10 Total
4 High severity
5 Medium severity
1 Low severity
Summary

This is Strava's Terms of Service for 2026, the legal agreement that applies every time you use the Strava fitness tracking app and website, covering your account, your data, payments, and your legal rights if something goes wrong. The most important thing for most users is that Strava collects your GPS location, workout data, and health metrics and uses them not just to power the app, but also to create aggregated data products — and if you're a paying subscriber, there are no refunds and your subscription auto-renews unless you cancel at least 24 hours before the next billing date. You can opt out of mandatory arbitration by sending written notice to Strava within 30 days of creating your account, which preserves your right to sue in court.

Technical Summary

Strava's Terms of Service (effective January 1, 2026) govern access to and use of the Strava platform — including its mobile applications, websites, and fitness-tracking services — and constitute a binding contract formed upon account creation or use, with EU/EEA users contracting with Strava Ireland Limited and all others with Strava, Inc. The document's most significant obligations include a mandatory binding arbitration clause with class action waiver (opt-out available within 30 days of account creation), a broad intellectual property license granted to Strava over user-generated content including workout data and GPS routes, and automatic subscription renewal unless canceled at least 24 hours before the billing period ends. Notable deviations from industry standard include an explicit reservation of rights to aggregate and de-identify user data for commercial research and product development, a unilateral right to modify subscription fees with only 'reasonable notice,' and a disclaimer of all warranties combined with a liability cap at the greater of fees paid in the prior 12 months or $100 — an unusually low cap for a platform collecting sensitive biometric and location data. This document engages GDPR (Articles 6, 9, 13, and 17) for EU/EEA users, CCPA/CPRA (§1798.100 et seq.) for California residents, COPPA for users aged 13–17, and FTC Act Section 5 regarding unfair or deceptive trade practices; material compliance considerations include the adequacy of consent mechanisms for sensitive health and location data, the lawfulness of the arbitration clause under EU consumer protection law (Directive 93/13/EEC), and whether de-identified aggregate data practices satisfy GDPR recital 26 standards.

Institutional Analysis

(1) REGULATORY EXPOSURE: This document engages GDPR Arts. 6, 9, 13, and 17 (EU/EEA users contracting with Strava Ireland Limited, supervised by the Irish Data Protection Commission); CCPA/CPRA §§1798…

(1) REGULATORY EXPOSURE: This document engages GDPR Arts. 6, 9, 13, and 17 (EU/EEA users contracting with Strava Ireland Limited, supervised by the Irish Data Protection Commission); CCPA/CPRA §§1798.100, 1798.110, 1798.120, and 1798.150 (California residents, enforced by the California Privacy Pro…

🔒

Compliance intelligence locked

Regulatory exposure, material risk, and due diligence action items.

Evidence Provenance
Captured April 3, 2026 05:43 UTC
Document ID CA-D-000271
Version ID CA-V-000446
Wayback Machine View archived versions →
SHA-256 acd2bdabc93433a23ffd66ac5043de66353de1915e6f4baa969b33962fa969d0
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Change Timeline
View full version history (25 captures) →
High Severity — 4 provisions
Medium Severity — 5 provisions
Low Severity — 1 provision