Smartwatch and wearable privacy: what your fitness tracker actually knows about you

Your fitness tracker knows you stayed up until 1 a.m. It noticed your resting heart rate spiked on Thursday. It logged every block of your morning run, including the route. It knows roughly how stressed you've been this week.

Most people think of wearables as personal health tools. They're that. But they're also data collection systems that run 24 hours a day, seven days a week, and the information they gather doesn't always stay between you and your watch.

Hundreds of millions of these devices are now active globally, tracking hearts, routes, and sleep cycles around the clock. The wearable market has grown from a niche category into a mainstream health infrastructure, with devices ranging from basic step counters to watches with FDA-cleared features that can flag signs of atrial fibrillation. As adoption has accelerated, so has the volume and sensitivity of the data being generated, and the number of parties interested in accessing it.

Understanding what happens to all of that data is worth your time. Not because wearables are bad, but because the gap between what users assume and what's actually happening with their information is wider than most people realize.

What your fitness tracker is actually collecting

The short answer: a lot more than steps.

Modern wearables pull data from multiple sensors simultaneously, often without users giving much thought to what's being recorded between workouts. A typical smartwatch or fitness band collects:

• Heart rate and heart rate variability (HRV), measured continuously, around the clock
• GPS location, every route, every commute, every place you stop
• Sleep patterns, including duration, stages, and interruptions
• Blood oxygen levels (SpO2)
• Body temperature and respiratory rate
• Stress indicators, derived from HRV and movement patterns
• Calories burned, steps, and activity type
• Menstrual cycle data, on devices that offer period tracking

Some of this data reveals more than you'd expect. Your HRV can signal anxiety or chronic stress. Your sleep data can hint at alcohol consumption or illness. Disrupted sleep architecture and elevated resting heart rate are both well-documented physiological responses to drinking. Your GPS history can show where you worship, who you spend time with, and where you sleep at night. A week of location data is often enough to reconstruct a detailed picture of someone's daily life: their home address, workplace, gym, medical appointments, and social patterns.

These aren't abstract risks. They're the kinds of inferences that anyone with access to your data can draw from an ordinary fitness profile. The data points that seem mundane in isolation (a Tuesday morning run, a Thursday night with poor sleep, a weekend trip) combine into something far more revealing than any single measurement.

And that "anyone" is the part worth paying attention to. Because the data doesn't just live on your wrist.

Why HIPAA won't protect you

Here's something most people assume incorrectly: that their health data has legal protection.

HIPAA, the Health Insurance Portability and Accountability Act, covers healthcare providers, health plans, and healthcare clearinghouses, entities that handle medical records in a clinical context. Your fitness tracker is none of those things. Fitbit, Garmin, and Apple Watch don't qualify as healthcare entities under HIPAA, which means the data they collect isn't subject to the same rules that bind your doctor or insurer. The fact that a device measures your heart rate doesn't make it a medical device under the law. The fact that it tracks your sleep doesn't make the company storing that data a healthcare provider.

The gap is real and consequential. Without HIPAA coverage, wearable data can be sold to data brokers, shared with insurers, accessed by employers through wellness programs, and handed over to law enforcement with far fewer restrictions than medical records. A hospital cannot sell your diagnosis history to a marketing firm. In most states, a fitness app company can share your health data with third parties as long as it discloses that practice in its privacy policy, a document most users never read. The Federal Trade Commission can step in when companies break their own privacy promises, but that's a much lower bar than HIPAA.

Some U.S. states have moved to fill the gap. Illinois, Washington, and Texas have enacted their own biometric data laws that impose restrictions on how companies can collect and use biometric identifiers like fingerprints and facial geometry. Washington's My Health My Data Act, passed in 2023, extends some protections to consumer health data beyond HIPAA's reach. But these are state-level measures with varying scope and enforcement, and federal protection for consumer wearable data is limited. The FTC's Health Breach Notification Rule, updated in 2024, requires health and fitness apps to tell you if your data is breached or shared without your permission. It doesn't stop them from sharing data you've agreed to share.

