Privacy in consumer wearable technologies: a living systematic analysis of data policies across leading manufacturers

May combine two claims.

Regional disparities and opaque third-party data practices create regulatory grey areas that some companies exploit, often prioritising operational flexibility over user privacy.

“However, regional disparities and opaque third-party data practices create regulatory grey areas that some companies exploit, often prioritising operational flexibility over user privacy 41,42 .”

• cites [41] Zhang, C., Shahriar, H. & Riad, A. B. M. K. Security and Privacy Analysis of Wearable Health Device. in 2020 IEEE 44th Annual Computers, Software, and Applications Conference (COMPSAC) 1767-1772 (2020). sourcePartly supported

  The Data Security of Jawbone Tracker section says the device transmitted precise location data without users’ knowledge and that researchers could not determine why. The Related Works section discusses third-party access and EU and HIPAA privacy concerns. Neither section establishes regional regulatory disparities, companies exploiting grey areas, or a preference for operational flexibility over privacy. Page numbers are unavailable in our copy. (LLM, conf=0.83)

  Experimental — accuracy not yet measured
• cites [42] Cilliers, L. Wearable devices in healthcare: privacy and information security issues. Health Inf. Manag 49, 150–156 (2020). sourceNot checked — no full text of the source

May combine two claims.

Many companies are incentivised to gather and monetise extensive amounts of user data, often concealing the scope of these practices behind dense, difficult-to-read privacy policies.

“Many companies are incentivised to gather and monetise extensive amounts of user data 31 , often concealing the scope of these practices behind dense, difficult-to-read privacy policies 32,33 .”

• cites [31] Choi, J. P., Jeon, D.-S. & Kim, B.-C. Privacy and personal data collection with information externalities. ISN: Property Protection (Topic) (2018). sourceSupported
• cites [32] Milne, G. R. & Culnan, M. J. Strategies for reducing online privacy risks: Why consumers read (or don’t read) online privacy notices. J. Interact. Mark. 18, 15–29 (2004). sourceNot checked — no full text of the source
• cites [33] Schumann, M. & Doherty, C. Bridging gaps in wearable technology for exercise and health professionals: a brief review. Int. J. Sports Med. 45, 949-957 (2024). sourceSupported

May combine two claims.

Insurers might use health data to risk-profile individuals, potentially leading to higher premiums.

“For instance, insurers might use health data to risk-profile individuals, potentially leading to higher premiums 27 .”

• cites [27] Neumann, D., Tiberius, V. & Biendarra, F. Adopting wearables to customize health insurance contributions: a ranking-type Delphi. BMC Med. Inform. Decis. Mak. 22, 112 (2022). sourceSupported

May combine two claims.

Informed consent is often undermined by lengthy and complex privacy policies, which in this review averaged 6113 words and would take approximately 26 min to read.

“Informed consent-a cornerstone of ethical data collection-is often undermined by lengthy and complex privacy policies, which in this review averaged 6113 words and would take approximately 26 min to read 55 .”

• cites [55] Brysbaert, M. How many words do we read per minute? A review and meta-analysis of reading rate. J. Mem. Lang. 109, 104047 (2019). sourceSupported

May combine two claims.

Studies have shown that heart rate sensors on some wearables are less accurate for individuals with darker skin tones, reflecting a racial design bias that may affect health outcomes.

“For example, studies have shown that heart rate sensors on some wearables are less accurate for individuals with darker skin tones 57 , reflecting a racial design bias that may affect health outcomes.”

• cites [57] Koerber, D., Khan, S., Shamsheri, T., Kirubarajan, A. & Mehta, S. Accuracy of heart rate measurement with wrist-worn wearable devices in various skin tones: a systematic review. J. Racial Ethn. Health Disparities 10, 2676-2684 (2022). sourceSupported

May combine two claims.

Older adults who may rely on wearables for fall detection or chronic disease monitoring are often unaware of how their data is shared with insurers or third parties, raising the possibility of discrimination in premiums or coverage based on wearable-derived metrics.

