A Study on Fitness Trackers and Privacy
A piece of technology that has become ubiquitous in our society are fitness trackers. Whether it is through your smartphone or a wearable such as an Apple Watch or FitBit, millions of people are having their fitness data tracked at all times. The majority of fitness tracker users probably do not think about the privacy concerns that they come with. To look into this, six students from the University of Lausanne in Switzerland conducted a study of online surveys and interviews to ask people what their knowledge is of privacy threats that are prevalent in fitness trackers. They also ask users if they know how the fitness tracker ecosystem works. With this study, the students looked into potential data minimization as well. The name of their publication is “Are Those Steps Worth Your Privacy?: Fitness-Tracker Users’ Perceptions of Privacy and Utility.”
In the introduction of the study, the authors talk about the privacy concerns with fitness trackers and why they carried out this study. They point out that the user can allow the tracker to share their data with the manufacturer. They can also give third-party organizations access to their data if they so choose. Using machine learning, manufacturers can take someone’s fitness data and infer some more personal data. The example the authors used was that if machine learning notices a trend, it can guess that the user suffers with drug use. Sometimes this can be a good thing, but the authors point out that this is very close to crossing the line with privacy violations.
How was this study conducted?
The authors describe their reasons for this article saying, “Earlier research showed that fitness-tracker users perceive their devices as being mostly beneficial. However, most users are not well-informed about the privacy risks associated with their device. Hence, users have an overall low level of privacy concerns. Users also do not take sufficient actions to protect their privacy,” (Velykoivanenko et al., 2021). To figure this out, they asked four research questions in a survey for over 200 young university students. These research questions were:
- How do users value the utility of features, types of data, and platforms in the fitness-tracker ecosystem? In particular, how much loss of detail would users be willing to accept to protect their privacy?
- How do users perceive privacy in the context of fitness trackers? In particular, which types of sensitive information do users think can be inferred and with what accuracy?
- How well do users understand the information flow among the devices, the companion app, and the supporting online services?
- Which behaviors would users engage in to protect their privacy?
Before asking these questions, each student was given a fitness tracker to use for four months. After the four months, then they filled out a survey containing these questions, and 19 individuals were also interviewed about their experience.
The survey had 11 total sections containing the four research questions and some other questions to gather more info. For example, they asked the participants to explain their knowledge of the different aspects of a fitness tracker, such as what they perceive about what data the trackers collect, and how the hardware of the trackers work. They also bring up what concerns the users have with what the trackers collect and infer about them. Finally, there were a couple sections asking about how often, and when the users used their trackers, and when they did not. They also asked about what interfaces the users took advantage of, such as just the tracker, on their smartphone, or on the tracker’s website. Another section included a so-called “mental model.” Each participant had to draw a model of how they perceived their information was being shared between the tracker and other devices.
Regarding the 19 interviews that were conducted, the authors created four groups based on their activity and usage of the fitness trackers over the four month span. Those four groups were as follows:
- G1: Frequently removed the tracker during the day and who rarely or never wore it at night.
- G2: Frequently removed the tracker during the day and who often or always wore it at night.
- G3: Rarely or never removed the tracker during the day and who rarely or never wore the tracker at night.
- G4: Rarely or never removed the tracker during the day and who often or always wore it at night.
Each interviewee was interviewed slightly differently than the others. The authors designed the interview questions based on the user’s survey responses. Along with that, they adapted the interview based on the responses the interviewee was giving.
Results
The first of their findings was what interfaces the users used to track their steps and heart rate. The majority only used their phone or tracker, where 85.8% did not use another connected device and 88.5% did not use the tracker’s website. There were very similar results with sleep data as well.
Along with this, the authors asked how the users felt about the trackers not displaying precise step counts, rather in intervals. They used intervals of 100 steps, 500, 1000, and 2000. As the intervals went up, the less useful the users thought this info would be, seen in the figure below.
Next, which is probably the most interesting result of this study, is the users shared how precise the trackers were at inferring information. Then, the users also shared how worried they were about the accuracy of the inferences. For example, it could infer their age, menstrual cycles, sexual activity, alcohol consumption, illegal drug use, and it even somewhat accurately inferred their socioeconomical status. The figures below both show the trackers’ accuracy and the users’ worries about the accuracy. One thing that could skew this data however is some of the information can accurately infer something because that data can be inputted by the user, which is noted by the authors.
Next are their results of how the users understand the flow of information in the fitness tracker ecosystem. First was the participants’ mental models. 40.3% only had a tracker, smartphone, and tracker server in their drawings, while the remaining had other elements such as laptops, internet related things such as WiFi or data centers, and even third-party sites/applications. The authors found that only 20.8% had the correct mental model. While many participants had the right elements in their drawings, they did not correctly identify the flow of data. A lot of data was able to be pulled from the remaining 79.2% of the participants that had incorrect mental models. 16.2% of the users believe the information shared between the tracker and phone is one sided, which is wrong because data is sent both ways. 6.5% of the users believe that the trackers receive the processed data (such as graphs), which is also incorrect because this data is shown on connected devices or on the tracker’s website.
Other Relevant Graphs
Conclusion
At the end of this study conducted by University of Lausanne students, they were able to pull a few conclusions about fitness-trackers and their privacy concerns, along with people’s knowledge of their privacy. They found that overall, fitness tracker users believe that their sensitive information cannot be inferred by the trackers. They believe that only information that is in the trackers is what is obtained from the sensors on the trackers. After making the participants draw mental models of the data flow within data trackers, the authors found that the majority of users have a lack of knowledge or misunderstanding of the data tracker ecosystem, which could lead to some privacy concerns. With data trackers becoming more popular and upgraded, it will be interesting to see what privacy issues occur, and if people will ever pay more attention to those concerns.
Study:
Velykoivanenko, L., Niksirat, K. S., Zufferey, N., Humbert, M., Huguenin, K., & Cherubini, M. (2021). Are those steps worth your privacy? Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 5(4), 1–41. https://doi.org/10.1145/3494960
