Popular Fitness App Hit With Lawsuit Over Selling User Health Data to Advertisers

The short version: Multiple fitness and health tracking apps — including Strava and MyFitnessPal — have faced class action lawsuits in recent years for allegedly sending sensitive user health data to Facebook and other advertising platforms through hidden tracking technology embedded in the apps. This happened even when users never agreed to share their health information with advertisers. If you used a fitness app between roughly 2019 and 2024, your private health data may have been shared without your knowledge.

The Hidden Tracker That Sent Your Health Data to Facebook

At the center of these lawsuits is a piece of technology called the Meta Pixel — a small piece of code that app developers can embed in their products to track user behavior and send data back to Facebook's parent company, Meta, for advertising purposes.

The problem: when the Meta Pixel is embedded in a health or fitness app, it can transmit users' in-app activity to Meta — including what workouts they logged, what health symptoms they tracked, what medications they recorded, and in some cases, their precise GPS location during exercise. This happens automatically, in the background, without most users knowing it is occurring.

An investigation by The Markup published in 2022 found that the Meta Pixel was present in dozens of health-related apps and hospital websites, transmitting sensitive medical and personal information to Facebook (The Markup, "Facebook Is Receiving Sensitive Medical Information from Hospital Websites," 2022). A follow-up investigation found that fitness apps were among the most common transmitters of this type of data.

The Federal Trade Commission has since taken action in related areas. In a 2023 enforcement action, the FTC ordered the health app company BetterHelp (an online therapy platform) to pay $7.8 million and prohibited it from sharing user health data with advertisers after finding it had sent sensitive mental health information to Facebook and Snapchat (FTC, In the Matter of BetterHelp, Inc., March 2023).

Which Apps Are Involved

Several major fitness and health tracking apps have faced lawsuits or regulatory scrutiny for data-sharing practices:

• Strava — Strava, one of the most popular running and cycling tracking apps, faced a class action in 2023 alleging it shared users' GPS location, workout data, and personal health information with Facebook through the Meta Pixel and other tracking technologies without adequate disclosure (class action complaint, N.D. Cal., 2023).
• MyFitnessPal — MyFitnessPal, owned by Francisco Partners since 2020, faced criticism and litigation in 2022–2023 for sharing user nutrition, weight, and calorie data with advertising partners. A 2022 investigation found the app transmitted user data to third parties including advertising networks (class action filings, 2022).
• Period tracking apps — Following the Supreme Court's 2022 Dobbs decision, period-tracking apps including Flo Health faced particular scrutiny and lawsuits over sharing reproductive health data with Facebook. Flo reached a settlement with the FTC in 2021 over deceptive data-sharing practices (FTC, In the Matter of Flo Health, Inc., June 2021).

Investigators found that in many cases, users had no meaningful way to opt out of the data sharing — the tracking was built into the core of the app and continued even for users who had told Facebook they did not want their off-platform activity tracked (The Markup, 2022).

What Data Was Allegedly Shared

The data at issue in these cases is not generic web browsing data. It is among the most sensitive personal information people generate — information they entered specifically because they trusted a health app to keep it private:

• Heart rate readings during and after workouts
• GPS route data showing exactly where users run, bike, or walk — including their homes
• Weight, BMI, and body composition data entered manually or synced from wearable devices
• Nutrition and calorie logs including diet-related medical conditions like diabetes meal tracking
• Sleep patterns and recovery metrics from synced smartwatches and fitness bands
• Menstrual cycle and reproductive health data in apps that offer period tracking features

Privacy law experts note that while HIPAA (the federal health privacy law) technically applies only to health care providers and insurers, not consumer apps, state privacy laws in California, Illinois, and Washington impose significant restrictions on how health-adjacent data can be collected and shared (California Consumer Privacy Act, 2018; Washington My Health MY Data Act, 2023).

Who May Be Affected

You may be part of an affected group if you:

• Used Strava, MyFitnessPal, or another fitness or health tracking app between approximately 2019 and 2024
• Entered personal health data into the app — including workouts, weight, nutrition, sleep, or heart rate information
• Are or were a resident of California, Illinois, Washington, or another state with strong consumer privacy laws
• Did not receive a clear disclosure that your health data would be shared with advertising platforms like Facebook or Google

What to Do Right Now

Review Your App's Privacy Settings

Open the fitness app in question and go to Settings → Privacy or Data Sharing. Look for any toggles related to "personalized advertising," "share with partners," or "analytics." Turn off anything you did not intentionally enable. Note that turning off these settings now does not undo past sharing, but it limits future exposure.

Request a Copy of Your Data

Under the California Consumer Privacy Act (CCPA) and similar state laws, users have the right to request a copy of all personal data a company holds about them. Go to the app's website and look for "Privacy" or "Data Request" to submit a data access request. This can help document what information was collected and may be useful in a legal claim.

Check If You Are Part of a Settlement

Some class actions in this space have already reached settlement stages. Check settlement administrator websites and class action clearinghouse sites to see if any settlements for apps you used have already been filed or approved. Deadlines to participate in settlements are real — missing them forfeits your right to share in any payout.