Tesla se llevó lo que pagué

Thank you for your reply. With respect, it does not answer any of the questions I raised, and several of its statements are either factually incorrect or contradict Tesla’s own instructions to me. Let me address each point.

Y las preguntas que siguen sin respuesta:

• The exact warranty clause that excludes this fault from coverage.
• Who authorised the remote disablement, on what documented evidence, and on what legal basis.
• What the “unauthorized third-party device” was — make, model, log entry, and timestamp.
• The specific safety risk the device is alleged to have created, with documentation.
• The date by which the paid features will be restored, and the formal appeals process.
• The compensation Tesla will provide for the period the paid features were disabled.

I reiterate my request for a written response addressing each point within 14 days. Absent that, I will treat this as Tesla’s final refusal and escalate to the relevant consumer-protection and data-protection authorities. — Bartosz Hernas

I would like to reiterate that I would also like to have any telemetry data you used to deny my warranty claims.

My car has the Full Self-Driving package purchased, and this package has been illegally disabled by a remote configuration change — in effect tricking the car into thinking FSD had never been purchased.

I have lost legally available, previously working functionality: Traffic Light Awareness on Autopilot. This was part of a €6,200 extra payment. It was remotely disabled, with no refund.

Your reasoning was that your telemetry discovered a third-party device — even though on the day it was disabled I had telemetry opt-out enabled in my car. I would therefore like all the data associated with that telemetry.

I would also like to know whether the Tesla cars you sell are owned by their owners (me), or whether they are rented/subscribed to but owned by Tesla. If I own the car, I would like Tesla not to tell me what I can and cannot do with a car I paid full price for.

I want to ensure there are no future violations of my privacy: please remove all telemetry data sent from my cars to your servers, and ensure no future telemetry data is sent out, on all cars of which I am the owner.

I need this data to follow up on the loss of value of the car following the remote bricking of legal functionality, and Tesla’s full denial of my warranty claim to restore the car to full functionality.

Thank you for your response of 25 June 2026. I am writing to dispute the completeness of my access request and to make a further, specific request under Articles 15 and 22 of the GDPR.

Your response states that Tesla does not associate vehicle data generated by driving with my identity or account “by default,” and that linkage only occurs when a specific condition is triggered — including “a raised hardware or software issue” or “your consent.”

This is directly contradicted by Tesla’s own prior written communication to me, in which Tesla stated that an unauthorised device was detected in my vehicle and that Full Self-Driving was consequently disabled. That detection and that decision necessarily relied on vehicle telemetry linked to my specific VIN and account. By your own framework, this is exactly the kind of “specific condition” that triggers linkage — meaning the underlying data exists, is associated with my identity, and falls squarely within the scope of my access request.

Los datos que solicité, y que no se facilitaron:

• All telemetry, diagnostic, and event data from my vehicle (VIN XP7YGCEK9SB621959) that Tesla used, referenced, or relied upon to detect the alleged unauthorised device and to disable functionality. This is personal data under Article 4(1).
• The specific date(s) and time(s) this data was collected and processed.
• Under Article 15(1)(h) and Article 22, meaningful information about the logic involved in the automated decision to disable functionality, including the criteria used to classify a device as “unauthorised.”
• Under Article 15(1)(c), the recipients or categories of recipients to whom this data has been or will be disclosed.
• Under Article 15(1)(d), the retention period applied to this category of data, and confirmation of whether it is still held.

Article 15 does not permit a controller to withhold data on the basis that it is “not provided by default.” Where data has in fact been linked to my identity and used to make a decision affecting me, it is personal data and must be disclosed. If Tesla maintains that any of the requested data is not held, I request a clear statement to that effect for each item, together with the legal basis. — Bartosz Hernas

For the attention of Tesla Resolutions / Tesla International B.V.

Dear Sir or Madam,

I am writing to make a formal complaint and a formal demand for the restoration of functionality I paid for and own, together with reimbursement, compensation, and written answers to the specific questions set out below. This follows my earlier correspondence, which remains substantively unanswered.

