Fitbit Ace 3

As of January 14, 2021, Google officially became the owner of Fitbit. That worried many privacy conscious users. However, Google promised that “Fitbit users’ health and wellness data won't be used for Google ads and this data will be kept separate from other Google ad data” for at least 10 years as part of the deal with global regulators. However, Fitbit and Google announced in 2022 that a Google account will be required for some uses of Fitbit starting in 2023. And in 2025, Google accounts will likely be required to use a Fitbit, indicating Google has plans to bring Fitbit users into the Google ecosystem as much as they can.

What’s this mean? As a parent, you must create a Fitbit account (or soon, a Google account) and then from there create a family account where you will create an account for your kid to use the Fitbit Ace. And remember, Fitbit can collect a good amount of data, as most fitness trackers do. They say they collect things such as name, date of birth, gender, height, and weight of your child if you choose to provide it as well as body related data like steps, activity, sleep, and more. Fitbit also says they can collect data on things like IP addresses, app and mobile device information (including cookie and application identifiers) when your kid accesses their account. Fitbit does say they limit some of the sharing of personal information of your kids with the limited connections you set up for them in the app. However, they do say they can share some personal information of your child for things like external processes through business affiliates and service providers and if their business is sold.

And remember, all this applies to children up to the age of 13. Once your child turns 13 (or the eligible age for kids in your country), then Fitbit says your child will be eligible to independently manage their own account if they choose, and you as a parent will no longer have access or control over it through your Fitibt account.

Also remember, Fitbit can collect data from third parties social media sites like Facebook and Google on your main Fitibit account if you choose to connect them (please, don’t) and from employers and insurance companies if you choose to share to receive wellness benefits or discounted or free services (again, not a good idea).

How does Fitbit use all this personal information it collects? Well, the good news is their privacy policy says they never sell your data. They also say they can share your personal information (from you main account, not from your child’s account) with advertising partners for targeted, interest-based advertising across the internet, which isn’t good news. And they say they can use that information to make inferences about you to show you more relevant content -- like using your sleep data to show you content to help you sleep better, which I’m pretty sure wouldn’t actually help me sleep better. So yeah, your Fitbit data is being used to show you ads and keep you using the platform as much as possible. Not surprising, but not great either.

Fitbit also says it can share non-personal information that has been de-identified or aggregated. This is pretty common, but still, can be a bit of a concern as it’s been found to be pretty easy to de-anonymize these data sets and track down an individual’s patterns, especially with location data. So, be aware with Fitbit--or any fitness tracker--you are strapping on a device that tracks your location, heart rate, sleep patterns, and more. That's a lot of personal information gathered in one place.

What’s the worst that could happen with a Fitbit and all the personal and health related data it can collect? Well, in 2021 it was reported that health data for over 61 million fitness tracker users, including both Fitbit and Apple, was exposed when a third-party company that allowed users to sync their health data from their fitness trackers did not secure the data properly. Personal information such as names, birthdates, weight, height, gender, and geographical location for Fitbit and other fitness-tracker users was left exposed because the company didn't password protect or encrypt their database. This is a great reminder that yes, while Fitbit might do a good job with their own security, anytime you sync or share that data with anyone else including third party apps, your employer, or a insurance company, it could be vulnerable. And with your children’s data, well, that’s something you probably don’t want to get in the hands of anyone else. No one needs to know your kid’s sleeping patterns..

One final consideration. This device tracks the activity and sleep of a child. Parents should ask themselves, is this information something I want gathered and potentially accessible to others if there were a data leak or security vulnerability? Also, we think there is a good question to be raised about teaching young children that this level of digital surveillance in their lives is OK. Maybe we should track kids a little bit less, and teach them constant surveillance isn’t a good thing?