Wearable Activity Trackers: A Survey on Utility, Privacy, and Security

Numerous literature surveys related to WATs—and wearables in general—have been published. Table 1 summarizes these surveys. Several surveys provide valuable insights and in-depth knowledge, from different perspectives, about wearables. For example, they review applications of wearables for healthcare [110, 177, 256], rehabilitation [181], occupational safety [179, 232], and activity recognition [130]. They also review the reliability [81], adoption [117], privacy [52, 206], and security [56, 216, 223] of wearables. However, these surveys cover various types of IoT devices and wearables (e.g., eye-worn glasses, EEG devices) that are not specifically designed to track Physical Activity (PA), thus making it difficult to determine which findings are specific to WATs. The present survey focuses solely on WATs to reveal related findings and research gaps that are specific to WATs.

Whereas previous surveys on WATs focused on utility [220], reliability [68, 127], quality [213], and WATs’ effectiveness for behavior change [231], the present survey takes a holistic approach by integrating utility, privacy, and security aspects. This is important for three reasons. First, research on WATs is multi-faceted, as these devices serve practical purposes by collecting personal data and exposing users to privacy threats. The comprehensive approach provided by this survey ensures that readers gain a well-rounded understanding of the benefits and perils of using these devices. Second, utility, privacy, and security are inherently intertwined, where challenges in one domain inevitably affect the others. The well-documented tradeoff between utility and privacy further illustrates this connection [17, 137]. In addition, privacy threats identified for WATs are necessarily connected to the security measures implemented by SPs. Our integrated approach offers valuable insights into three cardinal dimensions of WAT research. Third, the holistic approach also allowed us to draw a research agenda for WATs by identifying six research gaps that researchers might explore next.

Finally, many research articles on WATs have been published in the past 5 years but were not considered in past surveys of wearable technology. Given the speed at which new technologies in WATs emerge and advancements in sensor technologies (e.g., oximeter sensors added after COVID-19), updating the survey on WATs research was necessary.

Figure 1 summarizes our methodology. We conducted a systematic literature review following the assessment criteria of Kitchenham et al. [126] (e.g., inclusion/exclusion criteria, comprehensive literature search). To identify relevant papers, we crafted a set of search strings that encompassed the key terms related to our research focus: [“physical activity data” or “fitness data” or “fitness tracking” or “wearable activity tracking” or “physical activity tracker” or “fitness tracker” or “wearable activity tracker”] and [“utility” or “privacy” or “security” or “perception” or “understanding” or “experience” or “expectation” or “sharing”] and [“system” or “device” or “application” or “app” or “service” or “bracelet” or “wrist-worn”]. We chose these specific keywords, according to previous surveys [220, 223], to ensure a comprehensive search and to enable us to capture a wide range of relevant literature while excluding studies that do not directly contribute to our inquiry. For example, we include “physical activity data” and “fitness data”, as they are directly related to the topic of WATs. In addition, we used “fitness tracker” and “wearable activity tracker”, as they were interchangeably used in the literature to refer to WATs. We also used terms such as “bracelet” and “app”, as they uncover studies related to the physical form factor of WATs or other entities in the WAT ecosystem. We searched in ACM DL, IEEE Xplore, the AIS library, USENIX, PoPETs, ScienceDirect, and Springer Link. We used Google Scholar to include papers from other databases and publishers (e.g., Taylor & Francis). To update our paper database during the review process, we also kept track of the most recent and relevant published proceedings (e.g., IMWUT). We identified 688 papers (after removing duplicates). After retrieving the full articles, we excluded the papers that (i) are not written in English, (ii) were published in 2012 or earlier, or (iii) are not peer reviewed (e.g., position papers, letters, editorials, prefaces, article summaries, theses, patents, or books). We included only the papers that met both of the following criteria: (i) they are about WATs and/or have implications for WATs, and (ii) they have direct relevance to the utility, privacy, and/or security of WATs. The first author applied the inclusion and exclusion criteria and later confirmed them with the second and third authors. Out of 688 papers, 236 were selected to be reviewed (including two papers we added after the first survey submission) .² Three authors summarized the papers’ context, methodology, and findings. The reviews were discussed in weekly meetings. To synthesize the findings, we adhered to the guidelines provided in the JBI Manual for Evidence Synthesis [13]. First, we reviewed the summaries of the papers, identifying the common patterns and homogeneity between them. Then we highlighted aspects of heterogeneity and diversity with regard to their findings.