1. What I paid for and what happened

I purchased a 2025 Model Y with the Full Self-Driving Capability package for €6,200 plus VAT, paid in full. That package — expressly including Traffic Light and Stop Sign Control — worked reliably for months after delivery. On 8 April 2026 at 22:27, a remote Tesla Cloud Config update reset my vehicle to its “original configuration,” removing features I had paid for, including the automatic stopping at red lights and stop signs. Roughly three hours later I received an email citing an “unauthorized third-party device,” naming no device, specifying no risk, and giving no timeframe for restoration. To this day, the Tesla app and the car’s own settings still list the Full Self-Driving package as “Included.”

2. Why the disablement is unlawful and unjustified

The use of third-party equipment for vehicle diagnostics and maintenance falls within the framework established by Article 61 of Regulation (EU) 2018/858. The concept of an “unauthorized third-party device” has no basis in that regulatory framework and cannot lawfully be used to determine what equipment an owner may connect to a vehicle they own outright. The devices I used are standard CANBUS diagnostic tools that modify no hardware, no component, and no software — they send only commands the vehicle already supports, through the manufacturer’s own diagnostic interface. No safety system, in hardware or software, was modified in any way.

The claim that such equipment could “potentially interfere with” Full Self-Driving does not justify remotely and unilaterally disabling features that were previously working normally. The result is paradoxical: since the intervention, my vehicle no longer stops automatically at red lights or stop signs, so presenting the removal of these features as a “safety measure” is untenable — the car is now demonstrably less safe than before. If Tesla had a genuine concern, I could simply have been asked to disconnect the device. I have now removed it. The features have still not been restored.

Since the features were disabled remotely, they can plainly be re-enabled remotely. Referring to “a future software update” under which features “may” be re-enabled guarantees neither full restoration nor any reasonable timeframe. Meanwhile, Full Self-Driving is now approved on public roads in Estonia, where my car is registered (from 29 May 2026), so I am now blocked from using a feature that is both paid for and legal.

3. Warranty

The vehicle is under warranty. Service centres in Turku (Finland) and Warsaw (Poland) each confirmed that the features do not work and that the car is under warranty, yet each refused to remedy the fault. Under EU consumer law the warranty attaches to the vehicle and transfers with it; it is not extinguished by a change of registered owner, and no site visit that Tesla itself declined to perform can be cited as a reason not to address this.

4. Questions requiring a written answer

The following questions have been put to Tesla and its service centres and remain unanswered. I require a specific written response to each.

The decision to disable:

• (i) Who authorised the remote disablement of the paid entitlement, by name or role, and on what documented evidence?
• (ii) Was the decision automatic or made manually by a person? If automatic, what specific trigger or rule caused it?
• (iii) On what legal basis does Tesla remotely disable functionality a customer has already paid for?

The detection:

• (iv) What exactly was the “unauthorized third-party device”? Provide its make and model.
• (v) Provide the specific log entries, telemetry, and timestamp that led to the detection.
• (vi) The vehicle had telemetry sharing disabled on the relevant date; explain how detection occurred and what data was transmitted, when, and under what legal basis.

The notification and the question of responsibility:

• (vii) How, and through what channel, was the owner contacted before — rather than after — the entitlement was removed?
• (viii) Tesla took no step to establish whether the registered owner installed or was even aware of any device. What process, if any, does Tesla follow to establish responsibility before penalising the owner, given that a device could be fitted by a previous keeper, an intermediary, a workshop, or a third party without the owner’s knowledge?
• (ix) On what basis does Tesla consider it proportionate to strip a paid entitlement rather than simply request that the device be removed — which I would have done, and have now done?

The “authorization” of devices:

• (x) Who at Tesla decides whether a third-party device is “authorized” or “unauthorized,” and by what published criteria?
• (xi) Is there a published list of approved and prohibited devices? If so, provide it; if not, explain how an owner is expected to know in advance.
• (xii) Does Tesla consider a standard CANBUS diagnostic device, used through the manufacturer’s own diagnostic port, “unauthorized”? If so, state that policy publicly.

