← IoT Privacy Database

Dexcom G7

Dexcom, Inc. · Medical Wearable / CGM

Staff Reviewed — a person at DeSpy reviewed this rating.

4.5Surveillance
Index
Policy — what its policy permitsD
Evidence — what research provesD

The Dexcom G7 is a body-worn sensor that samples interstitial glucose every few minutes and streams a continuous record of your metabolic state to Dexcom's cloud via a phone app. It knows your glucose curve, timestamps and device identifiers, thresholds you set, and — through Share/Follow — lets up to ten designated people watch your readings in real time. Data also flows to healthcare providers and, optionally, to linked third-party health apps.

Why this rating

Deductions: continuous glucose data is sensitive health information (-15); Dexcom's own notice concedes that sharing with advertising and social networks qualifies as a 'sale'/'targeted advertising' under state privacy law, even as it denies monetary sale (-25); retention timelines are unspecified/vague (-7). Opt-outs and deletion requests are available and HIPAA applies when data flows through a provider, limiting further cuts.

What it is

Manufacturer
Dexcom, Inc.
Category
Medical Wearable / CGM
Model years
2023-present
Market status
Current
Companion app
Dexcom G7

The evidence 1

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S3Dexcom, Inc. Warning Letter (MARCS-CMS 700835)
    Regulatory action · U.S. Food and Drug Administration · 2025-03

    An FDA inspection cited unauthorized manufacturing/design changes to G7 sensor components that internal studies indicated reduced accuracy.

    Why it matters here: Device-safety/manufacturing regulatory action, not a data-privacy incident; included because no independent scrutiny of the app's privacy behavior exists — the privacy axis here is effectively unstudied.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database