Consumer Apps · Health/Fitness (connected equipment) · Private litigation
Peloton
Headline
A proposed class action in California federal court (Jones v. Peloton Interactive, S.D. Cal., filed 2023; Peloton's motion to dismiss was denied July 5, 2024) alleges Peloton recorded live customer-service CHAT…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
A proposed class action in California federal court (Jones v. Peloton Interactive, S.D. Cal., filed 2023; Peloton's motion to dismiss was denied July 5, 2024) alleges Peloton recorded live customer-service CHAT conversations — the ones you'd have troubleshooting your bike or resolving a billing issue — and handed that data to an AI-focused MARKETING FIRM without telling you. On top of that, Check Point researchers reported in July 2023 that the Peloton Tread treadmill ran Android 10, missing fixes for more than 1,000 flaws addressed in later Android versions, with USB debugging enabled (Peloton said exploitation requires physical access), meaning someone with physical access to the hardware in your own home could potentially install malware or extract data through the machine itself — a hardware-level vulnerability that has nothing to do with what workout data you actually agreed to share.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Proposed California Invasion of Privacy Act (CIPA) class action (Jones v. Peloton Interactive, No. 23-cv-1082, S.D. Cal.; motion to dismiss denied July 5, 2024): alleges Peloton recorded online chat conversations between customers and Peloton customer-service representatives on its website, then turned that data over to a THIRD-PARTY AI-FOCUSED MARKETING FIRM without customer permission — a customer-service-chat-specific privacy issue distinct from the fitness-data-sharing concerns common elsewhere in this category.
Data sharing
A 2021 API vulnerability reported by Pen Test Partners let unauthorized requesters pull private account data of Peloton users (user IDs, location, workout stats, gender and age) on a platform with over 3 million subscribers; per the researchers, Peloton gave no substantive response for about 90 days after the Jan. 2021 report and largely fixed it within 7 days of press contact in May 2021. Separately, Check Point researchers reported in July 2023 that the Peloton Tread ran Android 10 (missing fixes for more than 1,000 flaws addressed in later versions) with USB debugging enabled, and showed that someone with physical access could sideload a remote-access tool giving full control of the device, including audio recording, photos and geolocation (Peloton said it meets expected security measures for Android devices and that physical access is required) — a hardware-level vulnerability distinct from the typical software/data-sharing issues found elsewhere in this tracker.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy peloton.com/legal-policies/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service peloton.com/legal-policies/terms-of-service | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.