Strava uses GPS data from user activities to build its publicly visible Global Heatmap, which shows aggregated movement patterns across all users.
This analysis describes what Strava's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Even aggregated or deidentified GPS data, particularly from users who regularly follow distinct routes, can in some cases be re-identified or used to infer sensitive location patterns; this feature has attracted national security and privacy scrutiny in the past.
Interpretive note: The policy does not specify the deidentification methodology applied to Global Heatmap data or whether users can opt out of contributing to it specifically, leaving the adequacy of the anonymization assertion uncertain.
Your GPS workout routes may contribute to a publicly accessible heatmap that shows movement patterns globally, which in sensitive locations or for users with distinctive routes could present privacy or safety considerations.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We may also use your activities to generate our Global Heatmap and other community-powered features such as Points of Interest and Start Points. We may also share aggregated or deidentified information, such as usage or demographics.Excerpt from Strava's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR requirements for deidentification adequacy and the requirement that aggregation genuinely eliminates the risk of re-identification before data can be treated as anonymous.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Even aggregated or deidentified GPS data, particularly from users who regularly follow distinct routes, can in some cases be re-identified or used to infer sensitive location patterns; this feature has attracted national security and privacy scrutiny in the past.
Your GPS workout routes may contribute to a publicly accessible heatmap that shows movement patterns globally, which in sensitive locations or for users with distinctive routes could present privacy or safety considerations.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Strava.