Re:EU launches probe into Google-Fitbit takeover
by 1vuio0pswjnm7 on Tuesday August 04, 2020 @06:33PM
(#24055221)
"We've been clear from the beginning that we will not use Fitbit health and wellness data for Google ads."
The above statement from Google only refers to a specific subset of data that Fitbit collects: "health and wellness data". Moreover, it only refers to a single limitation: use for Google ads. Any non-health and wellness data can be used for any purpose. Any health and wellness data can be used for any purpose except Google ads.
Consider an alernative statement such as: "We will only collect and use data for the purposes of providing the services, i.e., health and wellness services." This eliminates the loopholes.
From Fitbit's current privacy policy, below is a list of the Fitbit data. As one can see, most of this data is arguably not "health and wellness data".
When viewed in isolation, some of this data might seem routine and innocuous. However when combined with all the personal data Google has collected and obtained from other sources, including other Google devices or services a person might be using, the Fitbit data could be quite useful in profiling users.
Of course, in the future Google Fitbit could collect more data than what is listed here. It depends on what Google chooses to do with the devices and the services going forward.
1. Account data
(required:) name, email address, password, date of birth, gender, height, weight, and in some cases mobile telephone number.
(optional:) profile photo, biography, country information, and community username.
2. Additional data
(optional:) logs for food, weight, sleep, water, or female health tracking;
(optional:) an alarm;
(optional:) messages on discussion boards or to your friends on the Services.
friends' email addresses, friends' social networking accounts, contacts in the contact list on person's mobile device.
(in the case of a survey, contest, or promotion:) name, contact information, and message.
3. Payment and card data
(for certain devices:) name, credit, debit or other card number, card expiration date, and CVV code.
a token containing the last four digits of your card number and your card issuer's name and contact information
(for purchases of Fitbit merchandise via their website:) shipping address
4. Live coaching data
(if the person uses live coaching:) the plan, goals, and actions the person records with the coach, calendar events, communications with the coach, notes the coach records about the person, and other information submitted by the person or the coach.
5. Device data
number of steps taken, distance traveled, calories burned, weight, heart rate, sleep stages, active minutes, and location.
6. Geolocation data
precise geolocation data, including GPS signals, device sensors, Wi-Fi access points, and cell tower IDs. approximate location from your IP address.
7. Usage data
usage or network activity information, for example, when the person views or searches content, installs applications or software, creates or logs into account, pairs device to account, or opens or interacts with an application on the Fitbit device.
data about the devices and computers the person uses, including IP addresses, browser type, language, operating system, Fitbit or mobile device information, device and application identifiers, referring web page, pages visited, location (if settings allow), and cookie information.
8. Data from 3rd parties
(if person connects FitBit account to an account on another service, e.g., Facebook or Google:) name, profile picture, age range, language, email address, and friend list.
(optional:) exercise or activity data from another service.
(in the case of employers and insurance companies that offer Fitbit Services to their employees and customers:) name, email address, or similar information (like a telephone number or subscriber ID)
The above statement from Google only refers to a specific subset of data that Fitbit collects: "health and wellness data". Moreover, it only refers to a single limitation: use for Google ads. Any non-health and wellness data can be used for any purpose. Any health and wellness data can be used for any purpose except Google ads.
Consider an alernative statement such as: "We will only collect and use data for the purposes of providing the services, i.e., health and wellness services." This eliminates the loopholes.
From Fitbit's current privacy policy, below is a list of the Fitbit data. As one can see, most of this data is arguably not "health and wellness data".
When viewed in isolation, some of this data might seem routine and innocuous. However when combined with all the personal data Google has collected and obtained from other sources, including other Google devices or services a person might be using, the Fitbit data could be quite useful in profiling users.
Of course, in the future Google Fitbit could collect more data than what is listed here. It depends on what Google chooses to do with the devices and the services going forward.
1. Account data
(required:) name, email address, password, date of birth, gender, height, weight, and in some cases mobile telephone number.
(optional:) profile photo, biography, country information, and community username.
2. Additional data
(optional:) logs for food, weight, sleep, water, or female health tracking;
(optional:) an alarm;
(optional:) messages on discussion boards or to your friends on the Services.
friends' email addresses, friends' social networking accounts, contacts in the contact list on person's mobile device.
(in the case of a survey, contest, or promotion:) name, contact information, and message.
3. Payment and card data
(for certain devices:) name, credit, debit or other card number, card expiration date, and CVV code.
a token containing the last four digits of your card number and your card issuer's name and contact information
(for purchases of Fitbit merchandise via their website:) shipping address
4. Live coaching data
(if the person uses live coaching:) the plan, goals, and actions the person records with the coach, calendar events, communications with the coach, notes the coach records about the person, and other information submitted by the person or the coach.
5. Device data
number of steps taken, distance traveled, calories burned, weight, heart rate, sleep stages, active minutes, and location.
6. Geolocation data
precise geolocation data, including GPS signals, device sensors, Wi-Fi access points, and cell tower IDs. approximate location from your IP address.
7. Usage data
usage or network activity information, for example, when the person views or searches content, installs applications or software, creates or logs into account, pairs device to account, or opens or interacts with an application on the Fitbit device.
data about the devices and computers the person uses, including IP addresses, browser type, language, operating system, Fitbit or mobile device information, device and application identifiers, referring web page, pages visited, location (if settings allow), and cookie information.
8. Data from 3rd parties
(if person connects FitBit account to an account on another service, e.g., Facebook or Google:) name, profile picture, age range, language, email address, and friend list.
(optional:) exercise or activity data from another service.
(in the case of employers and insurance companies that offer Fitbit Services to their employees and customers:) name, email address, or similar information (like a telephone number or subscriber ID)