Weaponizing Your Fitness Tracker Against You
Where
Common Ground
BSides Las Vegas
Duration
39 min
Explains how fitness tracker and health app data could be reached by law enforcement, and which protections apply.
Summary
The talk argues that fitness trackers and health apps hold sensitive body and location data that law enforcement could seek in a post-Roe environment. It first lays out the legal process ladder: subpoenas return metadata, while warrants return full content, and keyword or geofence warrants begin with data rather than a suspect. Consent searches of phones are presented as a way police skip those protections, so the advice is to decline them.
Next, the speaker explains that HIPAA generally does not cover data created by consumer wearables, because users and app makers are not covered entities. Examples include routes from apps that exposed sensitive locations, body temperature readings that can indicate ovulation, cycle trackers that shared data with advertisers, and embedded ad and analytics libraries. Permission models vary: Apple Health allows app-by-app choices, Google Fit offers coarser controls, and Apple states that its health data is end-to-end encrypted in cloud storage.
The closing section notes that fitness data has so far been treated as circumstantial, with prosecutions focusing on messages and search history. Practical steps include reviewing each vendor's transparency reports and privacy policies, limiting location history and tracking identifiers, and weighing individual risk before choosing a tracker or period app. Specialist privacy groups are recommended for deeper guidance.
Related talks
Talks·55 min
Bill Budington · Lena Cohen
Explains how a few location data brokers collect and sell device location data, and what individuals and developers can do.
Talks·1 hr 25 min
Joshua Aaron
Explains the design, growth and safeguards of the anonymous ICEBlock app for reporting immigration enforcement sightings.
Talks·42 min
Robert Stribley
Surveys six ways AI erodes privacy, from opaque data sharing to deepfake misuse, and suggests design guidelines to respond.