The remainder of the survey is organized as follows. In Section 2, we define WATs and explain their ecosystem. In Section 3, we discuss several aspects of WATs’ utility, such as their core benefits and different usage patterns, including social usage and data sharing. In Section 4, we first discuss the risks of WATs for users’ privacy and the main findings about users’ awareness, attitudes, and behaviors. We review WATs’ privacy policies, the existing regulations for protecting users, and the ethical aspects of using WATs for research or health campaigns. In Section 5, we discuss how utility, privacy, and security are intertwined and how users make tradeoffs among these aspects. In Section 6, we review different types of attacks and security vulnerabilities related to WATs. In both Sections 4 and 6, we present the existing work as Privacy-Enhancing Technologies (PETs) and security countermeasures. In Section 7, we discuss several open issues concerning WATs and possible opportunities for future research. We conclude the article in Section 8.

Users have unique reasons for (and ways of) using WATs [89, 112, 113, 125, 163]. Various patterns have been identified based on the profile characteristics of WAT users (Table 2). Users check their WATs more often while exercising [10, 92] and prefer to engage in activities that their WATs can track [76]. Users might use different trackers to track different types of activities (e.g., using one to track walks and another to track runs) [10, 202]. Users might concurrently use multiple devices [6, 42, 145] . Next, we list users’ motivations for tracking:

The most common way of sharing WAT data is through companion apps on smartphones or, less frequently, through desktop companion software [71] . Findings on users’ propensity to share WAT data are varied. Tang and Kay [233] found that about \(50\%\) of users use social features, whereas Rooksby et al. [202] found that only a small percentage share their WAT data. To share and compare data easily, those who share tend to use devices and apps that are similar to those their friends and family have [94, 139, 196, 211] . Interestingly, Fritz et al. [76] found that sharing with friends and family is not an effective strategy for increasing motivation, whereas sharing with strangers is. Sharing could support reaching a common goal and increase motivation. In cooperative tracking, a group goal must be reached under specific constraints (e.g., only one member of the group can contribute toward the activity goal at a given time) [199, 203]. This was found to increase relatedness and boost individual motivation [203]. In general, users find value in comparing their data with that of others [10, 190, 253]. Sharing enables users to engage in constructive discussions [190], and to compete with friends, family [159, 209, 221], and strangers [190, 202] .

Caregivers can monitor their children’s data to check if they are healthy or to keep track of the children’s chores [174]. When a child’s tracker does not work correctly, they can feel ‘left out.’ Families in low-income neighborhoods could have limited engagement with WATs, as they often prioritize their children’s education over their physical health [209]. But WATs can promote social mindfulness in high-crime areas, where users feel a sense of safety and community support [208] .

Users’ willingness to share WAT data depends on the type of data shared and with whom it is shared [78, 190]. Users mainly share WAT data with people they know [78, 94, 190] and with people who are similar to them (e.g., same gender, goals, activities, and/or interests) [190, 211, 228]. Pevnick et al. [183] found that male and young healthcare workers are more willing to share WAT data with healthcare providers. Users share data with friends and strangers to compete and/or to show a positive image of themselves, whereas they share data with family members to encourage and motivate one another to be healthier [7] .

Users can also share data to increase their social status [159, 196, 253]. Some might even manipulate their data for entertainment/presentation purposes [94, 196], which can be perceived as bragging [202]. Furthermore, some users might feel intrusive looking at WAT data belonging to people that they do not know [190]. Finally, other research has identified groups of users who prefer to not share their WAT data [76, 202] .

The way users use their WATs changes over time [76, 233]. We identified four categories of usage duration:

Over time, users’ habits were found to change: they change their motivations [10] and goals [186, 233] to use WATs. Interestingly, WAT data utility becomes less meaningful and relevant over time, as users correlate it with their routines [113]. After long-term use, distinct usage patterns emerge. These usage patterns are summarized in the second half of Table 2.

