The scale at which some fitness apps collect significant amounts of data about users has been revealed by new analytics - including apps that may share the information with so-called 'data harvesters'.
The data collected includes individuals' precise locations and financial information about the photos they took. Of the ten apps analyzed, seven collected photos from users and five collected users' exact current location.
The vast majority of users probably know that the apps they have on their phones legitimately store some personal information, such as email addresses and their names. However, the lengthy Ts & Cs that come with each download mean that they may not be aware of the amount of information they are giving away.
Researchers from data protection service Incognit analyzed 10 apps in the Google Play Store on March 27: Strava, Fitbit, AllTrails, Calm, Flo, Runna, MyFitnessPal, Headspace, Calorie Counter, ShutEye.
They noted the wide range of user information that the apps collected and shared (such as precise location, name, email, health information, fitness information, photos, app interactions, other user-generated content, other actions, crash logs, diagnostics, other app performance data, device or other identifiers).
The results showed that the fitness apps Fitbit and Strava collected the most personal information and that all but three apps (Fitbit, Fl, Calorie Counter) shared data with third parties.
Running coaching app Runna collected 13 data points and shared them all with third parties such as 'data brokers' - including users' exact location, name and email addresses, photos and health and fitness information. The hiking app AllTrails collected and shared eight data points about the people who use it.
Seven out of ten apps analyzed collected users' photos (FitBit, Strava, AllTrails, Flo, Calorie Counter, Runna, MyFitnessPal) and five collected their exact current location (Fitbit, Strava, AllTrails, Runna, MyFitnessPal). This means app developers can 'see' where people regularly travel to or even their home.
Fitbit was found to have collected the most data points about their users, with 21 different types of information. Strava collected 19 different species.
Data collection is something users should be aware of. Brokers can collect information from apps and social networking sites and combine it with other publicly available information. This data can even be used for background checks by employers or checks by insurers.
Darius Belejevas, head of data protection service Incognit, comments: "Apps that record and track exercise data could be a great motivational tool that millions of Brits use to get more out of their workouts, eat better, keep running or just stay active . But without realizing it, many of us are giving away personal data that not only shows how many calories we ate or how many steps we walked, but also reveals the precise location of where and when we took those steps.
"Sensitive, personal health and fitness information is extremely valuable to data brokers because there are hundreds of interested parties - both legal and illegal - willing to pay for such information, including insurance companies and marketers. It is particularly concerning that some apps collect 'other information' and 'other user-generated content' without specifying what these vague terms mean."
Gaël Duval, co-founder and developer of the privacy-focused operating system /e/OS, said: "Many of these apps are marketed as 'free', but people don't realize that their data is now a means of payment. Free and paid apps ask for certain permissions during installation that allow them to collect and sell your data to data brokers. This is often disguised as part of the app's functionality, but in reality the data is then passed or sold to data brokers, who resell it for advertising purposes and more.
"Data brokers collect/analyze user data from various sources to create a detailed profile of a person and resell it for a profit. The data collected about you in apps can range from things like age and location to medical information and sexual interests. It is then used to build an accurate picture of your habits, allowing advertisers and big tech companies to deliver increasingly relevant content and product suggestions, encouraging you to spend more time and money online, to the detriment of your mental health and finances ."
Yahoo News has reached out to the apps for comment.
Fitbit21 data points collected
0 shared with third parties
Strava: running, cycling, walking19 data points collected
3 shared with third parties (crash logs, diagnostics, device or other IDs)
AllTrails: walking, cycling and running18 data points collected
8 shared with third parties (precise location, approximate location, name, email address, user IDs, purchase history, app interactions, device or other IDs)
Calm - Sleep, meditate, relax16 data points collected
6 shared with third parties (email, user IDs, user payment information, purchase history, app interactions, device or other IDs)
Flo period and pregnancy tracker15 data points collected
0 shared with third parties
Runna: running plans and coach13 data points collected
13 shared with third parties (precise location, name, email, health information, fitness information, photos, app interactions, other user-generated content, other actions, crash logs, diagnostics, other app performance data, device or other identifiers)
MyFitnessPal: Calorie counter12 data points collected
3 Shared with third parties (precise location, user IDs, devices or other IDs)
Headspace: meditation and sleep9 data points collected
7 shared with third parties (name, email address, user IDs, app interactions, crash logs, diagnostic data, device or other IDs)
Calorie counter13 data points collected
0 shared with third parties
ShutEye: sleep and relax1 data point collected
2 shared with third parties (user IDs, device or other IDs)