“Similarly, older adults, who may rely on wearables for fall detection or chronic disease monitoring 63 , are often unaware of how their data is shared with insurers or third parties 64 -raising the possibility of discrimination in premiums or coverage based on wearable-derived metrics.”

• cites [63] Moore, K. et al. Older adults’ experiences with using wearable devices: qualitative systematic review and meta-synthesis. JMIR Mhealth Uhealth 9, e23832 (2021). sourcePartly supported

  Split into 2 atoms — 1 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.

  Experimental — accuracy not yet measured
• cites [64] Kim, T. K. & Choi, M. Older adults’ willingness to share their personal and health information when adopting healthcare technology and services. Int. J. Med. Inform. 126, 86–94 (2019). sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Previous research has highlighted risks stemming from inadequate data protection, opaque third-party sharing practices, and regulatory gaps that leave users vulnerable to breaches.

“Previous research has highlighted risks stemming from inadequate data protection, opaque third-party sharing practices, and regulatory gaps that leave users vulnerable to breaches 33,42,54 .”

• cites [33] Schumann, M. & Doherty, C. Bridging gaps in wearable technology for exercise and health professionals: a brief review. Int. J. Sports Med. 45, 949-957 (2024). sourceNot checked yet

  Checked before — its earlier verdict is held back until a new check runs.

• cites [42] Cilliers, L. Wearable devices in healthcare: privacy and information security issues. Health Inf. Manag 49, 150–156 (2020). sourceNot checked — no full text of the source
• cites [54] de Arriba-Perez, F., Caeiro-Rodriguez, M. & Santos-Gago, J. M. Collection and processing of data from wrist wearable devices in heterogeneous and multiple-user scenarios. Sensors 16, 1538 (2016). sourceCould not verify

  Section 5.2 describes user permission for third-party access to private wearable data and says access tokens have limited lifetimes because of security concerns. The Conclusions frame the paper’s findings as interoperability and standardization issues. Our copy does not address inadequate data protection, opaque sharing practices, regulatory gaps, or breaches; those risks cannot be verified from this source. (LLM, conf=0.73)

  Experimental — accuracy not yet measured

May combine two claims.

Once accepted, agreements often grant manufacturers broad discretion to share data with third parties or store it in jurisdictions with weaker privacy protections.

“Once accepted, these agreements often grant manufacturers broad discretion to share data with third parties or store it in jurisdictions with weaker privacy protections 33,56 .”

• cites [33] Schumann, M. & Doherty, C. Bridging gaps in wearable technology for exercise and health professionals: a brief review. Int. J. Sports Med. 45, 949-957 (2024). sourcePartly supported

  The Ethical and Legal Considerations section says users surrender data when they accept the terms of service, and describes opaque third-party processing and servers in jurisdictions with less stringent data-protection laws. It does not establish that the agreements themselves grant manufacturers broad contractual discretion to share or store the data in those ways. (LLM, conf=0.82)

  Experimental — accuracy not yet measured
• cites [56] Keogh, A. et al. Breaking down the digital fortress: the unseen challenges in healthcare technology-lessons learned from 10 years of research. Sensors 24, 3780 (2024). sourcePartly supported

  Section 2.3 says end-user licence agreements tend to prioritise corporate immunity over user protection, and its privacy checklist asks whether terms explain third-party data sharing. It does not say that accepted agreements often grant manufacturers broad discretion to share data, or that they permit storage in jurisdictions with weaker privacy protections. (LLM, conf=0.82)

  Experimental — accuracy not yet measured

May combine two claims.

Low Risk ratings were common for identity policy (94%) and data access (71%).

“High Risk ratings were most frequent for transparency reporting (76%) and vulnerability disclosure (65%), while Low Risk ratings were common for identity policy (94%) and data access (71%).”

May combine two claims.

High Risk ratings were most frequent for transparency reporting (76%) and vulnerability disclosure (65%).

