Peloton Tread

Peloton became one of the go-to workout machines for those who could afford them during the pandemic. They’ve had a rough 2021 though. Here’s what happened. Peloton sells expensive treadmills alongside their popular exercise bikes. Tragically, a 6-year old was killed in an accident on one of these treadmills. Due to safety concerns, Peloton issued a recall and added a feature called Tread Lock that requires a four-digit passcode to keep their treadmills from starting up for anyone without authorized access.

Sounds great, right? Here’s the problem. Peloton treadmill users needed that Tread Lock four-digit passcode to unlock their treadmill and Tread Lock required a $39 per month subscription. If users cannot unlock their treadmill, they can’t use the machine at all. Peleton offered the Tread Lock subscription at no cost for three months and in August updated that so all Tread owners could access Tread Lock and Just Run without a subscription. This is good as many Peloton users worried their costly treadmills would turn into expensive towel racks - not something they signed up for when they bought the treadmill. This issue of who owns and controls a connected device after purchase will almost certainly be a growing concern in the years ahead. Especially with a company like Peloton, which makes quite a lot of money off the content sold to users of their workout equipment.

As for Peloton’s privacy, they do a decent job. They say they don’t sell your personal information. They may share your information with third parties for marketing after they de-identify it, which is normal and generally ok, although we should probably put out that many privacy researchers have demonstrated how it can be relatively easy to de-anonymize such data. Unfortunately, we could find no mention of their data retention or deletion policies. In early 2021, a bug in the Peloton system reportedly exposed personal user data on their servers, including gender, age, location, and more, to anyone on the internet. It appears to be fixed now, but what's not good is that it took Peloton more than three months — and a call from a journalist — to address the vulnerability, according to the security researcher who discovered the problem.

What’s the worst that could happen? Well, a child dying is pretty much the worst thing that could happen. We’re glad Peloton worked to fix this problem. We hope nothing like that ever happens again.