Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
If you give Strava access to your phone or social media contacts, it will continuously access and store that contact list to suggest connections, not just a one-time sync.
This analysis describes what Strava's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Ongoing access to your contact list means Strava collects and stores information about people who have never signed up for Strava and who have not consented to having their data processed by the service.
Granting Strava access to your contacts means your friends' and colleagues' names and contact details are stored by Strava even if those individuals are not Strava users, and this access is ongoing rather than a single import.
How other platforms handle this
If you wish to access, review, or make any changes to Personal Data you have provided to us through the Services, please submit a request through our Online Form, or email us at help@skillshare.com...
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
The right to access the data collected about you
Monitoring
Strava has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"You can choose to share contacts from your mobile device or social networking accounts. If you share this information, we will regularly access and store it to help you connect with Strava users you may know.Excerpt from Strava's Privacy Policy
REGULATORY LANDSCAPE: The collection and storage of contact data belonging to individuals who have not consented to Strava's data processing raises questions under GDPR, specifically regarding the lawful basis for processing non-user personal data and whether such individuals' rights can be honored. CCPA may apply if contacts include California residents. The FTC Act applies to the adequacy of disclosure about ongoing contact access. GOVERNANCE EXPOSURE: Medium. The phrase 'regularly access and store' indicates persistent rather than one-time data collection, which expands the scope of data held by Strava beyond its own user base. GDPR's accountability principle requires that Strava identify a lawful basis and respond to rights requests from non-user contacts whose data is held, which creates operational complexity. JURISDICTION FLAGS: EEA users whose contacts include non-consenting individuals present GDPR exposure. Illinois users may face considerations under BIPA if contact data includes biometric identifiers, though this is unlikely in typical contact sync scenarios. California users granting contact access implicate CCPA for California-resident contacts who are not Strava users. CONTRACT AND VENDOR IMPLICATIONS: Contact data should be treated with the same data protection standards as directly collected user data. Service providers accessing contact data for matching or suggestion features must be covered by appropriate data processing agreements. COMPLIANCE CONSIDERATIONS: The legal basis for processing contact data of non-users should be documented and reviewed, particularly for EEA users. Retention periods for contact data should be clearly defined. Users should be informed of how to revoke contact access and whether previously stored contacts are deleted upon revocation.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Ongoing access to your contact list means Strava collects and stores information about people who have never signed up for Strava and who have not consented to having their data processed by the service.
Granting Strava access to your contacts means your friends' and colleagues' names and contact details are stored by Strava even if those individuals are not Strava users, and this access is ongoing rather than a single import.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Strava.