“High Risk ratings were most frequent for transparency reporting (76%) and vulnerability disclosure (65%), while Low Risk ratings were common for identity policy (94%) and data access (71%).”

• Also stated in: § Discussion · plain

  “For example, 76% of manufacturers were rated as High Risk for transparency reporting, 65% for vulnerability disclosure, and 59% for breach notification.”

Probably not a substantial claim: may not pass S3 (load-bearing).

From available records, a typical policy revision cycle appears to occur approximately once every 9-15 months.

“From available records, a typical policy revision cycle appears to occur approximately once every 9-15 months, though some firms (e.g., Garmin and Withings) revise more frequently, and others rarely update publicly visible documentation.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Across the 17 manufacturers, the most recently available privacy policy updates ranged from May 2023 to April 2025.

“Across the 17 manufacturers included in this review, the most recently available privacy policy updates ranged from May 2023 to April 2025.”

May combine two claims.

High Risk ratings were most frequently observed for Transparency Reporting (criterion #2, 76%), Vulnerability Disclosure Programs (#23, 65%), and Breach Notification (#24, 59%).

“High Risk ratings were most frequently observed for criteria related to Transparency Reporting (criterion #2, 76% High Risk), Vulnerability Disclosure Programs (criterion #23, 65% High Risk), and Breach Notification (criterion #24, 59% High Risk).”

May combine two claims.

Cluster 3 manufacturers commonly lacked sufficient transparency reporting, demonstrated weaker breach notification policies, and offered limited user control over data sharing and retention.

“These manufacturers commonly lacked sufficient transparency reporting, demonstrated weaker breach notification policies, and offered limited user control over data sharing and retention.”

May combine two claims.

Low Risk ratings were predominantly observed for Identity Policy (criterion #4, 94% Low Risk), Data Access (criterion #15, 71% Low Risk), and Control Over Targeted Advertising (criterion #14, 65% Low Risk).

“Conversely, Low Risk ratings were predominantly observed for Identity Policy (criterion #4, 94% Low Risk), Data Access (criterion #15, 71% Low Risk), and Control Over Targeted Advertising (criterion #14, 65% Low Risk).”

May combine two claims.

The companies with the highest number of 'low risk' ratings were Google (17), Apple (15), Polar (15), Oura (13), Garmin (12), and Withings (12).

“This was reflected in the frequency of low risk ratings too; the companies with the highest number of 'low risk' ratings were Google (17), Apple (15), Polar (15), Oura (13), Garmin (12) and Withings (12).”

May combine two claims.

Most companies lacked formalised vulnerability disclosure programs and robust breach notification processes.

“Similarly, most companies lacked formalised vulnerability disclosure programs and robust breach notification processes, posing significant risks to data security and incident response.”

May combine two claims.

North American and European companies exhibited distributions that did not deviate significantly from expected values, with no residuals exceeding ±2.0.

“In contrast, North American and European companies exhibited distributions that did not deviate significantly from expected values, with no residuals exceeding ±2.0.”

May combine two claims.

Privacy by Default settings (criterion #8, 41% High Risk), Threat Notification (#3, 53% High Risk), User Notification about Third-Party Requests (#1, 47% High Risk), and Minimal Data Collection (#7, 24% High Risk) were often poorly implemented.

“Specifically, Privacy by Default settings (criterion #8, 41% High Risk), Threat Notification (criterion #3, 53% High Risk), User Notification about Third-Party Requests (criterion #1, 47% High Risk) and Minimal Data Collection (criterion #7, 24% High Risk) were often poorly implemented, indicating that companies frequently collect unnecessary data and fail to adopt privacy-protective defaults.”

May combine two claims.

Garmin, Withings, and Google provide accessible archives or version logs; Garmin published six updates between 2020 and 2025 and Withings published 12 since 2017.

“Garmin, Withings, and Google provide accessible archives or version logs, with Garmin publishing six updates between 2020 and 2025 and Withings publishing 12 since 2017.”

May combine two claims.

