Editing Secure gateway module

{{#seo:
|description=Secure gateway modules lock the OBD-II port behind internet paywalls, blocking independent shops from ADAS recalibration and diagnostics.
}}
A '''secure gateway module''' (SGW) is a digital firewall integrated into a vehicle's electrical architecture that restricts access to the on-board diagnostic (OBD-II) port by requiring internet-authenticated credentials before allowing bidirectional communication with vehicle systems.<ref name="youcanic">{{Cite web |url=https://www.youcanic.com/fca-security-gateway-module-explained-obd2-sgm-sgw/ |title=FCA Security Gateway Module Explained |publisher=YOUCANIC |access-date=2026-04-04}}</ref> Fiat Chrysler Automobiles (FCA, now [[Stellantis]]) introduced the technology across its vehicle lineup in 2017-2018, & Nissan, Mercedes-Benz, Volkswagen/Audi, & [[Hyundai]]/Kia have since adopted similar systems.<ref name="adasdepot">{{Cite web |url=https://adasdepot.com/blog/security-gateways-in-modern-vehicles-balancing-cybersecurity-and-repair-access/ |title=Security Gateways in Modern Vehicles: Balancing Cybersecurity and Repair Access |publisher=ADAS Depot |access-date=2026-04-04}}</ref> Independent repair shops must pay annual subscription fees to a third-party authentication service called AutoAuth, plus maintain separate scan tool software subscriptions, to perform repairs that dealerships can do without additional cost.<ref name="autoauth-pricing">{{Cite web |url=https://www.adasnetwork.org/industrynews/autoauth-announces-changes-to-it-s-pricing-structure-and-services |title=AutoAuth Announces Changes to its Pricing Structure and Services |publisher=ADAS Network |date=2025 |access-date=2026-04-04}}</ref>

The auto-glass & collision repair industries bear a disproportionate burden because every windshield replacement on an [[Advanced driver-assistance system|ADAS]]-equipped vehicle requires camera recalibration that the SGW blocks without active internet authentication.<ref name="rdn-adas">{{Cite web |url=https://www.repairerdrivennews.com/2026/03/04/industry-responds-to-federal-bill-requiring-nhtsa-guidelines-for-adas-calibrations/ |title=Industry responds to federal bill requiring NHTSA guidelines for ADAS calibrations |author=Teresa Moss |publisher=Repairer Driven News |date=2026-03-04 |access-date=2026-04-04}}</ref> The Federal Trade Commission found "scant evidence to support manufacturers' justifications for repair restrictions" in its 2021 report to Congress, & the GAO confirmed in 2024 that independent shops face repair information limitations resulting in fewer choices & higher costs for consumers.<ref name="ftc-nixing">{{Cite web |url=https://www.ftc.gov/reports/nixing-fix-ftc-report-congress-repair-restrictions |title=Nixing the Fix: An FTC Report to Congress on Repair Restrictions |publisher=Federal Trade Commission |date=2021-05 |access-date=2026-04-04}}</ref><ref name="gao">{{Cite web |url=https://www.gao.gov/products/gao-24-106633 |title=Vehicle Repair: Information on Evolving Vehicle Technologies and Consumer Choice |publisher=Government Accountability Office |date=2024-03-21 |access-date=2026-04-04}}</ref>

== History of OBD-II & the shift to closed diagnostics ==

The [[Clean Air Act]] amendments of 1990 mandated that vehicle manufacturers provide "any and all information needed" for emissions diagnostics to any person engaged in vehicle repair, codified at 42 U.S.C. 7521(m).<ref name="caa">{{Cite web |url=https://www.law.cornell.edu/uscode/text/42/7521 |title=42 U.S. Code 7521 - Emission standards for new motor vehicles |publisher=Legal Information Institute |access-date=2026-04-04}}</ref> The Environmental Protection Agency required standardized OBD-II connectors & diagnostic protocols in all vehicles sold in the United States starting with model year 1996.<ref name="carb-obd">{{Cite web |url=https://ww2.arb.ca.gov/resources/fact-sheets/board-diagnostic-ii-obd-ii-systems-fact-sheet |title=On-Board Diagnostic II (OBD II) Systems Fact Sheet |publisher=California Air Resources Board |access-date=2026-04-04}}</ref> For two decades, any technician with a scan tool could plug into the OBD-II port & read fault codes, clear diagnostic trouble codes, & perform bidirectional controls without manufacturer permission.

