Provision record
Strava · Strava Privacy Policy · View original document ↗

Contacts Data Collection and Regular Access

Medium severity High confidence Explicitdocumentlanguage Common · 295 of 352 platforms
Get alerted the next time Strava changes these terms. Follow Strava →
Share 𝕏 Share in Share 🔒 PDF
Monitor governance changes for Strava Monitor emails you the same day this changes. The archive stays free.
Follow Strava →

Get the weekly research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.

Document Record

What it is

If you give Strava access to your phone or social media contacts, it will continuously access and store that contact list to suggest connections, not just a one-time sync.

This analysis describes what Strava's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

Ongoing access to your contact list means Strava collects and stores information about people who have never signed up for Strava and who have not consented to having their data processed by the service.

Clause Stability Stable

0
Changes
4
Months Monitored
May 9, 2026
First Seen
May 22, 2026
Last Seen
This clause type exists across 5261 other provisions on other platforms.

Consumer impact (what this means for users)

Granting Strava access to your contacts means your friends' and colleagues' names and contact details are stored by Strava even if those individuals are not Strava users, and this access is ongoing rather than a single import.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
  • Delete Your Data
    On your mobile device, go to Settings, then Privacy or Contacts, find Strava, and revoke contacts access. You should also review Strava's app settings to request deletion of any previously stored contact data.

How other platforms handle this

Skillshare Medium

If you wish to access, review, or make any changes to Personal Data you have provided to us through the Services, please submit a request through our Online Form, or email us at help@skillshare.com...

Baseten Medium

The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.

GitHub Medium

The right to access the data collected about you

See all platforms with this clause type →

Monitoring

Strava has changed this document before.

Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Follow Strava → Or create a free account →
▸ View Original Clause Language DOCUMENT RECORD
"
You can choose to share contacts from your mobile device or social networking accounts. If you share this information, we will regularly access and store it to help you connect with Strava users you may know.

Excerpt from Strava's Privacy Policy

ConductAtlas Analysis

Institutional analysis (regulatory & governance intelligence)

REGULATORY LANDSCAPE: The collection and storage of contact data belonging to individuals who have not consented to Strava's data processing raises questions under GDPR, specifically regarding the lawful basis for processing non-user personal data and whether such individuals' rights can be honored. CCPA may apply if contacts include California residents. The FTC Act applies to the adequacy of disclosure about ongoing contact access. GOVERNANCE EXPOSURE: Medium. The phrase 'regularly access and store' indicates persistent rather than one-time data collection, which expands the scope of data held by Strava beyond its own user base. GDPR's accountability principle requires that Strava identify a lawful basis and respond to rights requests from non-user contacts whose data is held, which creates operational complexity. JURISDICTION FLAGS: EEA users whose contacts include non-consenting individuals present GDPR exposure. Illinois users may face considerations under BIPA if contact data includes biometric identifiers, though this is unlikely in typical contact sync scenarios. California users granting contact access implicate CCPA for California-resident contacts who are not Strava users. CONTRACT AND VENDOR IMPLICATIONS: Contact data should be treated with the same data protection standards as directly collected user data. Service providers accessing contact data for matching or suggestion features must be covered by appropriate data processing agreements. COMPLIANCE CONSIDERATIONS: The legal basis for processing contact data of non-users should be documented and reviewed, particularly for EEA users. Retention periods for contact data should be clearly defined. Users should be informed of how to revoke contact access and whether previously stored contacts are deleted upon revocation.

Full institutional analysis

Regulatory citations, enforcement risk, and due diligence action items.

Applicable agencies

  • FTC
    The FTC has authority over whether the collection and ongoing storage of third-party contact data constitutes an unfair or deceptive practice
    File a complaint →

Applicable regulations

BIPA
Illinois, USA
CCPA/CPRA
California, USA
Connecticut Data Privacy Act Amendments
US-CT
CAN-SPAM
United States Federal
FTC Act Section 5
United States Federal
GDPR
European Union
HIPAA
United States Federal
Indiana Consumer Data Protection Act
US-IN
Kentucky Consumer Data Protection Act
US-KY
UK GDPR
United Kingdom
Universal Opt-Out Mechanism Expansion 2026
US

Provision details

Document information
Document
Strava Privacy Policy
Entity
Strava
Document last updated
May 5, 2026
Tracking information
First tracked
May 9, 2026
Last verified
May 9, 2026
Record ID
CA-P-007790
Document ID
CA-D-00272
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
1f04cde7030a965e9a65ea78be50fec4717b7bbf6a378112228c49d14a8f6010
Analysis generated
May 9, 2026 22:52 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: Strava
Document: Strava Privacy Policy
Record ID: CA-P-007790
Captured: 2026-05-09 22:52:22 UTC
SHA-256: 1f04cde7030a965e…
URL: https://conductatlas.com/platform/strava/strava-privacy-policy/provision/CA-P-007790/contacts-data-collection-and-regular-access/
Accessed: July 26, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
Medium
Categories

Other risks in this policy

Related Analysis

Governance intelligence across arbitration, AI governance, data rights, indemnification, and retention

Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.

Frequently Asked Questions

What does Strava's Contacts Data Collection and Regular Access clause do?

Ongoing access to your contact list means Strava collects and stores information about people who have never signed up for Strava and who have not consented to having their data processed by the service.

How does this clause affect you?

Granting Strava access to your contacts means your friends' and colleagues' names and contact details are stored by Strava even if those individuals are not Strava users, and this access is ongoing rather than a single import.

How many platforms have this type of clause?

ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.

Is ConductAtlas affiliated with Strava?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Strava.