Cluster 2 consisted solely of Apple and Google, distinguished by notably strong performance across all dimensions.

“Cluster 2 consisted solely of Apple and Google, both of which were distinguished by notably strong performance across all dimensions.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The longest policy was 12,125 words (WHOOP), and the shortest was 4408 (Apple).

“The longest policy, at 12,125 words (WHOOP), while the shortest was 4408 (Apple).”

May combine two claims.

Xiaomi was identified as the highest risk company with a cumulative risk score of 60, and Google was identified as the lowest risk company with a score of 33.

“Xiaomi was identified as the highest risk company with a score of 60, and Google was identified as the lowest risk company with a score of 33.”

• Also stated in: § Discussion · plain

  “Google emerged as the overall leader in privacy protections, receiving the greatest number of Low Risk ratings (17) and an overall risk score of 33 (on a scale of 24-72, with higher scores indicating higher risk), while Xiaomi (Amazfit) was the worst-performing company, with a cumulative risk score of 60.”

Classified as probably not a substantial claim.

The study developed a bespoke evaluation framework designed to address gaps in existing standards and regulations.

“To achieve this, we developed a bespoke evaluation framework designed to address gaps in existing standards and regulations.”

• AssumptionRests on an assumption: No systematic evaluation of wearable device privacy policies has been conducted to date.

May combine two claims.

Post hoc analysis showed Asia-Pacific companies received significantly more High Risk ratings than expected (residual = +3.0) and significantly fewer Low Risk ratings (residual = -2.3).

“Post hoc analysis of standardized residuals showed that companies based in the Asia-Pacific region received significantly more High Risk ratings than expected (residual = +3.0)and significantly fewer Low Risk ratings (residual = -2.3).”

May combine two claims.

The companies with the highest number of 'high risk' ratings were Xiaomi (16), Wyze (15), and Huawei (14).

“The companies with the highest number of 'high risk' ratings were Xiaomi (16), Wyze (15) and Huawei (14).”

• Also stated in: § Discussion · plain

  “The analysis also identified clear disparities among manufacturers, with Xiaomi, whose wearable devices are marketed under the Amazfit brand through its subsidiary Huami, receiving the highest number of High Risk ratings (16 out of 24 criteria).This was followed closely by Wyze (15) and Huawei (14).”

May combine two claims.

Only a minority of companies achieved optimal scores for Data Deletion (criterion #16, 24% High Risk), where clear deletion policies and practices were often inadequate.

“Furthermore, only a minority of companies achieved optimal scores for Data Deletion (criterion #16, 24% High Risk), where clear deletion policies and practices were often inadequate.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Privacy fatigue leaves many consumers disengaged.

“Yet, privacy fatigue-a condition where consumers are overwhelmed by frequent, lengthy privacy disclosures-leaves many disengaged.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Health biodata is a highly valued commodity on the Dark Web; healthcare data records are worth up to $250 per record compared to $5.40 for a payment card.

“According to a 2021 Trustwave report, healthcare data records are worth up to $250 per record, compared to $5.40 for a payment card, due to the comprehensive personal information they contain 29,30 .”

• cites [29] Ibarra, J., Jahankhani, H. & Kendzierskyj, S. Cyber-physical attacks and the value of healthcare data: facing an era of cyber extortion and organised crime. Blockchain Clin. Trial 115–137 (2019). sourceNot checked — no full text of the source
• cites [30] Imprivata. Hackers, breaches, and the value of healthcare data. https://www.imprivata.com/uk/node/103708 (2021).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable).

The findings underscore the need for stronger, sector-specific privacy standards.

“Our findings highlight inconsistencies in data governance across the industry and underscore the need for stronger, sector-specific privacy standards.”

May combine two claims.

Employers could access data reflecting negatively on candidates' health or productivity, influencing hiring decisions.

“Employers could access data reflecting negatively on candidates' health or productivity, influencing hiring decisions 28 .”

