Peloton Exercise Data Selling: Workout Metrics Shared with Third Parties

Peloton faced scrutiny over its data sharing practices after privacy researchers discovered the company shared detailed workout and health data with third-party advertisers and analytics companies. The shared data included workout frequency, duration, performance metrics, heart rate data, and exercise preferences. Combined with account information, this data created detailed health and fitness profiles that could be used for targeted advertising and potentially influence health insurance assessments. Peloton's privacy policy permitted sharing data with "business partners" in broad terms that most users never read. The company also retained user workout data indefinitely even after account cancellation, creating comprehensive fitness histories. Security researchers additionally discovered API vulnerabilities that exposed user profiles, workout statistics, and location data for anyone with account access. The exercise data selling practices highlighted how connected fitness equipment transforms physical activity into monetizable data, often without users understanding their workout metrics are being shared beyond the platform.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.