Several studies have identified patterns of engagement with WATs, more specifically around adoption, adherence, and abandonment. Table 3 summarizes various elements that were found to positively or negatively influence users’ decisions to adopt, adhere to, or abandon their WATs.

Overall, interfaces of WATs are perceived as easy to use [159, 186, 188]. In general, users perceive the immediate feedback provided by WATs as useful, because it helps them achieve their goals [173], and to become more aware of their body image [29]. However, past research has identified several usability issues with different types of WATs .⁶ Matt et al. [159] found that the onboarding experience might be overwhelming for some users. Furthermore, users were found to have issues with basic tasks, such as synchronizing their WATs with their online accounts [167, 174] . With many types of WATs, the user interface tends to lack customization, personalization, and language (localization) support [167]. Additional issues were identified with navigation, text entry, and voice recognition [26, 167], and also with insufficient accessibility support [167]. New users of WATs were found to have trouble making sense of the numerical and visual representation of their PA data [10, 121], which could lead to frustration with their WATs [6, 188] .

Past research also identified issues with WATs’ activity detection and notification. Several types of WATs were found to incorrectly identify context (e.g., WATs giving prompts to walk while the user is on an airplane) [167]. WAT notifications were also found to be disruptive, interfering with concentration (e.g., by distracting the user by vibrating/flashing), and can reduce sports performances [10] .

Identified issues also concerned the accuracy of measurements of WATs. Data collected by WATs was found to not always represent actual PA (e.g., steps were recorded when none were taken [159]). Accuracy issues can elicit negative emotions in users (e.g., mistrust and annoyance) toward their WATs [76, 98]. Users were found to have differing requirements for accuracy [186, 261]. Some categories of users were found to care about the accuracy of WAT data [26, 65, 145, 167, 176, 188, 202, 253], whereas other types of users were not very interested in the accuracy of their WAT data [94]. More specifically, past research identified that users tend to perceive the accuracy of their WAT data in three ways: accurate and reliable [196]; partially accurate, but still useful [6, 26, 186, 196, 202]; and inaccurate and unreliable [26, 65, 98, 159, 167, 186, 202] .

Finally, many issues identified in past research are related to the ergonomics and form factors of WATs:

In the context of workplaces, existing studies show that employers have a vested interest in promoting the use of WATs for their employees [75, 123]. This creates a profitable business for WAT manufacturers, as they can sell more of their products (and additional services) to companies.¹⁷ Companies intending to adopt WAT-based wellness programs follow either a wellness model or a performance management model [156]. Whereas the former is used to promote healthy lifestyle habits and to enhance the well-being of the employees, the latter aims to increase efficiency, productivity, and safety.¹⁸ The concern with the first model is for employees’ privacy, whereas the second is more serious, as data can be used to monitor and detect misconduct, and it can negatively affect employees’ careers .

Most studies focus on the first model [43, 87, 88]. Many employees report perceiving wellness programs positively. They usually participate in such programs to improve their awareness of their activity levels, to become more physically active [43], or to socialize [87]. During the campaigns, employees can become concerned about the erosion of the boundary between their work and personal lives. However, they also tend to discuss their WAT data with colleagues (as an ice breaker for conversations during breaks). In the workplace, discussions about step counts or activities can increase social pressure, breach privacy boundaries, and hence raise tensions. Studies show that not all employees are happy to join such campaigns, and some decide to not join [43, 87] .

Given the lack of evidence of the long-term benefits of wellness campaigns and the social distance created between participants and non-participants, Gorm and Shklovski [88] suggest reconsidering the notion of “success” in such campaigns. Marassi and Collins [156] discuss the privacy and autonomy concerns of wearing WATs in the workplace and express many reservations, especially about the employees’ “right to bodily integrity,” “life-work boundaries,” and the “power imbalance” between employers and employees. In the United States, there is no legislation that protects employees’ privacy [34] .¹⁹ In the EU, the GDPR does not permit employers to monitor their employees. To address these issues, previous studies recommend (i) clarifying the terms and implications of information disclosure to employees [34]; (ii) proposing new laws that limit data collection by employers [34]; and (iii) using a coaching-based approach, where employers use third-party services that provide health advice to their employees [156] .

