Approximately 36% to 44% of adults own wearable technology, according to the ACSM. For its 20th edition, the ACSM ranks wearables first among fitness trends in 2026. Where collected data goes and who has access to it remain the central points of debate. According to the ACSM, approximately 36% to 44% of adults own wearable technology.
The essentials
- According to the ACSM, wearables dominate fitness trends in 2026 and are owned by approximately 36% to 44% of adults.
- Wearable users rarely have clear information about how their data is transmitted and resold.
- Google made commitments to the European Commission regarding Fitbit concerning the use of data for advertising purposes; the CCPA contains targeted exemptions for certain medical data already governed by specific regulations.
- The wearables market reflects the growing importance of data flows generated by users in the value chain.
- Protection is harmonized by the GDPR in the EU while the American framework is sectoral and supplemented variably by individual states.
One sensor, two interpretations of progress
Wearable users often operate without clear knowledge of who receives their data. The market is expected to reach 186 billion dollars by 2030.
The smartwatch sells itself as a tool for empowerment. The user knows their resting heart rate, its variability between beats, their oxygen saturation during exercise. They optimize their recovery, adjust their training load, and improve their sleep. Millions of runners, cyclists, and sedentary people who decided to start moving have genuinely changed their habits thanks to these real-time feedback loops. The ACSM has documented this progress for twenty years: wearables have become an infrastructure of everyday sports life.
Bruno Patino, who has been working for several years on the attention economy and its effects on behavior, offers a different interpretation. When we delegate to an algorithm the monitoring of our body—heart rate, calories, stress, sleep quality—we don’t just gain information. We progressively cede the role of judge of our own physical condition. The algorithm becomes the reference. And the reference belongs to someone else.
This tension between genuine empowerment and algorithmic dependency runs through the entire wearables debate. It deserves to be taken seriously, but it is not sufficient to resolve the governance question, which is of a more concrete nature.
30% in the dark: a gap that doesn’t close on its own
Wearable users rarely have clear information about how their data is transmitted and resold. This result stems from contracts spanning dozens of pages written to be signed without being read.
Data collected by a sports tracker is not like web browsing data. It measures biological states: resting heart rate, heart rate variability, physical activity level, sleep patterns, inferred stress hormones. For a health insurer or employer, these signals present a commercial interest distinct from a consumption profile. They can be used to estimate the risk of chronic disease, anticipate absenteeism, or segment populations.
In the United States, the federal medical privacy law, formally called the Health Insurance Portability and Accountability Act (HIPAA), covers data held by healthcare providers, not data collected by private applications. A cardiologist is bound by strict obligations. Whether Apple Health, Garmin Connect, or WHOOP are subject to HIPAA rules depends on their activities and contractual relationships, and cannot be resolved globally. An independent fitness application generally escapes HIPAA, but not necessarily other federal and state data protection rules.
California attempted to correct this gap with the California Consumer Privacy Act. But its exemptions primarily concern data already governed by specific medical regimes, not all health data collected outside a medical context. The law protects the consumer in theory; in practice, it regulates this type of data circulation but contains exemptions that may allow certain flows involving insurers or brokers to persist.
The European fine and what it reveals about geographic arbitrage
Google made commitments to the European Commission regarding the acquisition of Fitbit, notably a prohibition on using Fitbit data for advertising purposes. This decision marked a significant milestone in the enforcement of the General Data Protection Regulation, the European framework for personal data protection.
The case is instructive in several respects. Google acquired Fitbit in 2021 while explicitly promising European regulators that it would not use Fitbit data for advertising purposes. This commitment was a condition for approving the acquisition. It demonstrates the importance of binding regulation to govern the commercial uses of health data.
The contrast with North America is striking. The legality of these practices depends on individual states and applicable laws; some states, like Washington, require explicit separate consent rather than simple acknowledgment in general terms and conditions. Geographic arbitrage is thus rational for platforms: they adapt their practices based on local regulations.
Thomas Philippon and other economists specializing in digital market regulation have documented this asymmetry rigorously: regulatory asymmetries between geographic zones can create incentives to adapt practices rather than harmonize them globally.
The real value of biological data
The wearables market is expected to reach 186 billion dollars by 2030.
The value chain works like this. The user buys a device for 200 or 400 dollars. It then continuously generates biological data. This data is aggregated, anonymized (or presented as such), and can be processed by service providers or partners for analysis and research, or used to generate inferences or recommendations, according to applicable terms.