Massachusetts passed the first automotive [[right to repair]] law in 2012, requiring manufacturers to sell independent shops the same diagnostic tools & repair information available to dealerships.<ref name="securepairs">{{Cite web |url=https://securepairs.org/court-decision-looms-on-auto-right-to-repair-a-lawyer-explains-what-its-all-about/ |title=Court Decision Looms on Auto Right to Repair |publisher=SecurePairs.org |access-date=2026-04-04}}</ref> That law prompted a national Memorandum of Understanding in 2014 between automakers & the independent repair industry, extending similar access provisions across all 50 states.<ref name="mou-2023">{{Cite web |url=https://www.autosinnovate.org/posts/press-release/independent-auto-repairers-automakers-strike-major-right-to-repair-pact |title=Independent Auto Repairers, Automakers Strike Major Right-to-Repair Pact |publisher=Alliance for Automotive Innovation |date=2023-07-11 |access-date=2026-04-04}}</ref> A revised MOU was signed in July 2023 between ASA, SCRS, & the Alliance for Automotive Innovation.<ref name="mou-2023" /> The MOU covered the physical OBD-II port but didn't address wireless telematics data, a gap that manufacturers would later exploit.

=== The 2015 Jeep Cherokee hack ===

In July 2015, security researchers Charlie Miller & Chris Valasek remotely hijacked a Jeep Cherokee through its Uconnect cellular connection, demonstrating the ability to control steering, brakes, & transmission from a laptop miles away.<ref name="jeep-hack">{{Cite web |url=https://fractionalciso.com/the-groundbreaking-2015-jeep-hack-changed-automotive-cybersecurity/ |title=The Groundbreaking 2015 Jeep Hack Changed Automotive Cybersecurity |publisher=Fractional CISO |access-date=2026-04-04}}</ref> FCA recalled 1.4 million vehicles in response.<ref name="jeep-recall">{{Cite web |url=https://www.computerworld.com/article/1628895/chrysler-recalls-14m-vehicles-after-jeep-hack.html |title=Chrysler recalls 1.4M vehicles after Jeep hack |publisher=Computerworld |date=2015 |access-date=2026-04-04}}</ref> The hack prompted NHTSA to issue cybersecurity guidance for the automotive industry.<ref name="jeep-hack" /> However, Miller & Valasek exploited the vehicle's cellular telematics connection, not the physical OBD-II port.<ref name="jeep-hack" /> The SGW gates the physical port that a technician plugs a scan tool into while standing next to the vehicle. The FTC noted in its "Nixing the Fix" report that manufacturers' cybersecurity justifications for repair restrictions lack empirical support.<ref name="ftc-nixing" />

== How secure gateway modules work ==

=== Technical architecture ===

The SGW divides a vehicle's Controller Area Network (CAN) bus into "public" & "private" sectors.<ref name="youcanic" /> The public sector includes the telematics unit & the Data Link Connector (DLC, the physical OBD-II port). Everything on the internal CAN bus is private: engine control modules, transmission controllers, body control modules, & ADAS processors. The SGW sits between these two networks & decides which commands pass through based on an approved, authenticated list.<ref name="jscan">{{Cite web |url=https://jscan.net/fca-security-gateway-module-basic-info-and-location/ |title=FCA Security Gateway Module Basic Info and Location |publisher=JScan |access-date=2026-04-04}}</ref>

Without authentication, technicians can still read basic emissions data & some diagnostic trouble codes. They can't clear those codes, perform bidirectional controls (manually triggering a fuel pump, cycling an ABS motor, or operating a window actuator), execute module programming or service resets, or conduct ADAS calibrations.<ref name="autel-sgw">{{Cite web |url=https://autel.us/security-gateways/ |title=It Might Be An OEM Security Gateway |publisher=Autel |access-date=2026-04-04}}</ref><ref name="youcanic" />

=== Authentication flow ===

Bypassing the SGW requires a challenge-response protocol managed by a cloud server:<ref name="eti-overview">{{Cite web |url=https://etools.org/wp-content/uploads/2024/09/AutoAuth-High-Level-Overview-Ver10.pdf |title=AutoAuth High Level Overview |publisher=Equipment and Tool Institute |date=2024-09 |access-date=2026-04-04}}</ref>