The practical legal standard that applies to your fitness data is your device maker's privacy policy, a document most people have never read, and one that companies can update with relatively little friction.

Where your data actually goes

When you agree to a fitness app's terms of service, you're often agreeing to more than you realize. The language is typically broad, the consent bundled into a single "I agree" click, and the downstream destinations for your data are rarely spelled out in plain terms.

Health and life insurers are actively interested in wearable data. Some programs already offer premium discounts in exchange for fitness tracker data, the pitch being that proving you're active earns you lower rates. John Hancock, one of the largest life insurers in North America, announced in 2018 that it would only sell interactive policies that track fitness and health data through wearables and smartphones. The pitch is straightforward: demonstrate healthy behavior and pay less. The flip side is that the same data that rewards you for hitting 10,000 steps could, in a different context, be used to judge your risk, and in most states few laws would stop that.

Data brokers can aggregate health and location data from apps and build consumer profiles sold to marketers, insurers, and employers. Location data from workouts can reveal which neighborhood you actually live in, not just the address you've provided. Behavioral patterns establish routines, when you leave the house, when you return, how often you're sedentary for extended periods. All of it gets packaged, traded, and used in ways that are largely invisible to the person who generated the data.

There's also the platform consolidation question. In 2021, Google completed its $2.1 billion acquisition of Fitbit, as reported by ZDNET. The deal raised immediate questions about where years of biometric history, sleep records, and location data from tens of millions of users might end up inside one of the world's largest advertising companies. Google then required Fitbit users to move to Google accounts by May 19, 2026, and set data from accounts that weren't moved to be deleted after July 15, 2026 (9to5Google). New Fitbit users have had to sign in with a Google account for some time. The acquisition is a clear illustration of how the company holding your health data can change entirely, and how little control users have over that transition when it happens.

Real-world examples of wearable data gone wrong

The privacy risks aren't theoretical. They've already played out, repeatedly, in ways that range from embarrassing to genuinely dangerous.

In 2018, a 20-year-old Australian university student named Nathan Ruser noticed something unusual on Strava's global activity heatmap: bright lines of GPS data in Afghanistan, Syria, and Djibouti. Those weren't civilians jogging. They were military personnel running routes around sensitive bases, and their fitness apps had mapped every one of them. As The Guardian reported, patrol routes, operating patterns, and the outlines of facilities that didn't appear on public maps were all visible in the aggregated data. The shapes of previously undisclosed forward operating bases were traceable from the heatmap alone. The U.S. military began reassessing its wearable device policies in response, and the incident prompted broader conversations about operational security in an era of consumer fitness technology.

It happened again in 2024. French newspaper Le Monde published an investigation called #StravaLeaks, showing that security personnel protecting Joe Biden, Kamala Harris, Donald Trump, Vladimir Putin, and Emmanuel Macron had all exposed sensitive location patterns through fitness apps (AP via ABC News). Bodyguards posted runs near hotels before official visits, inadvertently revealing where protected individuals would be staying. Six years after the original Strava incident, the underlying problem remained unsolved, not because the technology had changed, but because the human behavior around it hadn't.

If people trained in operational security can't consistently protect their location data through fitness apps, it's worth asking what that means for the rest of us. The threat model for most people is different (it's not military adversaries but data brokers, stalkers, employers, and insurers) but the mechanism is the same. Location data collected passively, stored indefinitely, and shared broadly creates exposure that most users never intended.

Wearable devices also carry technical security risks that are separate from data sharing policies. Most sync over Bluetooth, and older or poorly implemented Bluetooth connections have had flaws that let nearby attackers intercept data. Keeping your watch and phone updated closes most known gaps. Weak or reused passwords on fitness accounts create additional exposure, since a breach of your fitness platform could hand an attacker years of intimate health and location history in a single event.

How to protect your privacy on wearables

You don't have to throw your watch in a drawer. A few practical steps make a real difference, and most of them take less time than a single workout.

