Data Privacy in Fitness Apps: What You Are Actually Sharing

By Noah Sato

Who This Matters Most For

This explainer is written for anyone who has a fitness, running, cycling, or wearable app installed on their phone, which by now covers a large share of smartphone owners. It matters most for people who track outdoor routes with GPS, wear a smartwatch or ring around the clock, log menstrual or fertility data, or connect several apps together through Apple Health or Google Fit. It’s also relevant if you’ve joined an employer wellness program or an insurer’s activity-based discount plan, since those setups add another layer of data sharing on top of whatever the app itself already does.

What Data Fitness Apps Typically Collect

A typical fitness app doesn’t just ask for one type of information. It usually requests permission for several categories at once, and most people accept the defaults during setup without reading each request closely. Here’s what tends to be collected, grouped by type.

Location data. Running and cycling apps need GPS to draw your route, but many request “always on” location access rather than access limited to when the app is open. That distinction determines whether the app can log your whereabouts only during a workout or continuously throughout the day.

Biometric and health metrics. Heart rate, resting heart rate trends, blood oxygen readings, sleep stages, VO2 max estimates, and step counts are standard for anything paired with a wearable. This category is often synced automatically into a broader health profile.

Body and demographic details. Height, weight, age, sex assigned at birth, and sometimes goals like weight loss or muscle gain are collected to personalize calorie or training recommendations.

Reproductive health data. Menstrual cycle tracking, ovulation predictions, and pregnancy status are collected by a large category of apps that overlap with general fitness and wellness tracking. Regulators have treated this category as especially sensitive, for reasons covered in the incidents section below.

Device and behavioral identifiers. Advertising IDs, device IDs, IP addresses, and Wi-Fi network identifiers are collected quietly in the background, often through embedded third-party code rather than the app’s own features.

Social and account data. Friends lists, workout photos, in-app messages, email addresses, and payment details round out the picture for apps with a social or premium-subscription component.

How That Data Gets Monetized and Shared

Free and low-cost fitness apps still cost money to build and run, and advertising built on user data is one of the more common ways developers cover that cost. The mechanism usually isn’t the app selling a spreadsheet of your data directly. Instead, developers embed a software development kit, or SDK, from an analytics or advertising company inside the app itself. Once installed, that SDK can independently collect information such as your device identifiers, precise location, and app activity, then transmit it back to the third-party company that built the SDK, sometimes without the app’s own engineers fully controlling what leaves the device.

This is exactly the pattern regulators have documented in enforcement actions. According to the Federal Trade Commission’s complaint against the Premom ovulation and fertility app, the company integrated SDKs from AppsFlyer, Google, and the Chinese analytics firms Umeng and Jiguang, and those SDKs collected users’ precise geolocation, social media account details, and non-resettable device and Wi-Fi identifiers, sharing them for advertising purposes. In a separate case, the FTC found that the prescription discount and telehealth platform GoodRx shared users’ prescription medication history and health conditions with Facebook, Google, and Criteo, then used that data to build lists of people who had purchased specific medications so it could target them with related ads on Facebook and Instagram. The online counseling service BetterHelp followed a similar path, disclosing consumers’ email addresses and mental-health questionnaire answers to Facebook, Snapchat, Criteo, and Pinterest for advertising, despite telling users it would keep that information private.

Once shared, data can flow further than the original recipient. Advertising platforms often use it internally for their own research or ad-targeting improvements, and some third parties resell or combine it with other sources into broader profiles. That’s part of why the FTC’s orders in these cases specifically required the companies to direct third parties to delete the data that had already been shared, on top of stopping future sharing.

Real, Documented Privacy Incidents

These aren’t hypothetical risks. Several fitness and health app data-sharing practices have already been investigated, exposed publicly, or penalized by regulators.

The Strava heatmap (January 2018). In November 2017, the fitness tracking company Strava published an updated global “heatmap” built from more than a billion aggregated activity uploads. Two months later, military analyst Nathan Ruser noticed the map was detailed enough to outline the shape and layout of military bases in Afghanistan, Djibouti, and Syria, since so many of the exercise routes uploaded from those locations belonged to foreign military personnel jogging around a base perimeter. The Guardian reported that bases invisible on standard commercial satellite maps were clearly traceable through Strava’s heatmap, along with a lone cyclist’s route near the Nevada test site commonly known as Area 51. Strava subsequently updated its privacy tools and encouraged military users to opt out of the heatmap.

FTC v. GoodRx (February 2023). The FTC’s first enforcement action under its Health Breach Notification Rule found that GoodRx had, since at least 2017, promised users it would never share personal health information with advertisers, then repeatedly shared prescription and health-condition data with Facebook, Google, Criteo, and other companies anyway. GoodRx agreed to a $1.5 million civil penalty and a proposed order barring it from sharing health data for advertising going forward.

FTC v. BetterHelp (March 2023). BetterHelp collected sensitive mental-health questionnaire answers, then used consumers’ email addresses and therapy history to help Facebook identify similar users to target with ads, according to the FTC’s complaint. The company agreed to pay $7.8 million to affected consumers and accepted limits on future data sharing.

FTC v. Easy Healthcare / Premom (May 2023). The maker of the Premom ovulation and fertility-tracking app was found to have shared users’ menstrual cycle, fertility, and pregnancy information, along with precise geolocation and non-resettable device identifiers, with third parties including AppsFlyer and Google, and with Chinese analytics firms Umeng and Jiguang, without adequate consent. The company agreed to a $100,000 civil penalty plus $100,000 to settle related state claims, and to a permanent ban on sharing health data for advertising.