# The technician connects an approved aftermarket scan tool to the OBD-II port. The tool detects the SGW & prompts for authentication.
# The scan tool must have an active Wi-Fi or cellular internet connection at the moment of authentication.
# The tool sends credentials to AutoAuth, which acts as the "SGW Authentication Bridge Server."
# AutoAuth retrieves cryptographic information from the manufacturer's public key infrastructure (PKI) to validate the user's identity & the tool's authorization.
# An unlock token is sent to the vehicle, opening the gateway for the duration of the diagnostic session.

For older FCA vehicles (2018-2021 Chrysler models), a physical workaround exists: technicians can use a "12+8 bypass cable" to unplug the SGW module under the dashboard & connect the scan tool directly to the CAN bus, though this requires invasive dashboard disassembly.<ref name="jscan" />

=== Manufacturer implementations ===

FCA/Stellantis was the first to deploy SGW at scale, starting on select 2017 models & expanding to nearly all 2018+ vehicles across Chrysler, Dodge, Jeep, Ram, Fiat, Maserati, & Alfa Romeo.<ref name="youcanic" /> Nissan & Mercedes-Benz subsequently adopted similar gateway restrictions routing independent access through AutoAuth.<ref name="adasdepot" />

Volkswagen & Audi use a different system called SFD (Schutz Fahrzeug Diagnose), which relies on time-limited tokens that temporarily unlock specific modules.<ref name="adasdepot" /> Bosch unlocked secure gateway access for Hyundai/Kia/Genesis vehicles in June 2024, allowing its ADS-series scan tools to authenticate directly.<ref name="bosch-hkg">{{Cite web |url=https://www.aftermarketmatters.com/collision-repair/collision-product-news/bosch-unlocks-secure-gateway-access-to-hyundai-kia-genesis-vehicles/ |title=Bosch unlocks secure-gateway access to Hyundai/Kia/Genesis vehicles |publisher=Aftermarket Matters |date=2024-06-18 |access-date=2026-04-04}}</ref>

== AutoAuth & the subscription model ==

AutoAuth is a third-party authentication service that serves as the primary gateway for independent aftermarket access to SGW-equipped vehicles in North America.<ref name="eti-overview" /><ref name="autoauth-home">{{Cite web |url=https://info.autoauth.com/ |title=AutoAuth |publisher=AutoAuth |access-date=2026-04-04}}</ref>

=== Pricing ===

AutoAuth charges an annual shop registration fee that was raised by $10 in June 2025.<ref name="autoauth-pricing" /> On top of the base fee, each vehicle manufacturer requires a separate annual subscription, also increased by $10 per year in the same pricing change.<ref name="autoauth-pricing" /> The per-manufacturer fee structure means costs compound with each new OEM that adopts SGW: a shop servicing three SGW-equipped brands pays three separate annual fees plus the base registration.<ref name="eti-overview" />

These fees don't include the scan tool itself. Aftermarket scan tool manufacturers (Snap-on, Autel, Bosch, Launch Tech, & others) require active software subscriptions for their tools to communicate with AutoAuth.<ref name="eti-overview" /> The scan tool subscription is a prerequisite; without it, the tool can't initiate the AutoAuth handshake regardless of whether the shop has paid AutoAuth's fees.

Dealerships don't pay these fees; their factory diagnostic tools authenticate directly through the manufacturer's own systems.<ref name="gao" />

== ADAS recalibration & the auto-glass industry ==

SGW's impact extends beyond cost into vehicle safety. Advanced Driver Assistance Systems rely on networks of sensors: forward-facing windshield cameras for lane departure warning, lane keep assist, & automatic emergency braking; radar sensors for adaptive cruise control & blind spot monitoring; and in some vehicles, LiDAR, 360-degree cameras, & night vision systems.<ref name="rdn-adas" />