Read the privacy policy before you set up an account. This sounds obvious, but almost nobody does it. Look specifically for vague language like "partners and affiliates," blanket consent to share data with third parties, or clauses that allow the company to change its data practices with minimal notice. If a policy doesn't explain clearly what data is shared and with whom, assume more is shared than you'd be comfortable with. Many fitness platforms publish summary versions of their privacy practices that are easier to parse than the full legal document.

Limit app permissions. On both iOS and Android, you can restrict what your fitness app can access, including location, contacts, and microphone. Set location access to "While Using" rather than "Always." Turn off background app refresh for apps that don't need it. These settings don't disable the app's core functionality; they just stop it from collecting data when you're not actively using it.

Disable GPS for everyday tracking. If you're not actively mapping a run or ride, there's no reason for your watch to log your location. Most wearables let you toggle GPS independently from step or heart rate tracking. Keeping GPS off by default and enabling it only for intentional workouts significantly reduces the volume of location data being generated and stored.

Make activity maps private and set privacy zones. Apps like Strava and Garmin Connect let you hide the start and end of activities near your home or office and limit who can see your workouts. Set your profile and activities to followers-only or private.

Audit which apps connect to your health platform. Apple Health on iPhone and Health Connect on Android both show you exactly which apps can read your data. Review that list regularly. It tends to grow over time as you install new apps that request health access. Revoke access for apps you no longer use or don't recognize. A fitness app you downloaded two years ago and forgot about may still be pulling your health data every day.

Turn off data sharing with third parties. Most fitness apps offer some opt-out for data sharing with partners. It's usually buried several layers deep in settings, but it's there. Look for options labeled "research," "personalization," or "partner sharing" and opt out where possible. Some platforms also let you opt out of having your data used to train algorithms or improve products.

Use strong, unique passwords and two-factor authentication. Your fitness account holds years of intimate health data. Protect it the same way you'd protect your email or bank account, with a password that isn't reused anywhere else and two-factor authentication turned on, ideally through an authenticator app rather than SMS codes. A credential breach at a fitness platform is a meaningful privacy event, not just an inconvenience.

Delete your data if you stop using a service. Don't just uninstall the app. Most platforms let you request full data deletion through their privacy settings or by contacting support directly. If you've stopped using a device or service, take the extra step and ask for it. Data that no longer exists can't be breached, sold, or subpoenaed.

The goal isn't perfect privacy. That's not achievable with connected devices. The goal is making deliberate choices about what you share and with whom, rather than accepting the defaults that were chosen for you.

Your watch is working. Is your privacy?

Wearables are useful, and you don't have to give one up to protect your privacy. What matters is knowing what you're trading and choosing it on purpose.

• Your tracker collects far more than steps, including heart data, sleep, and precise location.
• HIPAA doesn't cover consumer wearables, so the company's privacy policy sets most of the rules.
• Wearable data can reach insurers, employers, and data brokers, and the company holding it can change hands.
• Public activity maps have exposed military bases and world leaders' bodyguards.
• Limit permissions, keep GPS and activity maps private, audit connected apps, and delete data you no longer need.

Conclusion

Wearables are genuinely useful. They can catch irregular heart rhythms, improve sleep habits, and keep you accountable to your health goals. That's real value, and for many people it translates into measurable health improvements over time.

But every useful thing your fitness tracker does for you, it does by collecting and processing deeply personal data. The question isn't whether to use these devices. It's whether you understand what you're agreeing to when you strap one on, and whether you've taken the basic steps to limit exposure where you can.

Most fitness tracker data sits outside the protections you'd expect. The law hasn't caught up to the hardware. In the meantime, the settings in your device and the terms you agree to are the main line of defense you have. That's not a comfortable position, but it's the current reality.

Start there. Read the privacy policy. Limit the permissions. Delete the data you don't need stored.

Guardio can't change what your watch collects, but it helps protect the accounts that hold that data. It works on your computer and on your iOS or Android phone, blocking phishing pages that try to steal your app logins and alerting you if your email or phone number shows up in a data breach. Get a free security scan with Guardio today and stay protected.

Your body's data is yours. Treat it that way.