Strava transfers personal data from the EU, UK, and Switzerland to the United States and other countries, using Standard Contractual Clauses as the legal mechanism to authorize these transfers.
This analysis describes what Strava's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
EU and UK users' data is processed in the United States, which is subject to US surveillance laws; Standard Contractual Clauses are the primary transfer mechanism but their adequacy has been contested, and users should be aware that their data crosses jurisdictional boundaries.
If you are based in the EU, UK, or Switzerland, your personal data including health metrics and GPS location is transferred to and stored in the US under Standard Contractual Clauses, meaning it is subject to US law once transferred.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"Strava is based in the United States, and we process and store information in the United States and other countries. If you are in the EEA, UK, or Switzerland, your personal information may be transferred to, stored, and processed in the United States or other countries outside of your home country. When we transfer personal information outside of the EEA, UK, or Switzerland, we use Standard Contractual Clauses approved by the European Commission, or other appropriate safeguards, as required by applicable law.Excerpt from Strava's Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (international data transfers), the EU-US Data Privacy Framework, and the UK GDPR equivalent transfer requirements.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
EU and UK users' data is processed in the United States, which is subject to US surveillance laws; Standard Contractual Clauses are the primary transfer mechanism but their adequacy has been contested, and users should be aware that their data crosses jurisdictional boundaries.
If you are based in the EU, UK, or Switzerland, your personal data including health metrics and GPS location is transferred to and stored in the US under Standard Contractual Clauses, meaning it is subject to US law once transferred.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Strava.