=== Why windshield replacement triggers recalibration ===

The forward-facing camera on most ADAS-equipped vehicles is mounted to the windshield. When the windshield is replaced, the camera bracket is disturbed. Even a fraction-of-a-degree misalignment degrades system performance; a miscalibrated camera can cause automatic emergency braking to fire late or not at all.<ref name="autel-sgw" /> The Auto Glass Safety Council & vehicle manufacturers require recalibration after every windshield replacement to restore original safety performance, & insurers require documentation that the recalibration was completed.<ref name="autel-sgw" />

The SGW classifies ADAS recalibration as a "bidirectional control" or "special function."<ref name="autel-sgw" /> A glass technician who has replaced the windshield can't command the vehicle's ECU to accept the new camera parameters without an active internet connection, an updated scan tool, & an active AutoAuth subscription. The vehicle leaves the shop with ADAS in an uncalibrated state, or the glass company subcontracts the recalibration to a dealer or specialty shop, adding cost & delay.

=== The rural & mobile technician problem ===

Auto-glass replacement is one of the most common mobile repair services. Technicians drive to the customer's location (home, workplace, roadside) & replace the windshield on-site. AutoAuth's cloud-based PKI authentication requires an internet connection at the exact moment of vehicle authentication.<ref name="eti-overview" />

Mobile technicians working in rural areas, parking garages, or anywhere with poor cellular coverage can't complete the ADAS recalibration. The windshield is physically installed, but the safety system is disabled because the scan tool can't reach AutoAuth's server.<ref name="eti-overview" /> The technician must either leave the vehicle with uncalibrated ADAS (a liability risk), have the customer drive to a location with internet service (shifting the burden to the consumer), or return later at additional cost.

Rural trucks, farm vehicles, & fleet vehicles on highways are the most likely to need windshield replacements from road debris, and the most likely to be in areas where the authentication server can't be reached.

=== Target board proliferation ===

ADAS calibration requires manufacturer-specific equipment. H.R. 6688 addresses this gap by requiring manufacturers to publish calibration procedures & validation metrics, which would allow third-party equipment manufacturers to build compatible tools.<ref name="rdn-adas" />

The GAO found that evolving vehicle technologies create repair information barriers for independent shops, reducing consumer choice & increasing costs.<ref name="gao" />

=== Safety consequences ===

If a technician replaces a windshield but can't bypass the SGW to recalibrate the ADAS, the vehicle's safety systems operate on misaligned sensor data. H.R. 6688 (ADAS Functionality & Integrity Act), approved by a House subcommittee in February 2026, would give NHTSA authority to develop ADAS calibration guidelines & require manufacturers to publish calibration procedures & validation metrics.<ref name="rdn-adas" />

== Cost burden on independent shops ==

The total cost of SGW compliance for an independent repair shop compounds across multiple subscription layers:<ref name="eti-overview" />

* '''AutoAuth base subscription:''' Annual shop registration fee, increased in June 2025.<ref name="autoauth-pricing" />
* '''Per-manufacturer fees:''' Each OEM brand requires a separate annual subscription on top of the base fee, also increased in the June 2025 pricing change.<ref name="autoauth-pricing" /> A shop servicing Stellantis, Nissan, & Mercedes-Benz pays three separate per-brand fees.
* '''VW/Audi SFD tokens:''' Purchased separately per session or in bundles, outside the AutoAuth system.<ref name="adasdepot" />
* '''Scan tool software subscription:''' The aftermarket scan tool itself requires an active annual software subscription from its manufacturer (Snap-on, Autel, Bosch, etc.) to communicate with AutoAuth.<ref name="eti-overview" />

These are all recurring annual costs. A shop that doesn't pay any one of them loses the ability to clear a check engine light on a 2022 Jeep Grand Cherokee. Dealerships pay none of these fees; their factory tools authenticate through the manufacturer's own systems at no per-session charge.

