Fitbit

HEALTH & FITNESS

LAST UPDATED 4 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Fitbit is a wearables and fitness-tracking platform acquired by Google (Alphabet) on January 14, 2021. Its devices continuously collect sensitive biometric and behavioral data — steps, heart rate, sleep stages, weight, and precise geolocation — and its App Store privacy label lists twelve data categories collected and linked to user identity. The Fitbit Privacy Policy (updated February 27, 2026) states Fitbit never sells personal information, though it works with third-party analytics and advertising partners. As a condition of EU merger clearance (December 2020), Google is bound for ten years not to use EEA users' Fitbit health and wellness data for Google Ads, with the data kept in a trustee-monitored silo. Fitbit accounts were retired on May 19, 2026; a Google Account is now required, making Google the data controller. Advocacy group noyb filed GDPR complaints in 2023 alleging forced consent to data transfers outside the EU.

TRACK RECORD

1 ENFORCEMENT ACTION

[2020-12-17]

The European Commission's December 17, 2020 Fitbit merger conditions include an independent monitoring trustee — appointed before closing, with access to Google's records, personnel, facilities, and technical information — to monitor implementation of the ten-year commitments, plus a fast-track dispute resolution mechanism invocable by third parties.

ec.europa.eu ↗

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

TOOLS WE RECOMMEND

PLUS

RECEIPTS

12 ON FILE

COLLECTION

Google's product safety page for Fitbit/Google Health states that users can see what data is collected and why in app or Google Account settings, and choose what data to save or delete — a published data-visibility and control commitment.

safety.google ↗

[2026-02-27] · COLLECTION

The Fitbit Privacy Policy (last updated February 27, 2026) states that Fitbit devices collect metrics including steps, distance, calories burned, weight, heart rate, sleep stages, active minutes, and location, and that services use precise geolocation data from GPS signals, device sensors, Wi-Fi access points, and cell tower IDs when the user grants location access; users can delete their account, with most information deleted within 30 days and up to 90 days for backups.

web.archive.org ↗

OWNERSHIP TRANSPARENCY

Google's help page 'Our Continued Commitment To Data Privacy and Security' states that support for legacy Fitbit accounts ended on May 19, 2026, that a Google Account is now required to use the service (Google Health), and that Google is the data controller for users signed in with a Google Account.

web.archive.org ↗

[2021-01-14] · OWNERSHIP TRANSPARENCY

Google announced on January 14, 2021 that it had completed its acquisition of Fitbit, stating the deal was 'about devices, not data' and citing binding commitments to global regulators that Fitbit users' health and wellness data won't be used for Google ads and will be kept separated from other Google ads data.

blog.google ↗

[2020-12-17] · SHARING

In its December 17, 2020 merger clearance of Google's acquisition of Fitbit, the European Commission made approval conditional on commitments including that Google will not use EEA users' Fitbit health and wellness data for Google Ads, will keep that data in a technical 'data silo' separate from other Google data used for advertising, and will let EEA users grant or deny use of that data by other Google services; the commitments run ten years, extendable by up to ten more for the Ads Commitment.

ec.europa.eu ↗

[2024-11-08] · SHARING

The service's policy indicates the service explains how to prevent disclosure of personal information to third parties.

fitbit.com ↗

[2026-02-27] · SHARING

The Fitbit Privacy Policy (last updated February 27, 2026) states that Fitbit never sells users' personal information and does not share personal information except in limited described circumstances, such as when the user directs it, for external processing by service providers, or for legal reasons.

web.archive.org ↗

[2011-07-03] · TRACK RECORD

In July 2011, TechCrunch reported that manually logged sexual activity of Fitbit users appeared in Google search results because profile and activity records were publicly searchable under Fitbit's default privacy settings; Fitbit subsequently hid activity records and changed defaults.

techcrunch.com ↗

[2020-12-17] · TRACK RECORD

ec.europa.eu ↗

[2023-08-31] · TRACK RECORD

On August 31, 2023, the European privacy advocacy group noyb filed complaints against Fitbit with data protection authorities in Austria, the Netherlands, and Italy, alleging that Fitbit forces new app users to consent to data transfers outside the EU without a way to withdraw consent short of deleting the account; these are pending allegations, not findings.

noyb.eu ↗

TRACKING TECH

As of August 2026, the Fitbit iOS app's Apple App Store privacy label lists twelve data categories as 'Data Linked to You' — Health & Fitness, Purchases, Location, Contact Info, Contacts, User Content, Search History, Identifiers, Usage Data, Sensitive Info, Diagnostics, and Other Data — while declaring no 'Data Used to Track You' section (no cross-app tracking declared).

apps.apple.com ↗

[2026-02-27] · TRACKING TECH

The Fitbit Privacy Policy (last updated February 27, 2026) discloses that Fitbit works with third-party partners providing analytics and advertising services — including serving advertisements on Fitbit's behalf across the internet and measuring their performance — and that these companies may use cookies and similar technologies.

web.archive.org ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7