← IoT Privacy Database

MyFitnessPal

MyFitnessPal, Inc. · Wearable / Fitness Tracker

Staff Reviewed — a person at DeSpy reviewed this rating.

2.9Surveillance
Index
Policy — what its policy permitsD
Evidence — what research provesB

MyFitnessPal logs what you eat, your weight and body measurements, exercise and calorie goals, building a detailed picture of diet, health status and behavior patterns. It uses the camera for barcode scanning and links to other fitness services. As an ad-supported app it shares data with advertising and analytics partners, and its account credentials were part of one of the largest breaches on record.

Why this rating

Deductions: collects health, weight and dietary data (-15); as an ad-supported service it shares data with advertising/analytics partners, meeting the sale/targeted-advertising bar (-25); vague retention and processing language (-7). Evidence: the single cited incident is the 2018 breach of ~150M accounts, now more than five years old and weighted at reduced severity; a 2026 tracking-cookie class action (Wiley & Shah v. MyFitnessPal) survived a motion to dismiss but is not yet certified or settled, so it is noted for context rather than counted.

What it is

Manufacturer
MyFitnessPal, Inc.
Category
Wearable / Fitness Tracker
Model years
2005-present
Market status
Current
Companion app
MyFitnessPal

The evidence 1

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S4Under Armour says data breach affected about 150 million MyFitnessPal accounts
    Breach report · CNBC · 2018-03

    A February 2018 breach exposed usernames, email addresses and hashed passwords for roughly 150 million MyFitnessPal accounts — one of the largest breaches of that year.

    Why it matters here: Direct breach of this service's user base; older than five years and largely resolved, so weighted at reduced severity.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database