The GAO confirmed the cost disparity in March 2024, finding that independent shops face repair information limitations that leave consumers with fewer choices, higher costs, & longer wait times.<ref name="gao" />

== Legislation ==

=== Federal ===

==== REPAIR Act ====

The Right to Equitable and Professional Auto Industry Repair (REPAIR) Act was reintroduced in February 2025 as H.R. 1566 (House) & S. 1379 (Senate).<ref name="repair-act-house">{{Cite web |url=https://www.congress.gov/bill/119th-congress/house-bill/1566/text |title=H.R.1566 - REPAIR Act |publisher=Congress.gov |date=2025 |access-date=2026-04-04}}</ref><ref name="repair-act-senate">{{Cite web |url=https://www.congress.gov/bill/119th-congress/senate-bill/1379/text |title=S.1379 - REPAIR Act |publisher=Congress.gov |date=2025 |access-date=2026-04-04}}</ref> House sponsors include Rep. Neal Dunn (R-FL), Rep. Marie Gluesenkamp Perez (D-WA), Rep. Brendan Boyle (D-PA), & Rep. Warren Davidson (R-OH).<ref name="autocare-repair">{{Cite web |url=https://www.autocare.org/news/latest-news/details/2025/02/25/congress-reintroduces-bipartisan-auto-right-to-repair-legislation-to-protect-consumer-choice |title=Congress Reintroduces Bipartisan Auto Right to Repair Legislation |publisher=Auto Care Association |date=2025-02-25 |access-date=2026-04-04}}</ref>

The bill directly addresses SGW by requiring vehicle owners & independent shops to have direct, real-time, in-vehicle access to vehicle-generated data, diagnostics, & telematics. It prohibits manufacturers from mandating specific tool brands & requires NHTSA to develop standards for cyber-secure standardized data access.<ref name="autocare-data">{{Cite web |url=https://www.autocare.org/government-relations/current-issues/access-to-and-control-of-vehicle-data |title=Access to and Control of Vehicle Data |publisher=Auto Care Association |access-date=2026-04-04}}</ref>

==== ADAS Functionality & Integrity Act ====

H.R. 6688 was approved by the House Subcommittee on Commerce, Manufacturing, & Trade in February 2026.<ref name="rdn-adas" /> The bill gives NHTSA authority to develop ADAS calibration guidelines, requires manufacturers to publish calibration procedures & validation metrics, & addresses the target board standardization gap that inflates costs for independent shops.

==== Clean Air Act Section 202(m) ====

42 U.S.C. 7521(m) mandates that manufacturers provide "any and all information needed" for emissions diagnostics to any person engaged in vehicle repair & requires standardized OBD-II connectors.<ref name="caa" /> SGW doesn't block the read-only emissions data required under this statute, but it blocks the bidirectional controls needed to complete emissions-related repairs (clearing DTCs, performing system relearns after component replacement).

==== [[DMCA Section 1201]] exemptions ====

The US Copyright Office first granted a vehicle repair exemption to [[Digital Millennium Copyright Act|DMCA]] Section 1201 in October 2015.<ref name="dmca-2024">{{Cite web |url=https://www.federalregister.gov/documents/2024/10/28/2024-24563/exemption-to-prohibition-on-circumvention-of-copyright-protection-systems-for-access-control |title=Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies |publisher=Federal Register |date=2024-10-28 |access-date=2026-04-04}}</ref> The 9th Triennial Proceeding in October 2024 broadened the exemption to explicitly grant vehicle owners & their designees the right to access, store, & share "operational data, including diagnostic and telematics data."<ref name="dmca-2024" /><ref name="autocare-dmca">{{Cite web |url=https://www.autocare.org/detail-pages/blog/aina/2024/11/01/new-exemption-to-digital-millennium-copyright-act-broadens-protection-for-vehicle-data-access |title=New Exemption to DMCA Broadens Protection for Vehicle Data Access |publisher=Auto Care Association |date=2024-11-01 |access-date=2026-04-04}}</ref> The FTC & DOJ filed a joint comment in March 2024 supporting the expansion.<ref name="ftc-dmca">{{Cite web |url=https://www.ftc.gov/news-events/news/press-releases/2024/03/ftc-doj-file-comment-us-copyright-office-supporting-renewal-expansion-exemptions-facilitating |title=FTC and DOJ File Comment Supporting Renewal and Expansion of DMCA Repair Exemptions |publisher=Federal Trade Commission |date=2024-03 |access-date=2026-04-04}}</ref>

=== State ===

==== Massachusetts ====

Massachusetts passed the first automotive right-to-repair law in 2012 (Mass. Gen. Laws ch. 93K), which required manufacturers to provide independent shops access to the same diagnostic tools & repair information available to dealerships.<ref name="securepairs" /> The original law didn't cover wireless telematics data.<ref name="securepairs" />

