Does Your Wearable Know Too Much About You?

The watch on your wrist right now knows things about you that your doctor does not. It knows your resting heart rate at 3am. It knows whether you slept badly last Tuesday and whether your stress spiked at 11am on Wednesday. It knows your menstrual cycle, your blood oxygen, your walking pace, your location, and the route you take to work every morning. It knows when you left the house, when you came home, and whether you sat still long enough during the day to meet your own goals. And in most countries — including the United States — almost none of that data is protected by law.

Wearables are the fastest-growing category in consumer electronics in 2026. Samsung's Galaxy Watch 9, released last week, introduced on-device AI running 2-billion-parameter health models locally — a genuine step forward for user privacy. But the Galaxy Watch, Apple Watch, Fitbit, Oura Ring, and virtually every other device in the category shares a common structural vulnerability that no chip upgrade fixes: the data leaves your wrist, goes to a company's servers, and enters a legal environment with fewer protections than the information in your doctor's office. The Electronic Frontier Foundation published a damning review of the industry in July 2026. The findings are not comfortable reading.

What Your Wearable Actually Collects

Most people think their smartwatch tracks steps and heart rate. The reality is considerably more extensive. A modern flagship wearable — Galaxy Watch 9, Apple Watch Series 11, Oura Ring 4 — continuously monitors heart rate variability, blood oxygen saturation, skin temperature, electrocardiogram readings, respiratory rate during sleep, sleep stage architecture, stress indicators derived from HRV patterns, menstrual cycle data, ambient noise exposure, UV exposure, and GPS location in real time. Every one of those data streams is being continuously recorded, synced to cloud servers, and retained.

The combination of these streams is more revealing than any individual data point suggests. A peer-reviewed analysis cited by the Cato Institute put it directly: wearable sensor data "can be used to infer deeply private information like mood, stress levels, and behavioural patterns — well beyond what users knowingly disclose." Your smartwatch does not just know your heart rate. It knows, with increasing accuracy, whether you are anxious, whether you are drinking too much, whether you are sleeping badly because of a relationship problem or a work problem, and whether your health is declining in ways you have not yet noticed yourself. That inferential layer — built by AI models trained on aggregate user data — is what transforms biometric readings into something far more intimate than a fitness metric.

Where the Data Goes — And Who Can Get It

The primary destination for wearable health data is the company's own servers — where it trains AI models, powers personalised recommendations, and informs product development. The secondary destination is more opaque. Most wearable privacy policies include provisions for sharing "de-identified" or "anonymised" data with third-party researchers, advertisers, and analytics partners. The de-identification claim does not hold up to scrutiny. Sensor data from wearables — particularly the combination of location, movement pattern, and biometric signature — contains what researchers call a persistent fingerprint. That fingerprint is unique to you. Studies have consistently shown that "anonymised" wearable data can be re-identified with high confidence using only a few days of movement pattern data, even without any name, email, or demographic information attached.

Beyond the advertising and analytics ecosystem, two categories of third-party access deserve specific attention. Insurance companies in multiple US states have begun incorporating wearable data into health and life insurance underwriting — either through explicit opt-in programmes that offer premium discounts for meeting activity targets, or through data purchased on the open market. Law enforcement has been using wearable data in criminal investigations for years. The surveillance company Penlink explicitly describes fitness trackers as an "overlooked source" for law enforcement because they show movement patterns and changes in heart rate at the time of incidents. Heart rate and step data from smartwatches have been introduced as evidence in US court cases. Law enforcement can access this data through subpoenas or warrants directed at the device company — not at you.

The EFF Report — Nobody Passed

In July 2026, the Electronic Frontier Foundation published one of the most comprehensive privacy audits of the wearable industry ever conducted, evaluating smartwatches, rings, and fitness bands from the major manufacturers against criteria including transparency reports, end-to-end encryption availability, local storage options, data deletion tools, third-party sharing clarity, and law enforcement data request policies.

The headline finding was blunt: no major wearable company passed all of the EFF's criteria. The most common failures were absence of transparency reports (most companies do not publish how many law enforcement data requests they receive or how often they comply), no option for end-to-end encryption or local-only data storage, and inadequate clarity about what data is shared with which third parties and for what purpose. The EFF's conclusion: "An option for end-to-end encryption or local-only storage of the data collected by a wearable is the least companies can do" — and most are not doing even that.

Is On-Device AI the Answer? The Galaxy Watch 9 Case

The Galaxy Watch 9's most privacy-relevant feature — largely buried in Samsung's marketing — is the Snapdragon Wear Elite's on-device Hexagon NPU, which allows AI health models to process biometric data directly on the watch without sending it to Samsung's servers. When health coaching, sleep analysis, and stress detection run on the device itself, the data never leaves your wrist. This is a genuine privacy improvement over previous generations, where all AI processing happened in the cloud.

The important caveat: on-device processing and cloud syncing are not mutually exclusive. The Galaxy Watch 9 still syncs health data to Samsung Health servers by default. On-device AI processes some data locally for real-time responses, but the underlying biometric logs — the raw heart rate readings, sleep stage data, and location history — continue to be uploaded for backup, cross-device sync, and the AI training that makes future models smarter. On-device processing reduces latency and provides real-time insights without cloud dependency. It does not, in itself, stop your data from reaching Samsung's servers.

Your Legal Rights — And Where They Fall Short

The legal landscape for wearable data privacy is fragmented and state-dependent. Illinois' BIPA (Biometric Information Privacy Act) requires informed consent before collecting biometric identifiers and provides a private right of action — the most protective state law in the US. California's CCPA/CPRA classifies wearable-derived metrics as sensitive personal information with rights to deletion and opt-out of data sales. Washington's My Health My Data Act imposes strict consent requirements on any entity collecting health data including wearable companies. If you live in these states, you have meaningful rights. If you do not, federal law provides very little.

The FTC has been increasing enforcement against companies making misleading privacy claims about consumer health data. But enforcement after a breach or a misuse is a different kind of protection than preventing the data collection in the first place. For most wearable users, the most actionable protection available right now is not legal — it is behavioural.