For the past several months, any time I receive a marketing email or privacy policy update from a service I no longer use, I’ve gotten into the habit of going to the company website and requesting for them to delete my personal data. It all started after my personal data was leaked in a massive data breach earlier this year, and ever since then I have received a barrage of spam emails. I wanted some way to reclaim agency over my information, and unsubscribing from mailing lists still allowed companies to retain my personal information, so I wanted to take it a step further. Though tedious, I’ve felt like exercising my right to data privacy by having companies delete my data puts me less at risk for future breaches.

With this on the forefront of my mind nowadays, I’ve started thinking about other devices, services, and habits that potentially put my data privacy at risk. The one that seemed the most obvious (and also within my control), is my Garmin watch. I have been an avid Garmin-wearer for years now, taking it off only for special occasions, to clean it, or charge it. It has tracked every workout, every night’s sleep, and every step for the last 4 years and all the sudden this started to concern me. I, like many other Garmin users, have never bothered to read their privacy policy, and I had no idea what information Garmin was storing about it, for how long they kept it, and whether or not they shared it. This led me on an small investigative research project through the depths of Garmin’s privacy policy so I could be more informed about how Garmin is collecting its user’s personal data.

The first question I set out to address was - what data does Garmin collect? Well the short answer is everything. The Garmin privacy policy initially states, “name, email address, location, and other information”, but then it goes on to be more specific in subsequent sections. A lot of the information collected by Garmin is pretty standand and didn’t really raise any alarm bells for me. I was certain Garmin already collected information associated with user accounts like basic contact information, device information, and transaction history. I was also not surprised to see Garmin stored data pertaining to any customer service interactions users have. There were however, a few sections that surprised me and made me a bit concerned.

Each time you open the Garmin Connect app and sync the watch, Garmin collects detailed metadata about the upload. As stated in their privacy policy:

we log data about the transmission, such as the IP address used when syncing, the sync time and date, crash/diagnostic logs, geographic location of the device, information about your device, information about the network used to sync (e.g., Wi-Fi or cellular), and device battery level

This is something I never thought about until reviewing the policy, but every time you open the Garmin Connect app to view your health data on your phone, Garmin is collecting a pool of information about you and your habits. This might not seem like a big deal as a single event, but when aggregated together, Garmin can start to piece together a lot about your personal habits. Things like places you frequently visit, your usage habits, your daily routine. We’ve seen the outcome of this in other cases like famous New York Times article How Companies Learn Your Secrets, (Duhigg, 2012) detailing how Target knew about a teenager’s pregnancy before her own father. Or in the New York Times article Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret, (Valention-DeVries et al, 2018) which describes how your smartphone apps are using your location data and selling it to advertisers and hedgefunds.

This doesn’t mean Garmin is doing anything nefarious with this information, and their privacy policy suggests this is not the case, but it was just more metadata collected about me that I wasn’t really thinking about.

One of the things that made me most uneasy when thinking about my data privacy with Garmin was their collection of my location data. One of the wildest direct quotes I found in the privacy policy was:

Sometimes we need to collect your device’s location. That makes it a lot easier to tell you about things such as weather in your area, nearby traffic, and even movie prices near you.

Why does Garmin need to look up and notify me about movie prices near me? Perhaps there is someone out there who has the AMC app downloaded on their Garmin, but that’s not really how I expect Garmin to use my location data.

Unsurprisingly it only gets worse if you are using Garmin for navigation. Their privacy policy states:

If you use a Garmin auto navigation device or app and provide your consent, then we will collect and upload from your device data such as location, speed, direction, and time and date of recording. If you provide your consent when asked, then we may also share this aggregated data with third parties to enhance the quality of the traffic, parking, and other features enabled by content providers.

This section felt alarming to me, since these data could easily be aggregated and reveal a lot about personal habits, daily routine, and driving habits. I’m sure people would not appreciate Garmin sharing this information with insurance companies (which they claim they are not).

All these things considered, obviously the biggest privacy risk of all is your personal health data collected by the device and stored in the Garmin servers. Things like heart rate, sleep metrics, activities logged, weight data, and stress. These data points say a lot about someone’s overall health. Based on what’s in Garmin’s privacy policy, it doesn’t appear that they share user’s personal data with an third parties, unless they were explicitly authorized by the user. The policy also states:

We will retain your personal data as long as your Garmin account is considered to be active or in accordance with applicable law and regulatory obligations.

It’s not totally clear what the definition of an “active” user is in this context: whether that means the user has logged in/ opened the app within a specific timeframe or whether they specifically deactivated their account. I think it’s safe to assume they are not removing a user’s data unless they explicitly request it.

With all this in mind, I decided to exercise my right to privacy and request Garmin delete the personal data they have accummulated about me over the years. When I initially did this, I wasn’t fully aware of the consequences of deleting my data, but they make a lot of sense in hindsight. Revoking Garmin’s permission to store your personal data, basically renders the Garmin Connect app useless. If Garmin is no longer storing your data on their servers, they are not able to populate all the pretty charts and graphs about your health data on the app. And obviously all your historical data is gone too, unless you had the foresight to request a copy of your data before requesting they delete your data (which I did not). At first it made me a little sad to not have all the historical data to look back on. And to not have the Garmin Connect app to open and check on in moments of boredom. But the watch still functions as it always did and still collects all the same metrics it did before. The main difference is just that it doesn’t maintain the same historical data. I think I’m ok with that because I can still take in the health and fitness metrics the Garmin provides, while having the piece of mind that I’m not sacrificing my data privacy in the process.