For EEA, UK, and Switzerland users, Fitbit states it obtains explicit consent for processing health and special category data at the point of specific user actions such as device pairing, third-party service connection, or activation of health tracking features, and permits withdrawal of consent through account settings.
This analysis describes what Fitbit's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that special category health data processing under GDPR is consent-based and that consent is obtained at discrete action points rather than through a single upfront agreement. The withdrawal mechanism is operationalized through account settings, feature deactivation, device unpairing, or account deletion.
Interpretive note: Whether the described consent mechanism (tied to user actions such as device pairing) satisfies GDPR Article 9 explicit consent requirements depends on the implementation, which is not fully specified in the policy text.
Under this provision, EEA, UK, and Switzerland users operate under a consent-based framework for health and biometric data processing, with consent obtained at the time of specific actions such as device pairing or feature activation. The agreement states that consent can be withdrawn at any time through account settings, which may result in the discontinuation of associated features.
Cross-platform context
See how other platforms handle Explicit Consent for GDPR Special Category Health Data and similar clauses.
Compare across platforms →"To the extent that information we collect is health data or another special category of personal data subject to the GDPR, we ask for your explicit consent to process the data. We obtain this consent separately when you take actions leading to our obtaining the data, for example, when you pair your device to your account, grant us access to your exercise or activity data from another service, or use the female health tracking feature. You can use your account settings and tools to withdraw your consent at any time, including by stopping use of a feature, removing our access to a third-party service, unpairing your device, or deleting your data or your account.Excerpt from Fitbit's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that special category health data processing under GDPR is consent-based and that consent is obtained at discrete action points rather than through a single upfront agreement. The withdrawal mechanism is operationalized through account settings, feature deactivation, device unpairing, or account deletion.
Under this provision, EEA, UK, and Switzerland users operate under a consent-based framework for health and biometric data processing, with consent obtained at the time of specific actions such as device pairing or feature activation. The agreement states that consent can be withdrawn at any time through account settings, which may result in the discontinuation of associated features.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Fitbit.