Fitbit (Google)

HIPAA — the law most people assume protects their health data — does NOT cover Fitbit at all, because it only applies to hospitals, health plans, and their direct business associates, not consumer wearables. Fitbit collects heart rate, sleep, and location data just as sensitive as what a doctor's office gathers, with none of the same federal legal protection.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Data sharing

STRUCTURAL FLAG: HIPAA does NOT apply to Fitbit (or any consumer wearable maker) since HIPAA only covers hospitals, health plans, and their business associates — not consumer apps, even though wearables collect equivalent sensitive data (heart rate, sleep, location, reproductive-health-adjacent metrics). A study cited in prior research reportedly found that 79% of popular health/fitness apps share data with third parties (the attribution to Duke University and the figure were not verified this pass). Prior research reported that Fitbit was named in class litigation alleging sharing of heart-rate/sleep data beyond reasonable consumer expectations — no such case or MDL was located this pass, and it should not be cited without a docket; separately, a 2021 unsecured database (belonging to third-party company GetHealth, not Fitbit directly) reportedly exposed about 61 million Apple/Fitbit-linked user records (per security-researcher reports; not re-verified this pass) including names, birthdates, weight, height, and location — illustrating how data can leak through companies users have never heard of, buried in a device maker's own terms and conditions. Google announced its agreement to acquire Fitbit on November 1, 2019 (widely reported at about $2.1B), completed the acquisition January 14, 2021, and made binding commitments to regulators that Fitbit health and wellness data would not be used for Google ads; precedent is mixed since Google initially kept Nest separate after its 2014 acquisition and later folded it into Google's broader ecosystem (timing not verified this pass).

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.