A fitness tracker can collect a remarkable amount of information while doing exactly what the customer bought it to do.
Steps. Heart rate. Sleep stages. Exercise. Distance. Weight. Calories. Location during workouts. Sometimes manually entered health information as well.
None of that collection is mysterious when the feature depends on it.
The harder question is what happens after the measurement has served its obvious purpose.
Useful data can have more than one use
Google’s current Google Health documentation says Fitbit and related services can collect health and wellness data including steps, distance, calories burned, weight, heart rate, sleep stages, active minutes, and information from connected services. See Google Health’s privacy FAQ and Fitbit’s privacy policy.
Those records can support the expected functions: showing trends, calculating goals, producing sleep insights, or syncing a workout.
A dataset that rich can also be useful for analytics, product improvement, research, connected services, coaching, fraud prevention, or other secondary processing depending on the product and the user’s choices.
That does not mean every wearable vendor sells health data to advertisers.
In fact, Google currently states that Fitbit and Google Health wellness data is not used for Google Ads. See Google’s continued privacy commitment and Google Health data controls.
That is an important example because it shows why this subject has to be studied from actual policies and data flows rather than assumptions.
“Collected” is not the same as “commercially exploited”
The mere presence of a heart-rate database does not establish an advertising use.
Likewise, a promise not to use health data for ads does not tell you everything about research, service improvement, connected applications, retention, or other forms of processing.
A responsible audit asks separate questions:
- What measurements are collected?
- Which features require them?
- Which outside services can receive them?
- Is research participation optional?
- Are analytics separated from health data?
- Can users download or delete records?
- What happens when a connected third-party app receives a copy?
The distinction between primary use and secondary use is the important one.
Wearables make intimate data routine
A browser history can hint at health interests.
A wearable may directly measure sleep, pulse, movement, or exercise.
That does not automatically make the device sinister. It makes transparency unusually important because the product works by collecting information the user would rarely have generated before wearing it.
The Surveillance Economy is not only about secret collection.
Sometimes the user knowingly supplies the raw material because the feature is genuinely useful.
The harder question comes later:
What else is the dataset allowed to become?