Strava transfers your personal data internationally, including to the United States, using Standard Contractual Clauses and other mechanisms to comply with data protection laws.
If you live in the EU or UK, your personal data is transferred to countries with different privacy protections, and the legal mechanisms Strava uses to do this can affect your rights and remedies.
Cross-border transfers rely on Standard Contractual Clauses (SCCs) and potentially other GDPR Chapter V transfer mechanisms. Post-Schrems II, compliance teams must verify that transfer impact assessments have been conducted, supplementary measures are adequate, and that SCCs are updated to the 2021 European Commission standard form. UK GDPR transfer rules also apply separately.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS location, health metrics, and fitness activity, which is used for AI model training, advertising, and publicly accessible features like the Global Heatmap. Consumers should be aware that even with default settings, their anonymized or aggregated activity data may contribute to public features visible to anyone. You can adjust your privacy controls in Strava account settings at https://www.strava.com/settings/privacy to limit data visibility and opt out of certain data uses.