Why Big Tech Gatekeepers Cannot Receive Data Under the EU Data Act

The EU Data Act, applicable since 12 September 2025, gives users of connected products the right to have their product data shared with a third party of their choice. There is one notable carve-out: the largest platform companies cannot be that third party. Undertakings designated as gatekeepers under the Digital Markets Act are not eligible recipients of data shared under the Data Act's user-driven sharing right. If you build data-driven services, or if you are a manufacturer fielding access requests, this exclusion changes who can show up at your door.

Where the exclusion comes from

Article 5(3) of the Data Act provides that an undertaking designated as a gatekeeper under Article 3 of the Digital Markets Act is not an eligible third party under the data sharing right. The logic is competition policy: the sharing right exists to open up device data to aftermarket services, insurers, repairers and startups, and the legislator did not want it to become another channel through which the largest ecosystems concentrate data.

The companies currently designated as gatekeepers include Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft, with designations applying to specific core platform services. The list can change over time as the European Commission designates or de-designates undertakings, so it is worth checking the current state before assuming a given entity is in or out.

What gatekeepers cannot do

The exclusion is broader than simply refusing them as recipients. Under the Data Act, a gatekeeper is expected not to:

• solicit or commercially incentivise a user to make data available to it under the sharing right,
• receive such data from a user or from another third party,
• obtain the data indirectly by incentivising another recipient to pass it on.

That last point matters for intermediaries. A data recipient that lawfully receives product data at a user's request is not supposed to route it onward to a gatekeeper, and contracts in the data value chain increasingly say so explicitly.

What gatekeepers can still do

The exclusion is narrower than the headlines sometimes suggest. A gatekeeper that manufactures its own connected devices still holds and uses the data those devices generate, subject to the Act's other rules. Gatekeepers also remain among the largest providers of cloud and data processing services, where the Data Act's switching provisions apply to them like anyone else, including the withdrawal of switching charges expected by 12 January 2027. And nothing stops a user from giving data to a gatekeeper through channels outside the Data Act's sharing right, for example under an ordinary consent-based integration. The exclusion targets the statutory sharing mechanism, not every data flow.

What this means for manufacturers and data holders

If you are a data holder, you may need a screening step in your access request process. When a third party requests data at a user's instruction, checking whether that party is a designated gatekeeper, or is acting for one, is part of handling the request correctly. Germany's implementation act, the DADG, in force since 30 May 2026, makes the Bundesnetzagentur the enforcement authority, with tiered fines of up to EUR 500,000 for Data Act infringements. Where personal data is involved, GDPR-level fines of up to 4% of worldwide turnover can apply under Article 40(4), so vehicle, wearable and smart home data deserves particular care.

Could the rules change?

The Digital Omnibus package proposes softening several parts of the Data Act, with measures such as legacy contract exemptions and SME relief under discussion. The gatekeeper exclusion has not been the centre of those proposals, and none of the package is law yet. Until an amending text is adopted, the exclusion stands as written, and compliance processes should assume it applies.

Check your own position

Whether you are screening incoming data requests, designing a data sharing flow, or wondering if the Data Act applies to your product at all, our free readiness assessment will show you in minutes which obligations are relevant to you and how close you are to meeting them. It is the quickest way to turn a dense regulation into a short, concrete to-do list.