The “safety reasons”:

• (xiii) Identify the specific safety risk the device is alleged to have created, with supporting documentation.
• (xiv) Explain how disabling stop-sign and traffic-light recognition — leaving the car unable to stop automatically at red lights — improves safety.

Warranty and restoration:

• (xv) State, in writing, the exact warranty clause relied upon to exclude this fault from coverage.
• (xvi) The device has been removed and no third-party device is now present — what is the remaining obstacle to restoration, and by what date will the features be restored?
• (xvii) What is the formal appeals process, and how do I begin it?

Scope of remote control:

• (xviii) What else can Tesla disable remotely on a vehicle an owner has paid for in full — could I lose app access, heated seats, charging, or other functions over a third-party part Tesla disapproves of? Where is this disclosed before purchase?

5. What I require

• (a) Immediate restoration of the full Full Self-Driving Capability package to my vehicle, given that the device concerned has been removed and no third-party device is now present.
• (b) A specific, dated commitment for that restoration — not a conditional reference to an unspecified future update.
• (c) Reimbursement for loss of use. Tesla’s own published subscription price for this functionality is approximately €99 per month. On that basis, the value of the functionality withheld from 8 April 2026 to the date of this letter (15 July 2026, 98 days) is approximately €319, increasing by approximately €99 for each further month until full restoration. I require reimbursement on this basis for the entire period of deprivation.

(d) Compensation for damages, in addition to (c). Separately from loss-of-use reimbursement, I require compensation for:

• (i) Diminution in value of the vehicle resulting from the remote removal of a paid, functioning package. The package was purchased for €6,200 + VAT; a vehicle whose paid features can be, and have been, remotely revoked is worth materially less than one where they cannot. I reserve the right to quantify this by independent valuation, but put its floor at the unamortised value of the package.
• (ii) Loss of a safety-relevant function — automatic stopping at red lights and stop signs — over a period now exceeding three months.
• (iii) Time, effort and costs incurred pursuing a matter Tesla can resolve with a single remote configuration change.

I invite Tesla to propose a figure for (d); failing agreement, it will be quantified with supporting evidence in any subsequent proceedings.

• (e) If the Service Centre does not have the means to resolve this, direct contact from a person at Tesla with the authority to re-enable the functionality, together with the identity of the department responsible.

6. Timeframe

Please provide a written response addressing each numbered question and each lettered requirement within 14 days of this email. Absent a substantive response, I will treat this as Tesla’s final refusal and escalate to the competent consumer-protection and data-protection authorities, and pursue the matter further as advised. To my knowledge, several hundred European owners are affected by the same practice.

This complaint, and Tesla’s responses to date, form part of a documented public record at TeslaTookWhatIPaidFor.com.

Yours faithfully, Bartosz Hernas — Tesla shareholder, Owner of 2025 Tesla Model Y · VIN XP7YGCEK9SB621959

I refer to my email of 1 July 2026 (your reference J27NGDL), to which I have received no response.

That email set out five specific items requested under Articles 15 and 22 GDPR, none of which have been answered. Under Article 12(3) your response was due within one month, i.e. by 1 August 2026. No extension has been notified to me at any point, so no extension under Article 12(3) is available to Tesla.

I also note that your reply of 25 June 2026 did not inform me of my right to lodge a complaint with a supervisory authority or to seek a judicial remedy, as required by Article 12(4).

If I do not receive a substantive response to each of the five items by 1 August 2026, I will lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) under Article 77 GDPR, for onward handling with the Autoriteit Persoonsgegevens as Tesla’s lead supervisory authority.

For the avoidance of doubt, a restatement of your general Privacy Notice will not be treated as a response. If Tesla holds none of the requested data, I require a clear statement to that effect for each of the five items individually, together with the legal basis relied upon.

Thank you for your email of 31 July 2026. I note that you now require two further months under Article 12(3) GDPR. My position on that is as follows.