Users, in general, are open to using PETs [269]. Therefore, designing useful solutions could be a promising approach to preserving users’ privacy. As an addition to the work of Alqhatani and Lipford [8] that reviews existing PETs provided by known WAT brands, our work reviews the PETs proposed by the literature:²⁰

A large amount of research has been conducted on WATs and Bluetooth security. Multiple attacks, privacy issues, and mitigation techniques were identified. Table 4 shows all of the studies related to Bluetooth and Bluetooth Low Energy (BLE) security and WATs. By analyzing these studies, we identified six main types of attacks:

Hale et al. [100] developed an open source platform that aims to be used by researchers to facilitate wearable security investigations. The platform could be used to collect data, conduct attacks, and identify security vulnerabilities. They used their platform to analyze BLE communications of multiple WATs and observed that all of them use encryption protocols to communicate with their companion apps.

In conclusion, WATs tend to not use any protection mechanisms, such as basic cryptographic schemes [100]; in addition, they send unencrypted traffic, mainly for optimization reasons (e.g., to save battery life). As a result, the public attributes of the transmitted packets can be used to track WATs. Not using encrypted communication can lead to eavesdropping, data injection, and/or firmware modification. MitM attacks can be performed to bypass (basic) encryption mechanisms. An attacker can inject fake commands to conduct DoS attacks. Traffic analysis can disclose sensitive information, even if the communication between a WAT and its paired smartphone is encrypted. Finally, whereas some studies proposed mitigation techniques, only a few of them actually evaluated these techniques.

Several studies analyzed the security of WAT companion apps. Goyal et al. [93] analyzed the code of the companion apps, how the data is stored on the paired smartphone, the apps’ privacy policies, and the communication between the app and the SPs’ servers for two types for two WAT models. They showed that for both WATs, the data stored on the smartphone is not encrypted and some of it is even shared with third parties. Rahman et al. [192] analyzed the HTTP communication between Fitbit and Garmin devices and their servers. They showed that the data was not encrypted, including the user’s credentials for Fitbit. Fereidooni et al. [73] considered users as potential adversaries. Users might want to send fake data to their SP’s cloud for financial gain.²⁸ They analyzed multiple WATs and used MitM attacks to inject fake data into their servers. By reverse engineering the companion apps, they showed that multiple companion apps do not encrypt the data stored on the smartphone, which makes it easily readable and writable.

To inject fake data, Fereidooni et al. [73] also conducted MitM attacks between the companion app and the SP. They performed a new attack directly on the WAT by reverse engineering the hardware system and directly accessing the device’s memory to inject fake data [72]. After synchronization, the fake data was correctly encrypted and registered by the companion app.

Mendoza et al. [161] analyzed how the Fitbit companion app communicates with Fitbit’s servers by sniffing HTTP/HTTPS communication and how TPAs can access data using Fitbit’s API. They showed that authentication credentials are sent unencrypted and that the OAuth 2.0 protocol²⁹ is not correctly implemented. This creates vulnerabilities that an attacker can use to gain access to or modify the data. Classen et al. [46] reverse-engineered the Fitbit companion app to study how to modify it. Modifying the app could enable attackers to associate it with another account in order to download a user’s data. Finally, Kazlouski et al. [119] analyzed the communication between two well-known (yet anonymized) WAT companion apps and servers. They collected ground truth by using a MitM setup and sniffed the encrypted packets by using Wireshark. Then they computed correlations of the size and frequency of the packets with the activities, heart rate, and step count. They show that activities and metadata of encrypted packets are strongly correlated and that it is possible to use metadata to identify the occurrence and duration of several activities and even to estimate other information (e.g., estimating the heart rate). In conclusion, multiple devices do not implement adequately secure phone storage and communication with the SP’s servers, which can lead to serious threats, such as eavesdropping and/or data injection.

Side-channel attacks are a type of security attack that are conducted based on extra available information, instead of using vulnerabilities of security protocols. As the main purpose of WATs is to track users’ movements, it is possible to use the sensor data to infer sensitive information, such as the words a user writes, their typing on a keyboard, or even their biometrics.

