days. In the absence of a substantive response on reimbursement, compensation, the basis of the Terms, and the questions above, I will treat the matter as unresolved and escalate to the competent consumer-protection authority. This correspondence forms part of a documented public record at TeslaTookWhatIPaidFor.com. — Bartosz Hernas

Further to my last message, I want to record one point that remains entirely unaddressed.

Tesla states that an “unauthorized third-party device” was detected on my vehicle on 8 April 2026, and that Full Self-Driving was disabled as a result. To this day I have not been given the data that detection was based on. Specifically, Tesla has not identified:

• what data was collected from my vehicle;
• what within that data was interpreted as indicating a device;
• the date, time, and source of that data; and
• the logic or criteria by which that data was judged to indicate an “unauthorized” device.

This is not a new request. I first requested this data on 1 June 2026, and reiterated it on 1 July 2026. The one-month period under Article 12(3) in respect of it expired on 1 July 2026, and no extension was validly notified within that period. It is therefore already overdue, independently of the two-month extension Tesla later purported to take for my other items.

Your reply of 31 August 2026 states that “no automated-decision processing was performed.” If that is correct, then a person reviewed specific data linked to my VIN and account and reached a decision — which makes the underlying data plainly my personal data and plainly disclosable under Article 15. If instead the detection was automated, then Article 15(1)(h) and Article 22 entitle me to meaningful information about the logic involved. Either way, the data and the basis for the decision must be disclosed. They have not been.

Tesla cannot both assert that a device was detected via vehicle data and decline to show me the vehicle data said to have detected it. I therefore repeat my request for the specific telemetry, diagnostic, and event data — with timestamps — that Tesla relied upon to conclude a device was present and to disable the feature I paid for. If Tesla maintains it holds no such data, I require a clear statement to that effect, given that Tesla’s own notification asserts the detection occurred.

This remains outstanding and forms part of the complaint already lodged with the Estonian Data Protection Inspectorate.

Following the remote disablement of paid functionality on my vehicle based on data Tesla collected from it, I am exercising my rights under the GDPR in respect of the personal data generated by my vehicle. This letter concerns the future processing of that data; my outstanding access request regarding the detection of 8 April 2026 remains separate and unanswered.

1. What I am asking

I do not consent to my vehicle transmitting to Tesla, or to Tesla processing, any data that identifies me or that can be linked to me, my account, or my vehicle (including by VIN), beyond what is strictly necessary. In particular, I object to the collection or use of any such data for the purpose of monitoring, detecting third-party equipment, or making decisions that restrict or disable features of my vehicle.

2. The rights I am relying on

• (a) Article 21 — I object to the processing of my personal data carried out on the basis of Tesla’s legitimate interests, including any profiling. This specifically includes processing used to detect “unauthorized third-party devices” and to determine whether to restrict or disable features.
• (b) Article 7(3) — to the extent any processing relies on my consent, I withdraw that consent with effect from the date of this letter.
• (c) Article 18 — I request restriction of processing of the relevant data pending your response to my objection and to my outstanding access request.

3. What I require Tesla to confirm in writing

• (i) A complete list of the categories of data transmitted from my vehicle to Tesla, and for each category, the specific legal basis relied upon (consent, contract, legal obligation, or legitimate interest).
• (ii) For each category relied upon as “legitimate interest” or “contract,” a specific explanation of why it is claimed to be strictly necessary, so that I may exercise my objection meaningfully.
• (iii) Which categories of transmission I am able to disable myself (for example via the vehicle’s data-sharing settings), and confirmation of the effect of disabling them.
• (iv) Confirmation that, following my objection, Tesla will cease any processing of my vehicle data for the purpose of detecting third-party equipment or of restricting or disabling paid features — or, if Tesla refuses, a clear statement of the specific lawful basis on which it intends to continue that processing over my objection.
• (v) Confirmation of whether disabling data transmission affects the vehicle’s functionality or any feature I have paid for, and if so, how.

4. Note

I understand that certain limited processing may be necessary for safety recalls, regulatory compliance, or the basic connected operation of the vehicle. I am not asking Tesla to breach a legal obligation. I am asking Tesla to identify precisely which processing it claims is necessary and on what basis, to stop everything that is not, and in particular to stop using my vehicle’s data to make decisions that take away what I have paid for. Where Tesla asserts a basis that overrides my objection, I require that assertion in writing so that it can be assessed by the supervisory authority.

Please respond within one month, as required by Article 12(3). This matter forms part of the complaint already lodged with the Estonian Data Protection Inspectorate. — Bartosz Hernas, owner, 2025 Tesla Model Y · VIN XP7YGCEK9SB621959