1. Scope of the extension

Items 1 and 2 of my email of 1 July 2026 — the telemetry, diagnostic and event data relied upon to detect the alleged unauthorised device and to disable Full Self-Driving, and the dates and times on which that data was collected and processed — were already expressly requested in my email of 1 June 2026. In respect of those items the one-month period under Article 12(3) expired on 1 July 2026 and no extension was notified within it. An extension cannot be applied retrospectively to a period that has already expired. I therefore do not accept that the extension operates in respect of items 1 and 2, and I require those items now. As to items 3 to 5, which were first raised on 1 July 2026, I accept that your notice of 31 July 2026 was given in time.

2. A specific date

Your email gives no date. Please confirm in writing the precise date by which you will respond, and the date of receipt from which you are calculating the extension.

3. Reasons for the delay

Article 12(3) requires you to inform me of the reasons for the delay. That my inquiry “has been submitted across several departments” and that you are “reconciling those requests” describes Tesla’s internal routing, not the complexity or number of my requests. If Tesla maintains that the request is complex within the meaning of Article 12(3), please state the specific reasons.

4. Applicable law

For the avoidance of doubt, the applicable instrument is Regulation (EU) 2016/679, not “local regulations”. Tesla International B.V. is the controller and the extension available is that in the second sentence of Article 12(3).

5. Your position of 25 June 2026

You informed me on 25 June 2026 that my access request “was fulfilled on 01/06/2026”. That is inconsistent with now requiring three months in total to answer it. Please confirm whether Tesla withdraws the statement that the request was fulfilled.

6. Right to complain

Your response of 25 June 2026 declined to provide the data requested but did not inform me of the reasons for not acting, of my right to lodge a complaint with a supervisory authority, or of my right to seek a judicial remedy, as Article 12(4) requires. I note that failure.

I reserve all rights, including the right to lodge a complaint under Article 77 GDPR and to seek a judicial remedy under Article 79, and I am proceeding on that basis in parallel with this correspondence. — Bartosz Hernas

Summary of the complaint

On 1 June 2026 the complainant made a request under Article 15 GDPR for, among other things, the telemetry, diagnostic and event data that Tesla relied upon when it remotely disabled Full Self-Driving functionality on the complainant’s vehicle — functionality purchased for EUR 6,200 — on the stated ground that an unauthorised third-party device had been detected. Tesla supplied only a standard account-data export, which contained none of that data.

On 25 June 2026 Tesla asserted that the request had been “fulfilled on 01/06/2026” and that vehicle data is not associated with the complainant’s identity “by default”. That position is irreconcilable with Tesla’s own conduct. A remote decision to disable a specific feature on a specific VIN, taken because of what Tesla says its systems detected in that vehicle, necessarily involved personal data linked to the complainant. Tesla’s own reply lists “a raised hardware or software issue” as a condition that triggers precisely such linkage. That reply also declined the request without informing the complainant of his right to complain to a supervisory authority or to seek a judicial remedy.

On 1 July 2026 the complainant set out five specific items under Articles 15 and 22 GDPR. On 31 July 2026 Tesla stated that it requires two further months. This complaint is nevertheless lodged now, because the infringements are already complete and do not depend on the outcome of the extension.

The controller’s own notifications

The notification is itself proof of linkage. Tesla could not have generated and sent the email of 8 April 2026 unless the detection event had been transmitted from the vehicle to Tesla and associated there with the complainant’s account and email address. Tesla’s statement of 25 June 2026 that “no one – including Tesla – would have knowledge of your activities” cannot stand alongside a notification that Tesla itself sent to him about an event in his vehicle.

A second Tesla department describes a centrally imposed decision. On 25 June 2026, the same day as the privacy response, Tesla’s Warsaw service centre wrote to the complainant in Polish that “Blokada została nałożona odgórnie i jest software’owa, z powodów bezpieczeństwa po wykryciu modyfikacji systemów FSD” — “the block was imposed centrally and is software-based, for safety reasons, after detection of modification of FSD systems”. A block imposed centrally by Tesla following detection is a decision taken by the controller on the basis of vehicle data attributed to this vehicle and this account. It is not an autonomous act of the car, as the wording “your vehicle has detected” implies.