What Privacy Laws Require App Makers to Disclose

No single law covers every fitness app the same way, which is part of why enforcement has come from several directions at once.

The FTC’s Health Breach Notification Rule. This rule requires vendors of personal health records, and apps that function like one, to notify consumers, the FTC, and sometimes the media after an unauthorized disclosure of identifiable health data, even though these apps generally aren’t covered by HIPAA. In May 2023 the FTC proposed amendments to modernize the rule, explicitly stating that “health apps and other direct-to-consumer health technologies, such as fitness trackers, have become commonplace” since the rule was first issued, and clarifying that the rule applies to this newer category of apps.

GDPR, for users connected to the EU. Article 9 of the General Data Protection Regulation classifies health data, along with genetic and biometric data, as a “special category” subject to a general processing prohibition unless a specific legal basis applies, such as explicit consent. This is a stricter default than most US law, and it’s why apps operating internationally often build separate consent flows for EU users.

CCPA/CPRA, for California residents. California’s privacy law defines “sensitive personal information” to include precise geolocation and health data, and gives consumers the right to know what categories of information a business collects, request deletion, and opt out of the sale or sharing of their data through mechanisms like a “Do Not Sell or Share My Personal Information” link or a browser-level global privacy control signal.

In practice, these frameworks combine to create disclosure obligations, such as app store privacy labels and in-app privacy policies, plus, in several documented cases, real financial penalties when a company’s actual data-sharing practices contradict what it promised users.

Practical Steps to Check and Limit What You’re Sharing

You don’t need to delete every fitness app to reduce your exposure. A handful of settings changes cover most of the risk:

1. Open your phone’s system-level app permissions and switch location access from “Always” to “While Using the App” for anything that doesn’t need background tracking.

2. Inside the app itself, look for a privacy or “data sharing” section and turn off options labeled personalized advertising, partner sharing, or third-party analytics.

3. Review which apps are connected to Apple Health or Google Fit, and disconnect any you no longer actively use, since each connection widens the aggregated profile.

4. Set activity, route, and leaderboard visibility to private or followers-only instead of public, especially for apps that display a start and end point for each route.

5. Before downloading a new app, check its app-store privacy label (Apple’s “App Privacy” section) or Google Play’s “Data safety” section, which list the categories of data the developer says it shares.

6. If you live in California or another state with a comparable law, use the app’s opt-out or “Do Not Sell or Share” link, and submit a data-deletion request for accounts you no longer use.

Common Fitness App Permissions and What They Reveal

Permission requests aren’t all equally risky. This table breaks down what each common request actually exposes.

Checklist: Privacy Settings to Check on Your Fitness App

A Worked Example: Reviewing a Running App’s Settings

Here’s what this process looks like in practice, using a composite, realistic scenario rather than any specific real app.

Maria has used a running app for two years to track her routes and pace. She opens the app’s settings menu and taps “Privacy.” The first screen shows her location permission is set to “Always,” left over from the original setup. She switches it to “While Using the App,” then tests a short walk around the block to confirm the app still records the route correctly. It does.

Next she scrolls down and finds a toggle labeled “Personalized ads and partner offers,” switched on by default. She turns it off. Below that is a section titled “Connected apps,” where she discovers the app is still linked to an old calorie-counting app she stopped using more than a year ago. She revokes that connection.

She then checks her route visibility settings and finds her runs have been public since she created the account, meaning anyone can see the start point of her regular route, which happens to be her front door. She sets visibility to “followers only” and removes the map thumbnail from her public profile.

Finally, she opens her phone’s system settings, checks the app store’s privacy label for the app, and confirms it discloses sharing location and usage data with advertising partners, information she hadn’t noticed when she first installed it. The whole process takes about ten minutes and doesn’t require deleting the app or losing her workout history.

Common Mistakes People Make

What Privacy Researchers and Regulators Say

When the Strava heatmap issue surfaced, open-source intelligence analyst Nathan Ruser was the one who first flagged the pattern publicly, noting that while the map “looks very pretty,” it was “not amazing for Op-Sec,” since bases were “clearly identifiable and mappable” from jogging routes alone. His observation became a widely cited example of how aggregated, seemingly harmless fitness data can expose sensitive information that no single user intended to reveal.

On the regulatory side, Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, made a similar point when announcing the GoodRx settlement: “Digital health companies and mobile apps should not cash in on consumers’ extremely sensitive and personally identifiable health information.” Announcing the BetterHelp order the following month, he added that people using mental-health services do so “in a moment of vulnerability and with an expectation that professional counseling services will protect their privacy.”

Lawmakers behind both the GDPR and CCPA arrived at a related conclusion through legal drafting rather than enforcement: both frameworks single out health and precise location data as categories deserving extra protection, rather than treating them the same as ordinary account information like a username. That consistent pattern, showing up independently in a security analyst’s casual observation, an FTC director’s public statements, and two separate legislative frameworks, is a strong signal that fitness and health data sit in a genuinely different risk category from most other app data.

A Note on Scope

This article is general consumer-education information, not legal advice, and it isn’t a substitute for reading a specific app’s current privacy policy. Laws, company policies, and app settings all change over time, and a setting described here as available in one app’s menu may be labeled differently, or located somewhere else, in another. Always verify the current settings directly inside the app you’re using before relying on any single description of how it handles data.

Frequently Asked Questions

References