Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Weaponizing Your Fitness Tracker Against You

Wendy Knox Everette

PrivacyCommon Ground39 minBeginnerOpen on YouTube ↗

Where

Common Ground
BSides Las Vegas

Duration

39 min

Explains how fitness tracker and health app data could be reached by law enforcement, and which protections apply.

Summary

The talk argues that fitness trackers and health apps hold sensitive body and location data that law enforcement could seek in a post-Roe environment. It first lays out the legal process ladder: subpoenas return metadata, while warrants return full content, and keyword or geofence warrants begin with data rather than a suspect. Consent searches of phones are presented as a way police skip those protections, so the advice is to decline them.

Next, the speaker explains that HIPAA generally does not cover data created by consumer wearables, because users and app makers are not covered entities. Examples include routes from apps that exposed sensitive locations, body temperature readings that can indicate ovulation, cycle trackers that shared data with advertisers, and embedded ad and analytics libraries. Permission models vary: Apple Health allows app-by-app choices, Google Fit offers coarser controls, and Apple states that its health data is end-to-end encrypted in cloud storage.

The closing section notes that fitness data has so far been treated as circumstantial, with prosecutions focusing on messages and search history. Practical steps include reviewing each vendor's transparency reports and privacy policies, limiting location history and tracking identifiers, and weighing individual risk before choosing a tracker or period app. Specialist privacy groups are recommended for deeper guidance.

Related talks