Peloton Interactive, Inc. (NASDAQ: PTON) sells connected fitness equipment and subscriptions. Its Privacy Policy (updated October 1, 2025) discloses collection of workout data, heart rate from connected monitors and paired apps, location, and camera- and voice-derived data, plus cookies, pixels, and session replay services used for analytics and interest-based ads. Its U.S. States Privacy Notice says Peloton never sells personal information for money, while acknowledging cookie-based collection by partners may be a 'sale/share' under state law, with opt-outs. In 2021, an unauthenticated API exposed account data including private-profile details, and researchers criticized Peloton's disclosure response; a California class action alleges third-party interception of website chats. Peloton maintains a privacy center and vulnerability disclosure program and is an SEC-reporting public company.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
12 ON FILE
[2025-10-01] · COLLECTION
Peloton's Biometric Data Policy (last updated October 1, 2025) states Peloton may use a member's voiceprint to understand voice commands on voice-equipped products, and that for camera-based features it retains only derived telemetry data, stating that no raw video or image footage is sent to, viewed by, or stored by Peloton.
Peloton's Privacy Policy (last updated October 1, 2025) discloses collection of fitness and workout information including heart rate from paired applications or connected heart rate monitors, workout repetitions, exercises, weights, and equipment used.
Peloton publishes a consolidated Privacy Center linking its Privacy Policy, Cookies Policy, U.S. States Privacy Notice, Consumer Health Data Policy, Biometric Data Policy, and Artificial Intelligence Principles, and names a Data Protection Officer contact for privacy questions.
Peloton Interactive, Inc.'s Form 10-K for fiscal year ended June 30, 2025 (filed with the SEC on August 7, 2025) identifies it as a Delaware corporation listed on Nasdaq under 'PTON' and discloses a dual-class stock structure concentrating voting control among certain directors and Class B holders.
Peloton's Privacy Policy (last updated October 1, 2025) permits advertising affiliates/networks to receive information related to users based on their use of Peloton services, for measurement of content and advertisement effectiveness and campaign suppression.
Peloton's U.S. States Privacy Notice (last updated October 1, 2025) states Peloton never sells personal information to third parties for money, while acknowledging that information collected through cookies and similar technologies by its partners may be considered a 'sale/share' under state privacy laws, and offers an opt-out.
Peloton operates a published coordinated vulnerability disclosure program committing to respond to, investigate, and resolve reports of legitimate security vulnerabilities.
TechCrunch reported on May 5, 2021 that a flaw in Peloton's API allowed unauthenticated requests for user account data, exposing users' age, gender, city, weight, and workout statistics, including details hidden when profiles were set to private.
Pen Test Partners' disclosure of the Peloton API vulnerability (published May 5, 2021) states the issue was reported privately on January 20, 2021, that Peloton acknowledged receipt but did not respond further, that a silent partial fix still exposed data to all authenticated users, and that resolution came only after a journalist contacted Peloton about 90 days later.
On July 5, 2024, the U.S. District Court for the Southern District of California denied Peloton Interactive's motion to dismiss a class action alleging that a third-party AI-powered chat feature on its website aided and abetted an interception under the California Invasion of Privacy Act; the ruling addresses plausibility of allegations, not liability.
A class action complaint filed in California alleges that Peloton's website chat feature routed customer conversations to third-party vendor Drift in real time without notifying users, asserting violations of the California Invasion of Privacy Act; these are allegations, not established findings.
Peloton's Privacy Policy (last updated October 1, 2025) discloses use of cookies, pixels, tags/web beacons, scripts, social media widgets, and session replay services to collect personal information for analytics and to serve interest-based advertising.