What is Google going to do with your Fitbit data? Anything it likes
An0n January 2, 2022, 4:46pm #1
WIRED UK – 5 Nov 19
Fitbit's teams could soon be working on future Pixel watches. But more importantly, what can Google do with all the health and fitness data it's about to own?
In September, there was the first whiff of a potential sale and just a few months later, Google has announced it's acquiring Fitbit for a reported $2.1 billion (£1.63bn). Google is getting hardware and software teams with wearable-tech expertise, including Pebble smarts, to add to its mixed efforts with Wear OS and the $40 million (£30m) worth of Fossil smartwatch technology it paid for at the start of 2019.
It's also getting data. A whole lot of it; something that is undeniably at the heart of this sizeable acquisition. But what data is Google getting? What can Google do with it? And can GDPR or Labour's Tom Watson make any difference?
Fitbit has 28m active users syncing step counts, heart-rate readings, sleep time, menstrual cycles, location and more from their devices. That could be the most lucrative component of the deal: user data. It will have no doubt been a reason Facebook was also apparently sniffing around to see if it could buy the struggling fitness tracker maker, too. Fitbit sales fell from 22m in 2016 to an estimated 14m in 2018.
Unsurprisingly, both parties have been swift to address the subject of data and privacy in their respective announcements detailing the acquisition. In Fitbit's press release, it stated: "Fitbit will continue to put users in control of their data and will remain transparent about the data it collects and why." It also added: "The company never sells personal information, and Fitbit health wellness data will not be used for Google ads."
There were similar sentiments in a blog post by Google from Rick Osterloh, the company's senior vice president of devices and services. "Similar to our other products, with wearables, we will be transparent about the data we collect and why. We will never sell personal information to anyone." Osterloh repeated what Fitbit had to say about Fitbit health and wellness data: "We will give Fitbit users the choice to review, move or delete their data."
On the surface, both Google and Fitbit are trying to cover their backs and assure users that things won't change in the way their data is treated when the deal is likely completed in 2020. In some cases, Fitbit users will already have given Google access to their stats via Google Fit syncing on Android phones.
"Fitbit users will be asking themselves whether they want sensitive data like this being used and monetised by Google," says Ed Johnson-Williams, a policy officer at Open Rights Group. "Google says they won't use the data for targeting ads. Google must tell Fitbit users and competition authorities what other purposes they will they use it for."
"In the past, Google has abruptly pulled the plug on devices sold to customers by companies they've acquired. Google must also reassure Fitbit users that this won't happen here."
There's an air of uncertainty surrounding how data will be carved up and moved around the business and it's something Leo Gebbie, senior analyst for wearables and VR at CCS Insight, also believes still needs clarity. "How exactly the data will be used is currently unclear, and Fitbit users who are concerned about this should be careful to review the terms of their data use once the deal is complete."
Fitbit became HIPAA-compliant [Health Insurance Portability and Accountability Act] in the US in 2015, and so, according to James Moar, research analyst at Juniper Research, "any large-scale data collection that would be similar to Google's ad data platform would jeopardise Fitbit's existing corporate wellness business."
Fitbit states that "health wellness data" will not be used for ads. But what about the other data it collects? As Johnson-Williams explains, Fitbit's platform also collects location data and other non-health personal information, too. There have been no assurances on this front so far, or any mention of the level of anonymisation of this type of data.
Fitbit's privacy policy currently states that if Fitbit is acquired, it will "give affected users notice before transferring any personal information to a new entity". But who's to say that Google's stance will not change? It's happened before after a Silicon Valley acquisition has been completed.
"We've seen promises broken in the past where other digital services were acquired," explains Johnson-Williams. "When Facebook acquired WhatsApp, users were told that WhatsApp data wouldn't be shared with Facebook. Once the dust settled on the acquisition, Facebook started using data about how people used WhatsApp."
If Google or Fitbit do break these kinds of promises, there could be fines lying in wait. Google has already been found to be in breach of EU's data privacy rules. It was fined £44m by French data protection regulator CNIL over data transparency back in January, making it one of the biggest GDPR fines dished out. In September, it was also fined $170m (£131m) for sharing data on children on YouTube without the consent of parents.
Whether those types of fines are really going to hit a company that's valued at over $100bn seems unlikely. To be completely cynical, it could actually make business sense to use the new cache of Fitbit user data widely within Alphabet's companies and simply risk future fines.
Will GDPR regulations in Europe result in different policies for different territories? As fitness data is integral to the service provision to the user, fitness data can be processed by both Fitbit and Google under GDPR, explains Moar. "There needs to be explicit consent for this, but that was already built into the frameworks Fitbit had." Moar expects data portability to the biggest issue under GDPR, such as "being able to take Fitbit data and provide it as part of another device maker's record (such as Garmin)." In that case, the data management would be easier to do on a global basis with one global data privacy policy.
If data is not used for more targeted data-driven ads where Google's main income lies, what else can we expect? "Fitbit already sells their devices to employers to monitor employees and to health insurance providers. Google could be looking to expand into these markets," suggests Jonhson-Williams. "I'd also fully expect Google to have access to all historical data rather than just any new data going forward as well."
On that point, Juniper Research's Moar agrees that there's no reason to expect that historical Fitbit data will not be transferred in the sale. "This would require an update to the existing Terms & Conditions thanks to the change of ownership, which may lose Google some users, but there are no other obstacles to the company accessing all of Fitbit's existing users."
Ramon Llamas, wearable tech analyst at IDC, has an entirely different take on the move by Google to acquire Fitbit and believes it's not really about data here. "Accessing data is not the endgame for Google. This is more about expanding its opportunities in healthcare."
Google parent company Alphabet has already shown its own ambitions to delve deeper into the health-monitoring space through projects in development under its Verily Life Sciences research organisation and the biotech spin-off Calico. Fitbit meanwhile in recent years has ramped up things as far as conducting clinical trials and collaborating with major health researchers and organisations.
In fact, the two already announced a partnership in 2018 to bring health and fitness data to doctors and healthcare services. At the time Fitbit announced its intention to use Google's Cloud Healthcare API to integrate Fitbit data into medical records.
It is more than plausible that Google's intentions for the way user data is used will be both legal and designed to benefit users. That said, we have already seen the tech giant come under scrutiny from regulators, the authorities and most recently Labour's Tom Watson over what a deal like this could mean in terms of letting a company on the scale of Google hold so much (more) personal and health data. It's enough to make Fitbit users understandably wary of what happens next.