In the European Union, under the E.U. Data Act (Act), IoT data now belongs to users. Most provisions of the Act, which sets new rules for U.S. and other non-E.U. companies that do IoT-related business in Europe, came into force in September 2025. Together with other E.U. laws and sector regulations, the Act creates a complex and multilayered compliance landscape in the E.U., presenting companies with GDPR-level financial risk, as well as exposure to class actions and legal claims from competitors. This article, distilling insights offered by Baker Botts and Faegre Drinker Biddle & Reath partners during a BARBRI program, analyzes key elements of the Act and offers compliance guidance. See our two-part series on Cybersecurity Obligations in E.U.’s digital laws: “AI Act, CRA and NIS2” (Sep. 4, 2024), and “Data Act, DORA and Compliance Steps” (Sep. 11, 2024).