Canadians, and many people around the world, are increasingly purchasing and using electronic devices meant to capture and record their relative levels of fitness. Contemporary fitness trackers collect a broad range of data, and can include the number of floors climbed, levels and deepness of sleep, how many steps taken and distance travelled over a day, heart rates, and more. All of this data is of interest to the wearers of the devices, to companies interested in mining and selling collected fitness data, to insurance companies, to authorities and courts of law, and even potentially to criminals motivated to steal or access data retained by fitness companies.

Given the potential privacy implications associated with fitness trackers, Andrew Hilts (Open Effect/Citizen Lab), Jeffrey Knockel (University New Mexico/Citizen Lab), and I investigated the kinds of information that are collected by the companies which develop and sell some of the most popular wearable fitness trackers in North America. We were motivated to specifically understand:

• Whether data which are technically collected by the wearable devices was noted in the companies’ privacy policies and terms of service and, if so, what protections or assurances individuals had concerning the privacy or security of that data?
• If fitness and other collected data was classified as ‘personal’ data by the companies in question?
• Whether the information received by the individual matched what a company asserted was ‘personally identifiable information’ in their terms of service or privacy policies.

Our analysis depended on a mixed methodology of technical research, policy analysis, and legal/policy testing. Some of our core findings included:

• All studied fitness trackers except the Apple Watch were vulnerable to Bluetooth MAC address surveillance
• Garmin, Withings, and Bellabeat applications failed to use transit-level security for one or more data transmissions, leaving user data exposed.
• The Jawbone UP application routinely sent out the user’s precise geolocation for reasons not made obvious to the user.
• Fitness tracking companies gave themselves broad rights to utilize — and in some cases, sell — consumer’s fitness data
• Data collected by fitness tracking companies did not necessarily match with what can be obtained through an access request.

This research was funded by the Office of the Privacy Commissioner of Canada’s Contributions Program, with additional contributions from the Citizen Lab at the Munk School of Global Affairs, at the University of Toronto. Open Effect has created a webpage dedicated to the report and its impacts.

Download the Report (Alternate Link)