Your personal data may be moved to the US or other countries that may have weaker privacy protections than your home country, and by using Peloton you are treated as having agreed to this.
Your fitness and personal data collected in the EU or UK may be transferred to the US and shared with US-based advertising and analytics vendors, where legal protections may be weaker — and Peloton's consent mechanism for this transfer may not be legally adequate under GDPR.
Cross-platform context
See how other platforms handle Cross-Border Data Transfers and similar clauses.
Compare across platforms →Relying on user 'consent' via continued use of the service as the legal basis for international data transfers is legally problematic under GDPR, which requires specific transfer mechanisms rather than general consent embedded in terms.
REGULATORY FRAMEWORK: This provision directly implicates GDPR Chapter V (Arts. 44-49) governing international data transfers, including the requirement for adequacy decisions, Standard Contractual Clauses (SCCs, updated 2021), or Binding Corporate Rules; UK GDPR Chapter V and the UK International Data Transfer Agreement (IDTA); and the EU-US Data Privacy Framework (DPF, 2023) as the current primary transfer mechanism for US recipients. The CJEU Schrems II judgment (C-311/18) invalidated the previous Privacy Shield and imposed additional due diligence requirements on SCCs.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.