← IoT Privacy Database

Samsung Galaxy Watch / Samsung Health

Samsung Electronics · Wearable / Fitness Tracker

Staff Reviewed — a person at DeSpy reviewed this rating.

6.0Surveillance
Index
Policy — what its policy permitsF
Evidence — what research provesD

The Galaxy Watch and Samsung Health track heart rate, sleep, stress, blood oxygen, ECG, workouts and continuous location, plus a built-in microphone for voice assistants. Samsung combines this with data purchased from data brokers and other sources, and its privacy terms reserve the right to share data with affiliates, marketing partners and analytics providers and to sell identifiers and online activity for cross-context behavioral advertising. Using Samsung Health requires broad, effectively all-or-nothing consent to health-data processing.

Why this rating

Deductions: collects biometric, health and precise-location data (-15); terms permit selling identifiers/online activity for cross-context advertising (-25); combines its data with information bought from data brokers (-15); an all-or-nothing consent gate offers no meaningful opt-out to still use the health features (-10); unilateral terms changes (-5). Among the weakest policies in this slice. Evidence: Mozilla's independent review confirms the sale of identifiers for cross-context advertising, and a 2022 Samsung-account breach exposed customer contact data, though not specifically wearable or health data.

What it is

Manufacturer
Samsung Electronics
Category
Wearable / Fitness Tracker
Model years
2018-present
Market status
Current
Companion app
Samsung Health

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S4Samsung Galaxy Watch — *Privacy Not Included
    Ngo review · Mozilla Foundation · 2023-11

    Mozilla flags the Galaxy Watch with its *Privacy Not Included warning, finding Samsung sells identifiers and online activity for cross-context ads, shares location with third parties and ingests data from data brokers.

    Why it matters here: Independent review of this exact product's data-sharing and sale practices.

  2. S3Samsung says customer data stolen in July data breach
    Breach report · TechCrunch · 2022-09

    Samsung disclosed that a mid-2022 breach compromised U.S. customer information including names, contact details and dates of birth.

    Why it matters here: Indicates a breach of Samsung-account customer data (names, contact details, dates of birth); the disclosure did not specifically implicate Galaxy Watch or Samsung Health data.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database