• cites [28] Brassart Olsen, C. To track or not to track? Employees’ data privacy in the age of corporate wellness, mobile health, and GDPR†. Int. Data Priv. Law 10, 236–252 (2020). sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

With more than 500 million wearables in use globally, the total data footprint reaches into the trillions of data points annually.

“With more than 500 million wearables in use globally 1 , the total data footprint of this ecosystem reaches into the trillions of data points annually.”

• cites [1] Statista. Wearables Statista Dossier. (2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The proliferation of biometric data collection through wearables introduces significant risks to individuals and society, including cybersecurity breaches, data misuse, consent violations, discrimination against vulnerable populations, biometric persecution, and widespread surveillance.

“However, the proliferation of biometric data collection through wearables also introduces significant risks to individuals and society.These include cybersecurity breaches, data misuse, consent violations, discrimination against vulnerable populations, biometric persecution, and widespread surveillance 25,26 .”

• cites [25] Sivakumar, C. L. V., Mone, V. & Abdumukhtor, R. Addressing privacy concerns with wearable health monitoring technology. WIREs Data Min. Knowl. Discov. 14, e1535 (2024). sourceNot checked — no full text of the source
• cites [26] Keserű, J. From skin to screen: bodily integrity in the digital age. (Mozilla Foundation, 2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

A typical smartwatch can record second-by-second data on steps and heart rate, generating tens of thousands of individual data points per day.

“For example, a typical smartwatch can record second-by-second data on steps and heart rate, generating tens of thousands of individual data points per day 5,6 .”

• cites [5] Ash, G. I. et al. Establishing a global standard for wearable devices in sport and exercise medicine: perspectives from academic and industry stakeholders. Sports Med. 51, 2237–2250 (2021). sourceNot checked yet

  Checked before — its earlier verdict is held back until a new check runs.

• cites [6] Keogh, A. et al. Six-month pilot testing of a digital health tool to support effective self-care in people with heart failure: mixed methods study. JMIR Form. Res. 8, e52442 (2024). sourceNot checked yet

  Checked before — its earlier verdict is held back until a new check runs.

Probably not a substantial claim: may not pass S3 (load-bearing).

A 2021 breach of a third-party platform that allowed users to sync health and fitness data compromised the records of 61 million Fitbit and Apple users.

“For example, a 2021 breach of a third-party platform that allowed users to sync health and fitness data compromised the records of 61 million Fitbit and Apple users 34 .”

• cites [34] Osborne, C. Over 60 million wearable, fitness tracking records exposed via unsecured database. https://www.zdnet.com/article/over-60-million-records-exposed-in-wearable-fitness-tracking-data-breach-via-unsecured-database/ (2022).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Companies frequently collect unnecessary data and fail to adopt privacy-protective defaults.

“Specifically, Privacy by Default settings (criterion #8, 41% High Risk), Threat Notification (criterion #3, 53% High Risk), User Notification about Third-Party Requests (criterion #1, 47% High Risk) and Minimal Data Collection (criterion #7, 24% High Risk) were often poorly implemented, indicating that companies frequently collect unnecessary data and fail to adopt privacy-protective defaults.”

Classified as probably not a substantial claim.

Raters independently evaluated the same policies.

“Raters independently evaluated the same policies, and inter-rater reliability was assessed using Cohen's Kappa.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Development began with a comprehensive review of global regulatory frameworks, digital ethics benchmarks, and consumer privacy initiatives.

“Development began with a comprehensive review of global regulatory frameworks (GDPR, CCPA, HIPAA, NIST, ISO/IEC 27001, and others), digital ethics benchmarks (FIPPs, UN Digital Identity Principles), and consumer privacy initiatives.”

May combine two claims.

Data Collection (criterion #6, 71% Low Risk) and Purpose Limitation (criterion #10, 53% Low Risk) reflect a general adherence to data transparency and purpose-specific data collection.

“Additionally, criteria like Data Collection (criterion #6, 71% Low Risk) and Purpose Limitation (criterion #10, 53% Low Risk) reflect a general adherence to the principle of data transparency and purpose-specific data collection.”

