Strava uses your GPS activity data to generate the Global Heatmap, a publicly accessible map showing where people exercise, which is visible to anyone on the internet.
Even if your individual activities are set to private, your GPS data may still contribute to Strava's public heatmap, potentially revealing sensitive locations such as your home address, workplace, or private military installations.
The Global Heatmap feature raises GDPR Article 5 data minimisation and purpose limitation concerns, as aggregated location data can still be re-identified. This has previously attracted regulatory and national security attention when military base perimeters were revealed. Compliance teams should assess adequacy of de-identification methods applied.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS location, health metrics, and fitness activity, which is used for AI model training, advertising, and publicly accessible features like the Global Heatmap. Consumers should be aware that even with default settings, their anonymized or aggregated activity data may contribute to public features visible to anyone. You can adjust your privacy controls in Strava account settings at https://www.strava.com/settings/privacy to limit data visibility and opt out of certain data uses.