Strava uses your recorded activities to contribute to the publicly accessible Global Heatmap, which shows aggregated movement patterns of all users on a public map.
Even aggregated or de-identified data contributed to the Global Heatmap has previously been shown to reveal sensitive locations such as military bases and private residences, creating real-world safety risks.
Aggregation and public publication of GPS activity data raises GDPR re-identification risk concerns and may conflict with data minimisation principles. Prior incidents (e.g. 2018 military base exposure) demonstrate residual privacy and safety risks even in de-identified datasets.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS routes, heart rate, sleep data, and other health metrics, which may be used to train AI/ML models and contribute to publicly accessible features like the Global Heatmap. Health data from connected devices will not be sold or used for advertising, but activity data can be shared in aggregated or de-identified form and used for AI development. You can adjust your privacy and visibility controls in the Strava app under Settings > Privacy Controls to limit how your data is shared and used.