May combine two claims.

Existing regulatory frameworks, including GDPR, CCPA, and HIPAA, offer robust protections for user data but were not designed to address the continuous data streams, complex third-party ecosystems, and pervasive data collection intrinsic to wearable technologies.

“Similarly, existing regulatory frameworks, including the GDPR, CCPA, and HIPAA, offer robust protections for user data but were not designed to address the continuous data streams, complex third-party ecosystems, and pervasive data collection intrinsic to wearable technologies.”

• cites [36] Wolford, B. What is GDPR, the EU’s new data protection law? (GDPR.eu, 2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [38] California Department of Justice, O.o.t.A.G. California Consumer Privacy Act (CCPA, 2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [37] Services, U.S.D.o.H.a.H. Health Insurance Portability and Accountability Act of 1996 (HIPAA) (2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim. May combine two claims.

Privacy policies were assessed through a structured three-step process using the evaluation rubric, with two independent reviewers assessing each policy version.

“Privacy policies were assessed through a structured three-step process using the evaluation rubric, with two independent reviewers assessing each policy version: 1. Document Analysis: Reviewers systematically analysed privacy policies, terms of service, and transparency reports for evidence matching rubric indicators.”

May combine two claims.

Google faced legal action after investigations revealed it continued tracking user location data even after users disabled 'Location History'; 40 U.S. states reached a $391.5 million settlement in 2022.

“Similarly, Google-which also received strong scores in our analysisfaced legal action after investigations revealed that it continued tracking user location data even after users had disabled the 'Location History' setting.Regulators across 40 U.S. states reached a $391.5 million settlement with Google in 2022, citing deceptive privacy controls that misled users into thinking they had opted out of”

• cites [73] Bartz, D., Shepardson, D. & Freifeld, K. Google to pay nearly $400 million to settle U.S. location-tracking probe. (Reuters, 2022).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A preliminary version of the rubric was piloted on a representative sample of privacy policies from major wearable device manufacturers, testing clarity, consistency, and discriminatory capacity, and informed revisions.

“A preliminary version of the rubric was piloted on a representative sample of privacy policies from major wearable device manufacturers.This phase tested clarity, consistency, and discriminatory capacity across rubric dimensions and informed revisions to improve operational precision.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Discrepancies between raters were resolved through discussion, with finalised ratings used for subsequent analyses.

“Discrepancies between raters were resolved through discussion, with finalised ratings used for subsequent analyses.”

May combine two claims.

Some companies adhered closely to best practices, while others exhibited significant shortcomings, particularly in transparency reporting, vulnerability disclosure, and breach notification.

“While some companies adhered closely to best practices, others exhibited significant shortcomings, particularly in the domains of transparency reporting, vulnerability disclosure, and breach notification.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The study did not conduct formal participatory workshops with consumers; this decision reflects the highly technical nature of the policy language and the normative structure of privacy compliance rubrics.

“While we did not conduct formal participatory workshops with consumers, this decision reflects the highly technical nature of the policy language under review and the normative structure of privacy compliance rubrics, which are grounded in legal obligations rather than preference elicitation.”

May combine two claims.

Law enforcement agencies in the U.S. and other jurisdictions have purchased commercial data including from wearables to conduct location tracking, raising concerns about discriminatory surveillance of racial and ethnic minorities.

“Meanwhile, law enforcement agencies in the U.S. and other jurisdictions have purchased commercial data -including from wearables-to conduct location tracking, raising concerns about discriminatory surveillance of racial and ethnic minorities 58 .”

• cites [58] Toomey McKenna, A. US agencies buy vast quantities of personal information on the open market–a legal scholar explains why and what it means for privacy in the age of AI. in The Conversation (2023).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Inter-rater reliability was assessed using Cohen's Kappa.

“Raters independently evaluated the same policies, and inter-rater reliability was assessed using Cohen's Kappa.”

