Follow ZDNET: Add us as a preferred source on Google.

ZDNET's key takeaways

Wearable owners need to understand how their data is being handled.
The US lacks federal regulations around consumer health data.
Consumers should properly manage their data and explore privacy policies.

Today's smartwatches and smart rings extend well past basic step tracking by gathering ongoing details about fitness levels, rest patterns, reproductive health, and additional metrics before sending them to companion applications. This broad usage prompts fresh inquiries into data privacy, security protocols, and individual rights, specifically regarding ownership of the health information collected.

Expanded data gathering increases exposure to potential breaches or transfers to external entities for purposes like targeted promotions or risk assessments that users may not fully anticipate.

"Individuals exercised more restraint in earlier times with sensitive information categories, yet they now recognize substantial benefits from reviewing and applying such details," noted Jules Polonetsky, CEO of the Future of Privacy Forum, a nonprofit dedicated to consumer data safeguards, in discussion with ZDNET. "The challenge lies in not always pausing to evaluate appropriate safeguards in specific contexts."

More than 20 states have enacted broad data privacy statutes that typically grant users rights to review, remove, and limit sales of their personal details. These rules differ across jurisdictions, resulting in an uneven set of standards absent nationwide oversight.

Over 560 million individuals globally now use smartwatches, with more than one in four Americans included, per Statista figures. "Users show growing interest in retrieving and applying their health metrics for activity goals or family record management, yet they must investigate carefully to determine protections tied to their location," Polonetsky observed. "A primary requirement remains a national privacy statute that incorporates baseline safeguards for health information beyond HIPAA coverage."

Contrary to common assumptions, HIPAA does not extend to information from wearables, as these devices fall outside the scope of regulated healthcare entities.

This situation places responsibility on users to safeguard their own information.

Identifying Reliable Providers

Without national rules, "the service agreements and privacy statements control how personal and health details are used, protected, collected, and distributed in these cases," explained Caitlin Fennessy, vice president and chief knowledge officer at the nonprofit IAPP, during talks with ZDNET. Such agreements reflect both legal standards and each firm's data processing strategies.

A 2025 review in the peer-reviewed journal npj Digital Medicine assessed privacy policies from 17 major wearable makers against 24 standards covering openness, collection aims, data reduction, user authority, external sharing, security measures, and incident reporting.

Under this evaluation, Google, Apple, and Polar recorded the lowest risk ratings due to robust consumer protections, while Xiaomi, Wyze, and Huawei showed higher risk levels.

"The results point to variations in industry data practices and emphasize the demand for enhanced, targeted privacy guidelines," the analysis stated.

Privacy-conscious buyers often select devices based on general trust in the maker instead of detailed policy reviews, Fennessy noted. Those integrated into the Apple system and satisfied with prior data handling may favor an Apple Watch accordingly. Marketing approaches by these firms influence such choices.

Pursuing Clear Information

Firms prioritizing privacy and security usually offer accessible details on data management, including whether processing stays local or moves to remote servers, use of full encryption, and any external distributions.

"Entities building their image around privacy for wearables often share these key points openly, allowing quick checks during selection without needing to parse full legal documents," Fennessy added.

Absence of such visible details suggests lower emphasis on these aspects, warranting careful consideration before proceeding.

Additional factors include the company's revenue model.

"Paying substantially for a device and subscription creates strong motivation to satisfy customers," Polonetsky stated. "With free options, closer examination is essential to see how the service sustains itself. Absent charitable status or HIPAA-regulated medical involvement, monetization likely involves user data."

Thus, complimentary or low-cost offerings may treat data as the main commodity, potentially leading to sales to parties users prefer to exclude from health insights.

Measures for Self-Protection

Beyond reviewing maker commitments and reputations, users can apply these steps to secure wearable data:

Review the privacy policy (or seek a summary via automated tools, or scan for terms like "data" to trace information flows). Seek out clear public statements on privacy and security when choosing devices.
For unused smartwatches or rings, erase stored information to avoid risks from future company incidents.
Inspect connected devices linked to phones and wearables. Apple and Google interfaces list active services for periodic review, such as gym equipment that may retain access after initial use.
When employing AI tools to review wearable health data without allowing training use, adjust settings to disable data sharing or opt for session-based interactions. Avoid uploading files containing personal identifiers without first removing or obscuring such elements.

"Advising against sharing sensitive details, once sound guidance, no longer suffices," Polonetsky concluded. "Users gain real advantages from health data analysis. Focus now shifts to knowing recipients and confirming services avoid data monetization."