Consent and access rules for customer energy data

The UK's Smart Energy Code (SEC) is the rulebook governing who can access data from the country's smart meters, overseen by the SEC Panel and enforced by Ofgem, the energy regulator. It defines strict tiers:

• Suppliers get access to a customer's full interval data by default, since they need it for billing.
• Third parties (installers, comparison sites, energy management apps) need explicit, time-limited consumer consent, captured through a formal consent process, before they can pull the same data.
• Data is classified by granularity: monthly reads are lightly protected; daily and half-hourly reads require stronger consent because they are more identifying.

Under SEC, a third party like our Manchester installer must register as a authorized party, present a specific consent request naming the purpose (e.g., "battery sizing"), and get the homeowner to approve it through a recognized consent journey, often via the supplier's app or portal. Consent typically must be renewable and revocable; it is not a lifetime grant.

Reference: Smart Energy Code Company overview is the primary public source for the rules and governance structure.

The US model: Green Button

The US took a different path. Green Button is a voluntary industry initiative (not a binding federal law) that lets utilities offer customers a standardized way to download their own usage data or authorize a third party to receive it automatically.

Two flavors matter:

• Green Button Download My Data (DMD): the customer manually downloads their own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → as a file.
• Green Button Connect My Data (CMD): the customer authorizes an ongoing, automated feed to a third party (like a solar quote tool or a demand-response provider), similar to OAuth-style consent used in banking APIs.

Because there is no single US federal privacy law for energy data, oversight is fragmented: some states (California via the CPUC, the California Public Utilities Commission) impose binding privacy rules on utilities; others rely on voluntary frameworks and utility-specific tariffs. This is why a Texas utility's data-sharing practice can look nothing like a California one.

Reference: Green Button Alliance documents the technical standard and participating utilities.

Deciding who gets access: a practical checklist

When evaluating a real third-party access request, a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → team typically works through:

1. Purpose limitation. Is the stated purpose specific ("size a battery," not "improve our services")? GDPR and SEC both require a defined purpose, not a blanket grant.

2. Data minimization. Does the request ask for more than needed? A battery-sizing request needs 6 to 12 months of interval data, not five years of full history.

3. Consent freshness. Is consent still valid, or has it expired / been revoked? SEC and GDPR both expect renewable consent, not indefinite access.

4. Identity verification. Is the third party a registered, authorized party (SEC) or a vetted Green Button data custodian?

5. Audit trail. Is there a timestamped log of who requested what, when consent was given, and what was actually transferred?

A worked mini-scenario

Say the installer requests 12 months of half-hourly data. Under SEC's classification, half-hourly data is high-granularity and requires explicit, purpose-bound consent captured through the recognized consent flow, not a general marketing opt-in the homeowner may have signed a year ago.

If the audit log shows the consent was captured 14 months ago for a "smart thermostat installation," that consent does not cover a new battery-sizing request. A compliant governance process would require a fresh consent capture naming the new third party and new purpose. This is the kind of check a data protection officer or compliance analyst runs weekly, not hypothetically.

What a basic audit query looks like

Governance teams often run simple checks against consent and access logs. A simplified pseudocode check:

This is not exotic AI. It is a straightforward SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.View full definition → (Structured Query Language, used to query databases) audit that any utility's data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → function should run regularly, flagged for manual review.

Where checks and audits actually happen

Beyond the point-of-consent decision, ongoing governance requires:

• Access logging: every pull of interval data by a third party should be logged with timestamp, purpose, and consent reference.
• Periodic consent expiry sweeps: automated jobs that revoke access when consent lapses, common in SEC-regulated systems and increasingly expected under GDPR's storage limitation principle.
• Third-party audits: SEC-registered parties are subject to periodic compliance checks by the SEC Panel; Green Button custodians are expected to follow security and privacy baselines from NIST (US National Institute of Standards and Technology), though enforcement strength varies by state.
• Data breach protocols: under GDPR, a breach involving interval energy data (which can reveal occupancy patterns) must generally be reported to the relevant data protection authority within 72 hours.

🎬 [VIDEO: "How Smart Meter Data Privacy Works" - youtube.com/results?search_query=smart+meter+data+privacy+explained - search for recent regulator or utility explainer videos on smart meter data consent and privacy, useful for a visual walkthrough of the consent flow]

The bigger governance tension

Utilities, regulators, and third parties (aggregators, solar installers, demand-response companies) are pulling in different directions. Utilities want liability protection and clean audit trails. Third parties want fast, low-friction access to grow their businesses. Regulators (Ofgem in the UK; state PUCs like the CPUC in the US) are trying to standardize consent without freezing innovation.

This tension is why frameworks like SEC and Green Button keep evolving. As of 2026, expect continued expansion of automated consent (via APIs) alongside stricter granularity-based tiering, especially as EV charging and home battery data become more commercially valuable and more revealing of household behavior.

Key Takeaways

• Interval-level energy data (15/30/60-minute reads) is treated as sensitive personal data because it reveals behavioral patterns, not just totals.
• The UK's Smart Energy Code enforces tiered, purpose-bound, renewable consent for third-party access, overseen by Ofgem; the US relies on the voluntary Green Button standard plus fragmented state rules (e.g., California's CPUC).
• A valid access decision requires checking purpose limitation, data minimization, consent freshness, and third-party authorization, not just "was consent given at some point."
• Practical governance runs on logs and audits: access logging, expiry sweeps, and periodic third-party compliance checks are the operational backbone of consent enforcement.
• No single global standard exists; always check the applicable framework (SEC, GDPR, state-level US rules) before assuming a consent model transfers across borders.