Classified as probably not a substantial claim.

The Privacy and Data Security Evaluation Framework was developed through a multi-step, evidence-driven process involving expert consultation, regulatory analysis, and pilot testing.

“The Privacy and Data Security Evaluation Framework was developed through a multi-step, evidence-driven process involving expert consultation, regulatory analysis, and pilot testing.”

Classified as probably not a substantial claim.

Each dimension was further broken down into 24 criteria informed by existing regulatory standards, industry guidelines, and best practices.

“Each dimension was further broken down into 24 criteria informed by existing regulatory standards, industry guidelines, and best practices.”

May combine two claims.

Germany banned certain children's smartwatches, which were found to function as covert listening tools, violating child protection laws and parental trust.

“A notable example includes Germany's ban on certain children's smartwatches, which were found to function as covert listening tools, violating both child protection laws and parental trust 62 .”

• cites [62] Reuters. German agency bans children’s ‘smart’ watches over spying concerns (2017).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Within the scope of this review, several areas for improvement were identified, including standardisation of privacy policies, enhanced user control mechanisms, stronger privacy defaults, and stricter accountability measures for data handling.

“Within the scope of this review, several areas for improvement were identified, including the standardisation of privacy policies, enhanced user control mechanisms, stronger privacy defaults, and stricter accountability measures for data handling.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Stakeholder engagement consisted of structured expert input from privacy, consumer rights, and cybersecurity specialists, including collaboration with Mozilla's Privacy Not Included team and consultations with the University's Data Protection Officer and legal team.

“Stakeholder engagement consisted of structured expert input from privacy, consumer rights, and cybersecurity specialists.This included collaboration with Mozilla's Privacy Not Included team, as well as consultations with our University's Data Protection Officer and legal team.”

May combine two claims.

Overall inter-rater agreement for the evaluation was 89.3% (Cohen's Kappa = 0.893, 95% CI [0.855-0.931]), indicating excellent agreement.

“The overall inter-rater agreement for the evaluation was 89.3% (Cohen's Kappa = 0.893, 95% CI = [0.855-0.931]),indicating excellent agreement.”

Classified as probably not a substantial claim. May combine two claims.

Each rating decision was supported by direct excerpts from the policy text and assessed according to the definitions and examples provided in the rubric.

“Each rating decision was supported by direct excerpts from the policy text and assessed according to the definitions and examples provided in our rubric (see Evaluation Rating Definitions in Supplemental File 1).”

May combine two claims.

Consumer advocacy groups such as the Digital Standard and Mozilla's Privacy Not Included provide valuable tools but are generalised frameworks that do not account for the distinct privacy challenges associated with wearable-derived biometric data.

“While consumer advocacy groups such as the Digital Standard and Mozilla Foundation's Privacy Not Included initiative provide valuable tools for evaluating consumer-facing technologies-and informed aspects of our rubric-they are generalised frameworks that do not account for the distinct privacy challenges associated with wearable-derived biometric data.”

• cites [44] Foundation, M. Privacy Not Included. (2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [45] Reports, C. The Digital Standard. (2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable).

These gaps, coupled with the lack of global regulatory harmonisation, underscore the urgent need for a targeted approach tailored to wearable technologies.

“These gaps, coupled with the lack of global regulatory harmonisation, underscore the urgent need for a targeted approach tailored to wearable technologies, one that integrates principles of privacy, fairness, and accountability into their development and governance.”

• AssumptionRests on an assumption: No systematic evaluation of wearable device privacy policies has been conducted to date.

Classified as probably not a substantial claim.

An interrater reliability analysis using two independent raters was conducted to evaluate the reliability of the rubric and the consistency of ratings.

“To evaluate the reliability of the rubric and the consistency of ratings, we conducted an interrater reliability analysis using two independent raters.”

Classified as probably not a substantial claim.

Given behavioural barriers such as consent fatigue and privacy paradox effects, improving disclosure alone will not be sufficient.