Maiti et al. [153] studied how WAT sensor data can be used to recognize typing patterns on a computer keyboard. Such attacks can be used by adversaries to collect passwords for bypassing authentication systems. Similarly, Maiti et al. [155] used smartwatch sensor data to infer which keys are typed on a 10-digit keypad and a QWERTY keypad on a smartphone. They reached an accuracy of \(74\%\) for the 10-digit keys and had a mean accuracy of \(30\%\) for the QWERTY keypad. Sabra et al. [207] and Wang et al. [247] showed how similar attacks can be conducted to infer ATM PIN codes. The former obtains an accuracy of \(80\%\) for 6-digit PIN codes; this increases to \(93\%\) with five attempts. Lu et al. [148] aimed to infer PIN codes and Android pattern lock patterns. They found that it is possible to infer the Android pattern lock pattern two-thirds of the time, within the first 20 guesses. Maiti et al. [154] studied the inference of rotary combination lock passcodes and showed that WAT sensor data (especially gyroscope data) can be used to greatly increase the likelihood of inferring the lock combination. Eberz et al. [61] studied impersonation attacks. They showed that WAT sensor data can be used to mimic an individual’s biometrics (e.g., gait), which would enable bypassing biometrics-based authentication systems.

In general, we can affirm that using WAT sensor data to bypass a security system is a potential threat that should be considered by vendors. Several mitigation techniques are proposed. For example, WATs could deactivate sensors when they detect real-time activities such as typing [153]. Alternatively, WATs could add fine-grained noise to sensor data, in such a way that activities, such as walking or swimming, are still recognized but fine hand movements, such as typing, are not recognized [247]. Or, users can simply remove their devices when they type.

Although a large number of studies related to security are about weaknesses, attacks, and privacy leaks, some of them are about new protocols and tools that can help preserve the security of systems. To protect against different attacks, Rahman et al. [192] propose an encryption protocol based on symmetric keys. They show that their solution has little effect on the device’s performance. Using a system of tagged packets, Skalka et al. [226] develop a framework to manage and filter private data at the edge-router level. Yan et al. [260] propose an ML-based method that uses received signal strength indicators to detect spoofing attacks from peripheral devices (e.g., additional sensors worn on the foot) with high accuracy. Finally, Xin et al. [258] show that their new framework is effective at detecting when data is injected in WAT sensor data streams through specific data variations.

A few studies aimed to identify and assess the different types of existing attacks. To classify attacks, Mnjama et al. [164] developed a conceptual WAT threat assessment framework based on the CIA triad (i.e., confidentiality, integrity, availability) and on Microsoft STRIDE (i.e., spoofing, tempering, repudiation, information disclosure, denial of service, the elevation of privilege). They analyzed different phases of WAT data transmission and storage and the current health-wearable literature. Moganedi and Pottas [165] identified all known vulnerabilities affecting WATs and discussed these vulnerabilities with regard to their corresponding parts of the WAT ecosystem and the ways they are classified according to various existing standards. To classify the different currently known vulnerabilities, they identified five main components in the WAT ecosystem (the WAT, Bluetooth, smartphone companion app, WiFi, and cloud storage) and six control families (access control, audit and accountability, identification and authentication, system and communication protection, system and information integrity, and PII processing and transparency).

WAT data can be used to enhance security systems by using the collected data to authenticate users, and by either substituting or complementing other credentials. Table 5 provides a concise summary of various authentication methods utilizing WATs for security-related applications.

Notably, gait-based authentication was found to exhibit low error rates [48, 114]. Vhaduri and Poellabauer [244] demonstrated high accuracy in user recognition by using physiological and activity data collected by WATs. Tehranipoor et al. [235] showed the effectiveness of ECG-based keys for user identification. Chen et al. [41] introduced a resilient authentication system that combines credentials and biometrics by using a virtual 12-key keypad on a user’s fingers. Sturgess et al. [230] developed an authentication system for NFC payments with smartwatches. This system detects the intent to pay and then authenticates the user when they want to proceed with payment by using their smartwatch and an NFC terminal. This system prevents attackers from paying with stolen devices or from executing unwanted payments with unlocked devices worn by the user. However, in another study, the same authors showed that an attacker of approximately the same height as the user has a \(20.6\%\) higher likelihood of impersonating the user [229]. In summary, WATs are equipped with multiple sensors that enable them to be used for biometric authentication: the WAT’s firmware could use the biometric data to ensure that the device is activated only when used by its rightful owner; third-party services could also use the collected biometric information for user authentication.

