Peloton Privacy Policy

This document is Peloton's consumer-facing Privacy Policy, governing the collection, use, disclosure, and retention of personal data across its hardware products (Bike, Tread, Row), digital platform, mobile applications, and website, with legal basis rooted in consent, contractual necessity, and legitimate interests depending on jurisdiction. The policy states that Peloton collects a broad range of personal data including identifiers, fitness and health-related metrics (heart rate, workout output, body weight), geolocation data, device and usage data, financial information, and user-generated content, and the terms authorize sharing this data with service providers, business partners, affiliated companies, and third-party advertisers for purposes including marketing and analytics. Notable among the policy's provisions is its collection of health and fitness data that, while not constituting protected health information under HIPAA in this consumer context, nonetheless carries significant sensitivity; the policy also asserts broad behavioral analytics and advertising data sharing practices, including through cookies and tracking technologies, that engage state-level consumer privacy frameworks beyond CCPA. The policy engages CCPA/CPRA for California residents, GDPR and UK GDPR for EU and UK users respectively, and Canada's PIPEDA for Canadian users, with jurisdiction-specific rights sections addressing deletion, portability, correction, and opt-out of sale or sharing of personal information. Material compliance considerations include the sensitivity of fitness and biometric-adjacent data collected through connected hardware, the adequacy of consent mechanisms for behavioral advertising, and the cross-border data transfer arrangements required for Peloton's multi-jurisdiction operations.