In November 2020, Massachusetts voters passed Question 1 with 75% approval, expanding the law to require an interoperable, standardized, open-access telematics platform for model year 2022+ vehicles.<ref name="ballotpedia-ma">{{Cite web |url=https://ballotpedia.org/Massachusetts_Question_1,_%22Right_to_Repair_Law%22_Vehicle_Data_Access_Requirement_Initiative_(2020) |title=Massachusetts Question 1, "Right to Repair Law" Vehicle Data Access Requirement Initiative (2020) |publisher=Ballotpedia |access-date=2026-04-04}}</ref> The Alliance for Automotive Innovation sued immediately (see ''[[#Alliance for Automotive Innovation v. Healey|Alliance v. Healey]]'' below).<ref name="collisionweek-appeal">{{Cite web |url=https://collisionweek.com/2025/03/21/alliance-automotive-innovation-appeals-federal-judges-dismissal-massachusetts-right-repair-lawsuit/ |title=Alliance for Automotive Innovation Appeals Massachusetts Right to Repair Ruling |publisher=CollisionWeek |date=2025-03-21 |access-date=2026-04-04}}</ref> Rather than build open-access platforms, Subaru & Kia disabled telematics systems entirely on 2022+ vehicles sold in Massachusetts.<ref name="rdn-subaru-kia">{{Cite web |url=https://www.repairerdrivennews.com/2022/01/18/aai-ag-respond-to-new-evidence-in-mass-right-to-repair-suit-kia-joins-subaru-in-disabling-telematics/ |title=AAI, AG respond to new evidence in Mass. 'right-to-repair' suit; Kia joins Subaru in disabling telematics |publisher=Repairer Driven News |date=2022-01-18 |access-date=2026-04-04}}</ref>

Attorney General Andrea Joy Campbell began enforcement in mid-2023 while litigation continued. The federal district court dismissed the Alliance's remaining claims on February 11, 2025. The Alliance appealed to the First Circuit on March 14, 2025.<ref name="collisionweek-appeal" />

==== Maine ====

Maine voters passed Question 4, the Automotive Right to Repair Act (originating as LD 1677), by referendum in November 2023 with 84% approval.<ref name="ballotpedia-maine">{{Cite web |url=https://ballotpedia.org/Maine_Question_4,_%22Right_to_Repair_Law%22_Vehicle_Data_Access_Requirement_Initiative_(2023) |title=Maine Question 4, "Right to Repair Law" Vehicle Data Access Requirement Initiative (2023) |publisher=Ballotpedia |access-date=2026-04-04}}</ref> The law took effect January 5, 2025, mandating standardized access to on-board diagnostic systems & telematics across all makes & models.<ref name="autobody-2026">{{Cite web |url=https://www.autobodynews.com/news/right-to-repair-in-2026-where-laws-courts-and-automakers-stand |title=Right to Repair in 2026: Where Laws, Courts, and Automakers Stand |publisher=Autobody News |date=2026 |access-date=2026-04-04}}</ref> The Alliance for Automotive Innovation filed suit against Maine in January 2025 using arguments similar to the Massachusetts case.<ref name="collisionweek-appeal" />

=== International ===

==== European Union ====

EU Regulation 2018/858 mandates non-discriminatory access to OBD & repair/maintenance information (RMI) for independent operators as a condition of vehicle type-approval.<ref name="eu-reg">{{Cite web |url=https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02018R0858-20240701 |title=Regulation (EU) 2018/858 - Consolidated |publisher=EUR-Lex |date=2018-05-30 |access-date=2026-04-04}}</ref>

In October 2023, the European Court of Justice ruled in Case C-296/22 (Carglass/ATU v. Stellantis Italy) that manufacturers can't require personal registration, internet connection to manufacturer servers, or paid subscriptions for OBD access beyond what Regulation 2018/858 permits.<ref name="ecj-ruling">{{Cite web |url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62022CJ0296 |title=Case C-296/22 - CJEU Judgment |publisher=EUR-Lex |date=2023-10 |access-date=2026-04-04}}</ref> The court held that both read & write access to the OBD data stream must be granted to independent repairers & rejected the argument that UN Regulation 155 (vehicle cybersecurity) overrides EU access requirements.<ref name="ecj-analysis">{{Cite web |url=https://www.osborneclarke.com/news/ecj-decision-vehicle-manufacturers-may-not-restrict-access-vehicle-data-stream |title=ECJ decision: vehicle manufacturers may not restrict access to the vehicle data stream |publisher=Osborne Clarke |date=2023 |access-date=2026-04-04}}</ref> The court stated that if manufacturers could "limit at their discretion access to the direct vehicle data stream...it would be open to them to make access to that stream subject to conditions capable of making access impossible in practice."<ref name="ecj-analysis" />

