Fitbit (Google Health)

Is Fitbit safe?

Mostly, yes. The Fitbit app, which Google renamed Google Health on 19 May 2026, collects some of the most personal data a phone can hold: heart rate, sleep stages, weight, menstrual cycles, GPS routes and, in some countries, medical records. Google has kept a promise it made to European regulators when it bought Fitbit, that this health data does not feed Google Ads, and the app now sits behind a Google account with modern sign-in security.

We score it 66/100, a little below Garmin Connect at 70 and in line with Google Home at 62 and Flo at 66. Privacy is better than for most Google apps. What pulls the score down is Fitbit's record with its own customers: an A$11 million penalty in Australia and a $12.25 million penalty in the US over a smartwatch that burned people.

Does Google use Fitbit health data for ads?

Not for Google Ads, according to Google. When the European Commission cleared the takeover on 17 December 2020, Google committed not to use health and wellness data from Fitbit devices of users in the European Economic Area for its search, display or ad-tech products, to keep that data in a separate silo, and to let EEA users choose whether other Google services such as Search or Maps can use it. The commitment runs for ten years, and a monitoring trustee checks it. Google's own privacy FAQ, updated in May 2026, states the promise without a regional limit.

That is narrower than "no marketing". Apple's privacy label lists purchase history, email address, user ID, product interaction and advertising data as used for Google's own advertising or marketing, and health and fitness data among the data used for analytics and personalisation. Nothing appears under "Data Used to Track You", and on Google Play Google says the app shares no data with other companies. Google uses your activity to personalise promotions for its own devices, and you can turn off promotional emails.

The 2026 relaunch adds two newer uses. The Google Health Coach, built with Gemini and part of the paid Premium tier, can read everything in your account once you opt in, including cycle data and synced medical records. Research use is a separate opt-in and uses de-identified data, which may include AI chats. In the US, medical records you pull into the app are no longer covered by HIPAA, which Google states plainly.

The move to Google accounts

From 19 May 2026, a Fitbit account no longer works. To keep using the app you have to move it to a personal Google account, a step that cannot be undone, and Google said it would start deleting data from accounts that had not moved on 15 July 2026. Once moved, the Google Privacy Policy and Google's terms apply.

For security this is a gain. A Google account offers 2-step verification, passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary and Google's checks for suspicious sign-ins. For privacy it ties your health history to the account that also holds your searches and email. The ad silo is what keeps those apart, so check Google's settings for which other Google services may use your health data.

The privacy group noyb filed complaints in Austria, the Netherlands and Italy in August 2023, arguing that Fitbit forced new European users to consent to data transfers outside the EU, and that the only way to withdraw consent was to delete the account. We found no decision on them. A complaint is not a finding, so it does not change the score.

What Fitbit's fines were about

None of Fitbit's penalties concern the app's data handling. They concern how the company treated buyers of its devices.

In Australia, Fitbit (Australia) gave the competition regulator, the ACCC, a court-enforceable undertaking in 2018 after telling customers their warranty lasted only one year. Between May 2020 and February 2022 Fitbit LLC's support staff again told 58 consumers they had no right to a refund or replacement for faulty devices. Fitbit admitted the conduct was misleading, and the Federal Court ordered it to pay A$11 million in December 2023.

In the US, the Ionic smartwatch was recalled on 2 March 2022 because its battery could overheat. The US Consumer Product Safety Commission listed 115 overheating reports in the US and 78 burn injuries, including two third-degree burns. In January 2025 Fitbit agreed to a $12.25 million civil penalty for failing to report the defect immediately, the CPSC said, and to annual reports on its compliance programme. We count this at half weight: it is a consumer-safety penalty against the app's own maker, but it concerns hardware rather than anything the app does with your data.

How to use Fitbit safely

1. If you have not moved your account, sign in to the Google Health app now, and download your data first if you are unsure.
2. Protect the Google account with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or an authenticator, since it now guards your health history.
3. Check the friends and leaderboard settings: step count and cardio load are shared with friends unless you change them.
4. Think before syncing medical records or turning on the coach; leave research sharing off unless you want to contribute.
5. Review which apps and employer programmes can read your data, through Health Connect on Android or the app's connection settings.

How we scored it

Scams and harmful content (76) is the strongest factor, since contact is limited to friends and leaderboards. Security (70) follows, now that every account is a Google account and no breach of Fitbit health data is known. Privacy (62) gains from the ad silo and the absence of tracking, but loses points for Google's own marketing use and the reach of the AI coach. The regulatory record (50) is the weakest: one mid-size Australian penalty in full, after an earlier undertaking, plus the US Ionic penalty at half weight. For a watch app with no ad tracking at all, compare Garmin Connect.