“However, given well-documented behavioural barriers such as consent fatigue and privacy paradox effects, improving disclosure alone will not be sufficient.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Calibration exercises were conducted using practice policies to address discrepancies and standardise the application of the rubric.

“Calibration exercises were conducted using practice policies to address discrepancies and standardise the application of the rubric.”

May combine two claims.

Most companies allow users to access their data in structured formats, disable targeted advertising, and register accounts without requiring government-issued identification.

“This suggests that most companies allow users to access their data in structured formats, disable targeted advertising, and register accounts without requiring government-issued identification.”

May combine two claims.

The absence of consistent, enforceable global standards leaves consumers vulnerable to opaque data-sharing practices, insufficient security measures, and inadequate protections for sensitive health biodata.

“The absence of consistent, enforceable global standards leaves consumers vulnerable to opaque data-sharing practices, insufficient security measures, and inadequate protections for sensitive health biodata.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Independent initiatives such as Mozilla's Privacy Not Included, Consumer Reports' Digital Standard, and NOYB.eu aim to hold companies to higher privacy standards.

“To support consumers, independent initiatives such as Mozilla's Privacy Not Included 44 , Consumer Reports' Digital Standard 45 , and NOYB.eu 46 aim to hold companies to higher privacy standards, offering accessible evaluations that encourage ethical data practices.”

• cites [44] Foundation, M. Privacy Not Included. (2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [45] Reports, C. The Digital Standard. (2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [46] Rights, N.-E.C.f.D. NOYB Enforces Your Right to Privacy Every Day. (2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

These findings highlight the regulatory gaps in addressing the unique privacy challenges posed by wearable technologies and the potential risks to users from inconsistent data practices.

“Taken together, these findings highlight the regulatory gaps in addressing the unique privacy challenges posed by wearable technologies and the potential risks to users from inconsistent data practices.”

Classified as probably not a substantial claim.

Both raters received training to ensure uniform understanding of criteria, indicators, and rating categories (High Risk, Some Concerns, Low Risk).

“Both raters received training to ensure uniform understanding of criteria, indicators, and rating categories (High Risk, Some Concerns, Low Risk).”

May combine two claims.

Highest agreement was observed for criterion #6 (data collection), #12 (data retention), #13 (data control), and #22 (security over time), with Cohen's Kappa = 1.

“The highest agreement was observed for criterion #6 (data collection), criterion #12 (data retention), criterion #13 (data control), and criterion #22 (security over time), with Cohen's Kappa = 1 for all these criteria.”

Probably not a substantial claim: may not pass S4 (based).

These efforts, along with current regulations, lack specific standards for the consumer wearables industry.

“However, these efforts, along with current regulations, lack specific standards for the consumer wearables industry.”

• AssumptionRests on an assumption: No systematic evaluation of wearable device privacy policies has been conducted to date.

Classified as probably not a substantial claim.

Specific articles and provisions such as GDPR Articles 5, 15, 17, 20, 25, and 32; CCPA Sections 1798.110, 1798.120, 1798.135; and NIST SP 800-61 were mapped to indicators that shaped the framework.

“Specific articles and provisions-such as GDPR Articles 5, 15, 17, 20, 25, and 32; CCPA Sections 1798.110,1798.120,1798.135; and NIST SP 800-61-were mapped to indicators that collectively shaped our framework.”

May combine two claims.

Wearables marketed to minors frequently collect geolocation, audio, and health data with minimal parental awareness or consent, and in some cases have been found to act as de facto surveillance devices.

“Wearables marketed to minors frequently collect geolocation, audio, and health data with minimal parental awareness or consent, and in some cases have been found to act as de facto surveillance devices 61 .”

• cites [61] Shi, M. Who’s Really Watching? The Hidden Data Risks of Children’s “Phone Watches”. (Responsible Data for Children, 2024).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

The primary limitation with this review is that policy does not necessarily reflect practice.

“Herein lies the primary limitation with this review: policy does not necessarily reflect practice.”