Review date: Aug. 9, 2022
If you want to hit your personal best and kick life’s butt, you’ve already wasted too much time reading this sentence. Your metabolic rate has dropped 2% lower than a sprinting cheetah. Just kidding. Fitbit, Google's GPS tracking, heart rate monitoring, sleep tracking, stress managing, stairs climbed, calories burned, swim proof line of fitness tracker pairs with your phone and computer to tell you if you are, indeed, kicking life’s butt (or if life is kicking your butt instead). Good luck with that!
Update: In June 2022, after Roe vs Wade was overturned allowing US states to make access to abortion illegal, we took another look at the privacy and security of Google's Ftibit fitness trackers that can track menstrual cycle data. Our updated review is below. Overall, Fitbit is owned by Google, for better and for worse. That means your data is owned by the advertising giant (although not used for advertising, according to them). It also means Google has the resources to push back against law enforcement requests for data if they chose.
What could happen if something goes wrong?
As of January 14, 2021, Google officially became the owner of Fitbit. That worried many privacy conscious users. However, Google promised that “Fitbit users’ health and wellness data won't be used for Google ads and this data will be kept separate from other Google ad data” as part of the deal with global regulators when they bought Fitbit. This is good.
And Fitbit seems to do an OK job with privacy and security. It de-identifies the data it collects so it's (hopefully) not personally identifiable. We say hopefully because, depending on the kind of data, it’s been found to be pretty easy to de-anonymize these data sets and track down an individual’s patterns, especially with location data. So, be aware with Fitbit—or any fitness tracker—you are strapping on a device that tracks your location, heart rate, sleep patterns, and more. That's a lot of personal information gathered in one place.
What is not good is what can happen with all this very personal health data if others aren't careful. A recent report showed that health data for over 61 million fitness tracker users, including both Fitbit and Apple, was exposed when a third-party company that allowed users to sync their health data from their fitness trackers did not secure the data properly. Personal information such as names, birthdates, weight, height, gender, and geographical location for Fitbit and other fitness-tracker users was left exposed because the company didn't password protect or encrypt their database. This is a great reminder that yes, while Fitbit might do a good job with their own security, anytime you sync or share that data with anyone else, it could be vulnerable. And Fitbit partners with many third parties such as employers and insurance companies. I don’t know about you, but I don’t need the world to know my weight and where I live. That’s really dang creepy.
Update, August 2022 following the overturn of Roe vs Wade protection reproductive health rights in the United States.
Fitbit seemingly hasn't focused much time and resources into developing period and pregnancy tracking features in their app, at least according to the users who want such features. The Fitbit app does allow for period tracking though. And the app, like most wearable tracking apps, collects a whole bunch of person, body-related data that could potentially be used to tell if a user is pregnant.
As for how Fitbit says they share data with law enforcement, they say, "We may preserve or disclose information about you to comply with a law, regulation, legal process, or governmental request; to assert legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of our terms, or threats to the security of the Services or the physical safety of any person. Please note: Our policy is to notify you of legal process seeking access to your information, such as search warrants, court orders, or subpoenas, unless we are prohibited by law from doing so. In cases where a court order specifies a non-disclosure period, we provide delayed notice after the expiration of the non-disclosure period. Exceptions to our notice policy include exigent or counterproductive circumstances, for example, when there is an emergency involving a danger of death or serious physical injury to a person." It's a least nice Fitbit notes to users their policy to notify you if there is a legal request to access your data. With this much sensitive data collect, we would like to see them clarify even more that they won't give up user data to law enforcement unless required to under subpoena, and even then, we like to see them commit to only giving up the bare minimum necessary.
Fitbit isn't the wearable we'd trust the most with our private reproductive health data. Apple, Garmin, Oura all make us feel a bit more comfortable with this personal information. That said, Fitbit also doesn't have a pregnancy tracker and seems to have more limited period tracking in their app, which might be good in the long run. There are better options out there, all around.
Tips to protect yourself
- Follow Fitbit's advice to keep your stats private
- Stop sharing friends' lists: Under “Friends” on your profile page, select Privacy Setting and then Private.
- When you no longer use the app, go to "Delete account" in the app menu
- Turn off precise location sharing!
- Chose a strong password! You may use a password control tool like 1Password, KeePass etc.
- Use your device privacy controls to limit access to your personal information via app (do not give access to your camera, microphone, images and videos)
- Keep your app regularly updated
- Limit ad tracking via your device (eg on iPhone go to Privacy -> Advertising -> Limit ad tracking) and biggest ad networks (for Google, go to Google account and turn off ad personalization)
Can it snoop on me?
What can be used to sign up?
What data does the company collect?
Name, date of birth, gender, photo (optional)
Heart rate, movement, sleep data, menstrual cycle, and more
How does the company use this data?
How can you control your data?
What is the company’s known track record of protecting users’ data?
Unfortunately, Fitbit's security measures did not prevent the major data leak of 61 million fitness tracker data records, including Fitbit user data, by the third-party company GetHealth. In September 2021, a group of security researchers discovered GetHealth had an unsecured database containing over 61 million records related to wearable technology and fitness services. GetHealth accessed health data belonging to wearable device users around the world and leaked it in an non-password protected, unencrypted database. The list contained names, birthdates, weight, height, gender, and geographical location, as well as other medical data, such as blood pressure.
Child Privacy Information
Can this product be used offline?
User-friendly privacy information?
Links to privacy information
Does this product meet our Minimum Security Standards?
To create a Fitbit account, users are required to provide strong, complex, passwords during onboarding.
Period-tracking apps face intense data privacy scrutiny in wake of Roe reversalAndroid Police
Fitbit fitness tracker detects woman's pregnancyCBS News
How to use Fitbit’s female health tracking toolThe Verge
61M Fitbit, Apple Users Had Data Exposed in Wearable Device Data BreachHealth IT Security
Fitbit faces anger for setting limits on women's periodsBBC
Got a comment? Let us hear it.