The question of data infrastructures and who captures their value runs through other sectors: in raw material supply chains, added value systematically accumulates downstream, with whoever refines and distributes, not with whoever extracts. The wearables model reproduces this logic: the user is the producer of the raw resource; the platform is the refiner.
The anonymization of health data raises technical questions. Some studies suggest that biometric data can be re-identified despite anonymization, calling into question the effectiveness of this protection in certain experimental contexts. The contractual guarantees of platforms therefore rest on a technical assumption whose robustness varies depending on conditions.
Real progress, regulation seeking its way
It would be inaccurate to present the sector as a space without governance. Several initiatives show that regulation can advance, provided that actors push for it.
In Europe, the European Health Data Space Regulation entered into force on March 26, 2025, and complements the framework of the General Data Protection Regulation. It targets notably wellness applications claiming interoperability with electronic health record systems. Its application is gradual: the regulation applies from March 26, 2027; several important obligations are implemented from March 2029, then 2031 and 2035. European users have broader rights of access, rectification, and opposition.
In the United States, the Federal Trade Commission, the federal authority for competition and consumer protection, has multiplied actions against health applications that sold sensitive data to third parties without explicit consent. In 2023, it prohibited Premom, a fertility application, from sharing its data with third parties for advertising purposes. The action is notable, but it remains case-by-case: without federal legislation on health data privacy outside medical contexts, American regulation proceeds by individual sanctions rather than general rules.
Several states have begun to fill this gap. Washington adopted the My Health My Data Act in 2023, which extends protection of consumer health data beyond medical contexts alone, subject to its scope and exemptions. Oregon followed. The My Health My Data Act requires separate consent for certain data sharing and authorization for sales, with legal exceptions. They are still new, and their implementation remains to be built, but they indicate a direction.
On the company side, Apple has positioned itself on privacy as a commercial argument, with health data storage localized on the device and contractual guarantees against their advertising use. This differentiation through data protection creates competitive pressure on other players. The dynamic resembles what is observed in other technology sectors: when a major player makes data protection a product, others must adjust or lose users.
The window of arbitrage between 2026 and 2030
The timeline matters. Technical, contractual, and regulatory standards are being refined as of 2025-2027 and will continue to apply in stages through 2035. As platforms accumulate biological data and deploy prediction models, their positions harden and the complexity of adjustment increases for both users and regulators.
The analogy with other technological transitions is illuminating. When technology preceded regulation by ten years, acquired positions were very difficult to dislodge. The issue in the coming years is precisely this: the window during which the rules of the game remain revisable tends to narrow as investments accumulate and dependencies take hold.
Two levers appear most operational in the short term. The first is portability and transparency: requiring platforms to inform users in clear language about the recipients of their data, and to allow them to transfer or delete it without friction. The second is explicit contractual exclusion: requiring active, renewable, and revocable consent before any transmission of biological data to insurers or employers.
These two levers do not require prohibiting wearables or dismantling the market. They require that the rules of the game be readable by those who play. The question for American and Canadian legislators, facing the same gaps, is whether this minimum can be guaranteed without waiting for a major scandal to make inaction politically impossible.
Sources
- American College of Sports Medicine, Fitness Trends 2026, https://acsm.org/top-fitness-trends-2026/
- International Sports Sciences Association, Human Advantage Report, Health and Fitness Business, January 2026, https://www.healthandfitnessbusiness.org/jan2026/feature-trends
- National Institutes of Health (NIH), study on user knowledge of wearables terms of use for their data (cited in the editorial brief; URL not confirmed, source to be verified directly on PubMed)
- Irish Data Protection Commission, decision against Google LLC / Fitbit, 2023, summary available on the Data Protection Commission Ireland website
- California Consumer Privacy Act (CCPA), full text available on the California Office of the Attorney General website, https://oag.ca.gov/privacy/ccpa
- Washington State Legislature, My Health My Data Act (HB 1155), adopted in 2023, available on the Washington State Legislature website
- Federal Trade Commission, action against Premom / Easy Healthcare Corporation, 2023, available on https://www.ftc.gov
- European Health Data Space Regulation (EHDS), adopted in 2024, available on EUR-Lex
- Bruno Patino, The Civilization of the Goldfish and works on the attention economy (Grasset), theoretical framework reference
- Thomas Philippon, The Great Reversal (French translation, La Vie des Idées / Éditions du Seuil), on the concentration of digital markets and regulatory asymmetries
