Loading story…
The Electronic Frontier Foundation said most major smart wearable vendors still provide weak privacy protections and limited transparency for sensitive health data collected by consumer devices. In a review of 10 wearable makers, including Apple, Google/Fitbit, Garmin, Oura, Polar, Suunto, and Whoop, EFF found that many companies rely on encryption only in transit and at rest, leaving providers able to access user information such as health metrics, sleep patterns, movement, and location data.
EFF reported that only Apple and Google publish transparency reports, while Apple was the only vendor identified as offering end-to-end encryption for health data stored in its Health app. The findings come as wearable data faces growing scrutiny because it can be requested by law enforcement, underscored by Apple's published U.S. law-enforcement guidelines that describe how the company handles legal demands for customer information.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
A Security Affairs report summarized an Electronic Frontier Foundation review of ten major smart wearable vendors and said most still provide weak privacy protections and limited transparency around health data handling. The review noted that only Apple and Google publish transparency reports, and only Apple offers end-to-end encryption for health data stored in its Health app.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Electronic Frontier Foundation launched **“Encrypt It Already”**, a campaign pressuring major consumer tech providers to expand and complete **end-to-end encryption (E2EE)** commitments and make protections easier to use. The campaign tracks where encryption is promised but not delivered (e.g., E2EE for Facebook group messages, interoperable encrypted RCS messaging promised by **Apple** and **Google**, and E2EE for Bluesky DMs), where encryption exists but is not enabled by default (e.g., Telegram encrypted chats, WhatsApp backups, and Ring camera footage settings), and where additional encrypted storage and controls are being urged (e.g., encrypted backups for Google Authenticator and broader encrypted Android backups). EFF’s stated goal is to shift control of communications and stored data toward users by pushing vendors to ship E2EE features, enable them by default, and broaden encrypted data coverage. Separately, consumer privacy concerns continue to shape adoption and trust in data-collecting devices and platforms. A Clutch survey cited in reporting found **74%** of respondents are concerned about how wearable devices handle personal data, and only **58%** are confident their wearable protects their data—sentiment that may drive brand switching decisions. In parallel, an Apple-focused article on “privacy rules” promoted user configuration steps within the iPhone ecosystem (e.g., Safari anti-tracking features, a dedicated Passwords app, and other privacy controls), but it does not describe a specific incident or vulnerability and reads primarily as general privacy guidance tied to Data Privacy Day.
Jun 29, 2026
The Electronic Privacy Information Center (**EPIC**) released a report, *Beyond HIPAA: Reimagining How Privacy Laws Apply to Health Data to Maximize Equity in the Digital Age*, warning that US health privacy protections are failing as health-related data is increasingly collected outside clinical settings and repurposed for commercial profiling and government use. EPIC argues that **outdated laws (including HIPAA’s limited scope)** and weak regulation of digital tracking enable health data to be harvested via apps, websites, location tracking, and online searches, then aggregated and sold—supporting targeted advertising, “surveillance pricing,” and other uses that can raise costs or restrict access to care. The report and related coverage highlight that health data can escape medical contexts and be used for **surveillance and enforcement**, including scenarios where immigration enforcement activity in or around medical facilities deters patients from seeking treatment. EPIC frames the issue as a “health privacy crisis” that undermines trust and worsens outcomes, particularly for marginalized communities, and points to **data brokers** and the broader commercial surveillance ecosystem as central drivers of the problem; EPIC also promoted a public event discussing the report’s findings and recommendations.
Jun 29, 2026
U.S. Senator Bill Cassidy, chair of the Senate Health, Education, Labor, and Pensions (HELP) Committee, has introduced the Health Information Privacy Reform Act, which seeks to establish HIPAA-like privacy protections for consumer health data collected by devices such as smartwatches and health apps. The proposed legislation would require health technologies not currently covered by HIPAA or the HITECH Act to disclose how consumer information is collected and shared, aiming to address privacy concerns arising from the growing use of digital health tools. The bill responds to the gap in existing regulations, as HIPAA only applies to a limited set of healthcare entities, leaving much of the data generated by modern consumer health technologies unprotected. If enacted, the law would ensure that Americans' health data is secured and only collected or used with their consent, reflecting the evolving landscape of healthcare data privacy and security.
Jun 29, 2026