Kia Captcha illegal?

[txelu1997]

⚠️ Discussion: Is it even legal anymore to access our own Kia vehicle data?

Hi all,

As many of you have probably noticed, Kia has recently enforced a CAPTCHA challenge during login, specifically a "I'm not a robot" checkbox that must be solved manually. This change effectively blocks any programmatic access to the Kia Connect system — regardless of whether the request is made by the legitimate owner of the vehicle.

Until now, tools like kia_uvo and bluelinky allowed users to retrieve basic information about their own vehicle (SOC, odometer, charging state, etc.) to automate charging, monitor energy consumption, or simply be more in control of their EV usage. These tools were never about hacking or bypassing; they were about empowering users with access to their own data.

However, with this new CAPTCHA enforcement, any attempt to bypass it — even using techniques like browser emulation or headless login — would likely be considered a violation of Kia's Terms of Service, and possibly local laws, depending on jurisdiction. It's clear the CAPTCHA exists for the sole purpose of preventing automation, which puts us in a legally and ethically difficult position.

So my questions to the community are:

1. Is there any official communication from Kia Connect GmbH about why this change was introduced and whether an API or data export option will be offered?
2. Can users demand machine-readable access to their data under GDPR (Article 20 - Right to Data Portability)?
3. Is there any technical or legal way forward that would still comply with both GDPR and Kia's policies?

We all want to respect the rules, but we also expect our rights as users to be respected. I would love to hear your thoughts and whether any legal experts or organizations like the EFF, OCU, or others have weighed in on this issue.

Thank you for reading.

PS: English is not my native language, so I’ve used ChatGPT to help formulate this message clearly and respectfully.

[milmat72]

IMHO It is more about the customer experience and the product itself than a legal issue.

[walter-ve]

So you comment is that "GDPR (Article 20 - Right to Data Portability)" doesn't apply in this case? Do you have reason to say it doesn't?

[milmat72]

I mean this is a commercial issue rather then a legal issue. I'm not a legal expert, so I cannot answer your question. But you can investigate what kind of data are regulated under this article. I assume that this doesn't mean all data, but specific data like e.g. personal data, etc.

[semeion-net]

I am by no means a GDPR expert, but I'd assume the answer is no. Data portability implies that you can get a copy of your data (see e.g. Gmail -> Google Takeout). It does not imply free live API access to systems operating this data.

You can request all your data from KIA any time (but something tells me they will struggle with the implementation of this and probably not respond to your requests until you threaten legal action or involve data protection authorities). But live API access is a different story, sadly.

I'd expect that KIA will in the future try to lockout third party API access, like many manufacturers do. The only language they will understand is pressure from customers. I only know that if they do so, my next car won't be a KIA for sure. But if all manufacturers follow suit, what can you do.

It will become an ever-increasing concern considering Smart Homes. E.g. needing to interface the car with Home Assistant to enable smart charging via photovoltaic energy.

But the executives at these corporations pursue the same stupid MBA mindset logic that brought us electric car charging stations without direct payment, that require you to download their stupid abysmal app just to charge your car once. They want to impose their rules upon you and have no technical understanding why you'd even want to not be confined to their little ecosystem.

EDIT: As far as I'm aware they have already significantly reworked their data protection statement as well as the terms of use. Of course they won't allow use of the Kia Connect services through third party apps already. Further, the revisions of the data protection statement beginning of this year reveal that they are now introducing new features in new the KIA app, such as driver safety assessments. Beware when turning this on, the fine print in the data protection statement reveal that they are sending your behavioral patterns to a third party (LexisNexis) for profiling, which will mean that someday your car insurance premiums will increase just because you are driving in a fashion that some shady data broker deems unsafe based on questionable telemetry data.

Once the day comes that KIA locks third party apps out, I will put the car in offline mode and explore the route to use an OBD dongle for telemetry, at least at home. I could not care less about this if my car wasn't an electric, but sadly having the app integration is an essential feature for charging control.

[txelu1997]

Kia Spain and Kia Connect have confirmed to me that:

The CAPTCHA on Kia Connect is considered by them a “security measure” and they claim it is compliant with GDPR/LOPDGDD.

End users can only get their data via a manual request form: Data Access Form.

The so-called “vehicle data API” they referenced is not public. The link they provided is just a demo page, not a real endpoint for users:
http://example.com/playground/resources/api-reference/vehicle-data-api/intro

API access is restricted to third-party integrators with agreements with Kia. End users cannot generate their own credentials.

So in practice, there is no direct, automated access for users to their own vehicle data, despite the obligations of the EU Data Act (Regulation EU 2023/2854).