The ECJ's holding that manufacturers can't require internet connections, personal registration, or paid subscriptions for OBD access covers the same conditions that AutoAuth imposes in North America.<ref name="ecj-analysis" />

Other jurisdictions have enacted similar access requirements. The UK implemented the Motor Vehicle Block Exemption Order (MVBEO) in 2023, & Australia launched the Motor Vehicle Information Scheme (MVIS) in 2022, both mandating that manufacturers provide repair data to independent shops.

== Court cases ==

=== Alliance for Automotive Innovation v. Healey ===

The Alliance for Automotive Innovation, the trade group representing most major automakers, filed suit in the U.S. District Court for the District of Massachusetts (1:20-cv-12090) on November 20, 2020, challenging the Question 1 telematics expansion.<ref name="courtlistener-healey">{{Cite web |url=https://www.courtlistener.com/docket/18666877/alliance-for-automotive-innovation-v-maura-healey/ |title=Alliance for Automotive Innovation v. Maura Healey, 1:20-cv-12090 |publisher=CourtListener |access-date=2026-04-04}}</ref> The Alliance argued federal preemption under the Motor Vehicle Safety Act & the Clean Air Act, unconstitutional takings of intellectual property, & cybersecurity risks from open data platforms.

Judge Denise Casper (who took over from Judge Douglas Woodlock) dismissed the Alliance's remaining claims in February 2025.<ref name="collisionweek-appeal" /> NHTSA had initially expressed concern that the law's wireless data access requirements could create cybersecurity vulnerabilities.<ref name="securepairs" />

On March 14, 2025, the Alliance appealed to the First Circuit.<ref name="collisionweek-appeal" />

=== Alliance for Automotive Innovation v. Maine ===

The Alliance filed a similar challenge against Maine's automotive right-to-repair law in January 2025, using the same preemption & cybersecurity arguments raised in the Massachusetts case.<ref name="collisionweek-appeal" />

=== ECJ Case C-296/22 ===

Referred to the European Court of Justice by the Cologne Regional Court (Germany), this case asked whether EU Regulation 2018/858 prohibits manufacturers from imposing conditions on OBD access that go beyond what the regulation permits.<ref name="ecj-ruling" /> The ECJ ruled in October 2023 that manufacturers can't require internet connections to manufacturer servers, personal registration, or paid subscriptions as conditions for independent repairer access to the OBD data stream.<ref name="ecj-analysis" /> The court rejected the argument that UN Regulation 155 (vehicle cybersecurity) provides a basis for overriding the access requirements, holding that manufacturers must implement "security by design" without restricting third-party access.<ref name="ecj-analysis" />

== Industry positions ==

=== Manufacturer justifications ===

The Alliance for Automotive Innovation maintains that "automakers already and routinely make available to independent repair shops all the parts, service information and vehicle data needed to diagnose and repair a vehicle" & that "competition is alive and well in the auto repair industry."<ref name="alliance-r2r">{{Cite web |url=https://www.autosinnovate.org/RightToRepair |title=Right to Repair |publisher=Alliance for Automotive Innovation |access-date=2026-04-04}}</ref> The Alliance has sued to block both the Massachusetts & Maine right-to-repair laws, arguing in court filings that requiring open telematics platforms would create cybersecurity vulnerabilities.<ref name="courtlistener-healey" />

=== Aftermarket & consumer advocates ===

The Auto Care Association & CAR Coalition argue that SGW & telematics monopolies are anti-competitive tools designed to steer lucrative repair work to franchised dealerships, not genuine cybersecurity measures.<ref name="autocare-data" /> SEMA has called the 2023 national MOU between automakers & independent repairers insufficient, arguing it "distracts from the need to pass the REPAIR Act."<ref name="sema-mou">{{Cite web |url=https://www.sema.org/news-media/enews/2023/28/right-repair-agreement-distracts-need-pass-repair-act |title=Right to Repair Agreement Distracts From Need to Pass the REPAIR Act |publisher=SEMA |date=2023 |access-date=2026-04-04}}</ref>