One of the first findings from our survey is that there is no clear definition of WATs and that research on WATs is scattered across different overlapping categories (e.g., wearables, IoT). The lack of a clear definition leads to difficulty in identifying related literature, inconsistent research findings, and ineffective privacy regulations. A first step would be to properly define a “WAT” and to delimit research on the topic for more focused, consistent, and comparable research. This survey makes the first step in this direction.

The literature shows that privacy risks are huge, diverse, and widespread in terms of the information that can be inferred and of the consequences. Part of these risks stem from the behaviors of the users; this is due to their lack of knowledge and/or awareness of the WAT ecosystem and the privacy risks. When users are not concerned about privacy, they tend to behave carelessly. In addition, as users often choose utility when considering the utility–privacy tradeoffs of WATs, PETs must be particularly effective and desirable for users. To achieve this goal, we believe that future research should focus on the following: designing PETs that use the specificities of WAT data (e.g., numerical time series, TPAs), as is done for location data [189], and on pedagogical solutions to increase users’ understanding of WAT ecosystems. To do so, a user-centered approach should be taken (e.g., participatory design or co-design [120]). However, the following topics are sufficiently covered in the current research landscape: usage patterns; habits; the underlying reasons for adoption, adherence, and abandonment; and users’ privacy concerns.

Another issue identified in this survey is related to the policies governing the collection of user data via WATs. SPs enact policies that provide them many opportunities to develop business intelligence and to offer additional services to users. However, this often comes at the expense of diminished privacy for the users whose data was collected. More importantly, informed consents are often presented through long, complex, and tedious-to-read legal text, which induces users to accept the terms without understanding their implications. A few studies propose alternative solutions (e.g., abstractions or visualizations) to improve privacy policy legibility, but unfortunately, none are yet used in practice. Future studies should further investigate this aspect. In addition, competent authorities should create regulations that would require SPs to use easy-to-understand privacy policies. A related issue is the lack of protective regulations for users. The main limitation of the current legislation is that WAT data are not classified as health information. Consequently, WAT SPs are not obliged to adhere to specific legislation, which could offer better protection for users’ data (e.g., ECPA and HIPAA). We believe that legal scholars and policymakers should rework existing regulations to better protect WAT users.

Our survey shows that WATs are vulnerable. Many communications and storage protocols are vulnerable to attacks such as eavesdropping or side-channel attacks. There could be several factors contributing to these vulnerabilities: the low computational power of some WATs; the costs required to implement higher security standards; and/or the characteristics, which are typically not associated with identifiable information, of WAT data. Another interesting perspective to consider is that SPs are typically not considered adversaries in security research, as we noted in our survey. When they are considered adversaries, they are generally considered as honest but curious. This survey reveals that many types of inference are possible with WAT data and that SPs should be modeled as adversaries. Future research should therefore focus on raising WAT security standards and on studying business models and data management plans typically associated with WATs.

We also reviewed many studies on HAR and inference. Most of the HAR papers are functionality oriented, wherein they mainly highlight HAR benefits and focus on achieving high performance. Most privacy-oriented inference papers do not consider activities or specific personal information (e.g., health), as most of them study the inference of data, such as passwords or other types of information that could be used for authentication. We believe that future research should investigate privacy risks more systematically by finding inspiration from inference studies published on location and smartphone data (e.g., religion, political views, or consumption habits), as done recently by Zufferey et al. [268].

We identified studies of WATs’ utility, privacy, and security that reported heterogeneous and sometimes opposite findings. Meta-analyses could be useful for comparing these diverse and sometimes conflicting findings. Similarly, studies comparing users vs. non-users, as well as some cross-cultural studies, have reported inconsistent findings. This underlines the need for replication studies in WAT research. To enable replication (and reproducibility), researchers should follow transparency and openness practices (e.g., see the work of Niksirat et al. [210] for guidelines on research transparency and openness).