The notifications were dispatched in bulk. An identical notification was sent twenty-three seconds later, at 23:00:23 UTC on 8 April 2026, in respect of a different vehicle, to a further email address controlled by the complainant. The complainant advances no claim in respect of that vehicle or its owner and refers to it only as evidence that these notifications, and the disablements they announced, were dispatched as an automated bulk action rather than following any individual assessment of the vehicle concerned.

Infringements alleged

Article 12(4) — failure to inform of remedies. Tesla’s reply of 25 June 2026 declined to provide the data requested but did not inform the complainant of the reasons for not acting, of the possibility of lodging a complaint with a supervisory authority, or of seeking a judicial remedy. This infringement is complete and is unaffected by the extension of 31 July 2026.

Article 15(1) and 15(3) — incomplete access, and an untenable ground for withholding. A generic account-data export was supplied in place of the personal data actually identified in the request, and Tesla declared the request “fulfilled”. Data that has in fact been linked to the complainant and used to take a decision affecting him is personal data within Article 4(1) and cannot be withheld on the ground that linkage does not occur “by default”.

Article 12(3) — failure to respond within one month as to items 1 and 2. The telemetry data and the dates and times of its processing fell due on 1 July 2026. No extension was notified within that period. These items remain outstanding.

Article 15(1)(c), (d) and (h) — failure to supply required accompanying information. Recipients, retention period, and information on the logic of the automated decision were all requested and none has been provided.

Article 22 — automated decision-making. The disablement appears to have been an automated decision producing a significant effect on the complainant (loss of paid functionality valued at EUR 6,200, with no refund and no restoration under warranty). Tesla has provided no information about the logic applied and no meaningful route to human intervention or to contest the decision. The bulk dispatch of identical notifications seconds apart in respect of different vehicles indicates that no individual human assessment preceded the decision.

Article 12(1) and 12(2) — failure to facilitate the exercise of rights. Tesla’s substantive reply restated its general Privacy Notice and redirected the complainant to Customer Support rather than answering the request. Tesla has since attributed the delay to the request having been spread across its own departments, having itself directed the complainant to a further department.

Article 17 — no response to the erasure request. The request of 1 June 2026 for erasure of telemetry data and cessation of further transmission has never been addressed in any reply.

Action requested

• That the Inspectorate register this complaint and investigate it, in cooperation with the Autoriteit Persoonsgegevens under Article 60 GDPR.
• That the Inspectorate find the infringement of Article 12(4) in respect of the response of 25 June 2026, which does not depend on the extension.
• That the Inspectorate order Tesla under Article 58(2)(c) to comply forthwith as to items 1 and 2, which fell due on 1 July 2026.
• That the Inspectorate require Tesla to state, in writing and to the complainant, the specific date by which it will respond and the reasons for the delay required by Article 12(3).
• That, if Tesla has not fully answered items 3 to 5 by the expiry of the extended period, the Inspectorate proceed on those items without requiring a fresh complaint.
• That the Inspectorate require Tesla to provide the information owed under Article 15(1)(h) and Article 22 concerning the logic and criteria of the automated decision to disable purchased functionality.
• That the Inspectorate examine whether Tesla processed vehicle telemetry from the complainant’s vehicle at a time when telemetry sharing was set to opt-out, and on what legal basis under Article 6.
• That the Inspectorate consider whether the practice complained of extends beyond the complainant, Tesla having reportedly applied the same remote entitlement change to a substantial number of other vehicles.
• That the complainant be informed of the progress and outcome of the complaint under Article 77(2).

I confirm that the information given in this complaint is true and complete to the best of my knowledge, and that I have attempted to resolve the matter directly with the controller. — Bartosz Hernas, 3 August 2026, signed digitally (ID-card / Mobiil-ID)