An alternative approach exists: the Secure Vehicle Interface (SVI) initiative proposes a standardized, secure diagnostic access protocol that would replace manufacturer-specific authentication with a universal standard, maintaining cybersecurity without requiring per-OEM subscriptions.<ref name="svi">{{Cite web |url=https://www.svi-for-mobility.org/ |title=Secure Vehicle Interface for mobility |publisher=SVI for Mobility |access-date=2026-04-04}}</ref>

=== Government findings ===

In its May 2021 "Nixing the Fix" report, the FTC found "scant evidence to support manufacturers' justifications for repair restrictions," dismissing claims that diagnostic lockouts are necessary for safety or cybersecurity.<ref name="ftc-nixing" /> Restricting access to proprietary diagnostic software & steering consumers to manufacturer networks may violate the anti-tying provisions of the [[Magnuson-Moss Warranty Act]] (15 U.S.C. ch. 50, Sections 2301-2312), the report noted.<ref name="ftc-mm">{{Cite web |url=https://www.ftc.gov/legal-library/browse/statutes/magnuson-moss-warranty-federal-trade-commission-improvements-act |title=Magnuson-Moss Warranty Act |publisher=Federal Trade Commission |access-date=2026-04-04}}</ref>

In July 2021, the FTC voted 5-0 to adopt a policy statement committing to enforce against repair restrictions that violate antitrust laws or the FTC Act's prohibitions on unfair or deceptive practices.<ref name="ftc-policy">{{Cite web |url=https://www.ftc.gov/news-events/news/press-releases/2021/07/ftc-ramp-law-enforcement-against-illegal-repair-restrictions |title=FTC to Ramp Up Law Enforcement Against Illegal Repair Restrictions |publisher=Federal Trade Commission |date=2021-07-21 |access-date=2026-04-04}}</ref> The GAO's March 2024 report confirmed that evolving vehicle technologies are restricting consumer choice & increasing repair costs for independent shops.<ref name="gao" />

== Comparison to other industries ==

[[John Deere]] restricted access to its proprietary diagnostic software to franchised dealers, preventing farmers from repairing their own tractors. John Deere signed a Memorandum of Understanding with the American Farm Bureau Federation in January 2023 promising to expand diagnostic access, though right-to-repair advocates expressed skepticism about enforcement.<ref name="deere-mou">{{Cite web |url=https://www.npr.org/2023/01/10/1147934682/john-deere-right-to-repair-farmers-tractors |title=John Deere vows to open up its tractor tech, but right-to-repair backers have doubts |publisher=NPR |date=2023-01-10 |access-date=2026-04-04}}</ref> [[Tesla]] requires its proprietary Toolbox 3 diagnostic software for repairs beyond basic OBD-II fault codes; until a price reduction, the software cost $3,000/year.<ref name="tesla-toolbox">{{Cite web |url=https://driveteslacanada.ca/news/tesla-reapirs-more-accessible-toolbox-3-price-drop/ |title=Tesla Makes Vehicle Repairs More Accessible With Major Toolbox 3 Price Drop |publisher=Drive Tesla Canada |date=2025 |access-date=2026-04-04}}</ref>

Similar patterns exist across industries: Apple uses [[Parts pairing|parts pairing]] to lock replacement components to device serial numbers, & BMW charged subscription fees for hardware features already installed in vehicles (see [[BMW feature lockout scandal]]).

== See also ==

* [[Right to repair]]
* [[Stellantis]]
* [[DMCA Section 1201]]
* [[Magnuson-Moss Warranty Act]]
* [[Parts pairing]]
* [[John Deere]]
* [[BMW feature lockout scandal]]
* [[Hyundai Ioniq 5 N brake pad repair restrictions]]
* [[Tesla]]

== References ==

{{reflist}}

[[Category:Right to Repair]]
[[Category:Automotive]]
[[Category:Planned Obsolescence]]
[[Category:Legislation]]