The devices we wear are no longer mere accessories. Today, a smartwatch or fitness tracker transforms the body into a inexhaustible source of personal and biometric data which are collected almost continuously. Heart rate, sleep patterns, steps, location, and stress levels all contribute to the databases of manufacturers, app developers, insurers, and technology platforms.
This reality places wearables at the center of a top-level legal and ethical debate. It's not just a question of whether data processing complies with the GDPR, but how to ensure that, in an environment of continuous monitoring and automated decisionsso that the person retains effective control over their information and is not reduced to a mere statistical profile.
What are wearables and why do they pose so many legal challenges?
When we talk about wearables, we are referring to smart electronic devices that are integrated into clothing or worn on the bodyThese include smartwatches and fitness trackers, smart glasses, biomedical patches, biosensors, connected rings, and devices for children and the elderly, among others. Their common feature is the presence of sensors that capture information from the user and their environment and send it to a mobile device, the cloud, or other connected systems.
These devices are used both in private and professional settings. They serve to Sync notifications, receive calls, use GPS, pay in stores, monitor physical exercise, or record health indicators (heart rate, blood oxygen, temperature, sleep cycles, etc.). They are also used to support people with disabilities, in the healthcare field or in security forces.
The problem is that, to offer all those functions, wearables need to collect a huge amount of data, much of it from the specially protected category of health or biometric dataFurthermore, they tend to operate silently, automatically, and constantly, which makes it difficult for the average user to understand the true scope of the treatment.
From a European perspective, these devices fall squarely within the framework of General Regulation of Data Protection (RGPD) and, in Spain, also in the LOPDGDD. Furthermore, they raise questions about the data sovereignty in EuropeData protection is a fundamental right, and this requires that the design, development and commercial exploitation of wearables respect principles such as lawfulness, fairness and transparency, purpose limitation, minimization, accuracy, storage limitation and security.
However, the very logic of wearables puts a strain on these principles: data collection is massive, storage is often prolonged, the purposes accumulate (wellbeing, analytics, marketing, personalization, research…) and the possible combinations with contextual data (location, schedules, mobility, contacts, smart home devices) allow for very sophisticated inferences about the user's life.
Types of data that wearables collect and why they are so sensitive
The data handled by these devices goes far beyond simply counting steps. A typical wearable can process basic identification information, contact details and access credentials, in addition to everything necessary for the service to work (for example, the email account to synchronize messages or credentials for mobile payments).
But the real qualitative leap lies in biometric and health data. We're talking about heart rate, blood pressure, oxygen saturation, body temperature, sleep quality, activity and rest stagesMenstrual cycles, estimated stress levels, or even movement patterns that can be used to uniquely identify a person. All of these are data that the GDPR considers especially sensitive.
Geolocation information is another key element. Many wearables record it with great accuracy. routes, usual commutes, entry and exit times from home or workplaceas well as frequent stops (gym, school, medical centers, etc.). From this mosaic, it is possible to reconstruct an individual's lifestyle with a level of detail that, in the wrong hands, can be extremely intrusive.
The combination of physiological data and context generates a powerful capacity for inference. With sufficient records, it is possible to deduce habits, beliefs, probable health status, or even anticipate future behaviors (for example, risk of illness, probability of absenteeism, or consumption patterns). These types of profiles can end up being used in decisions that directly affect people.
In sectors such as employment, insurance, and finance, the temptation to use metrics like physical activity, sleep, or stress as indicators of performance, risk, or reliability is high. This raises legal questions about proportionality, transparency, non-discrimination, limits on profiling and automated decision-makingespecially when the person does not have a reasonable alternative to refuse without suffering consequences.
Practical risks: from individual privacy to national security
The challenges of wearables are not mere theoretical hypotheses. High-profile incidents have already occurred demonstrating how the combination of geolocation data and usage habits can compromise not only the individual privacy, but also collective securityOne of the most talked-about cases was that of sports applications that allowed users to view, on a public heat map, the training routes of military personnel deployed at allegedly secret bases.
In these types of scenarios, an oversight in privacy settings or the automatic publication of routes can reveal sensitive locations, patrol routines, schedules, and hotspotsWhat seems like a harmless running app turns into a first-rate source of intelligence, exploitable by hostile actors to plan attacks or carry out espionage operations.
But you don't need to go to geopolitical extremes to appreciate the magnitude of the problem. Many users provide their wearable apps with detailed personal data, photographs, access to contacts, microphone, camera or real-time location without reviewing the privacy options. That's why users need to learn how to manage metadata and review the settings in detail to avoid unnecessary exposure. Combined with unrestricted default settings, this can expose information to other app users, the manufacturer, or third parties with whom data is shared.
In the corporate environment, wearables can become an additional risk vector. Devices connected to company Wi-Fi networks or linked to work phones can expand the attack surface; a security flaw or misconfiguration could facilitate an attack. unauthorized access to internal resources, leaks of confidential data, or even reputational problems if audio or video is recorded in sensitive contexts without the proper legal basis.
From a legal point of view, risks also arise when these gadgets allow Voice or video recordings in private spaces, workplaces, educational centers, or situations involving minorsDepending on the applicable legislation, the capture and dissemination of these images or sounds may entail criminal, administrative or civil liability, both for the user and, in certain cases, for the organization that promotes or tolerates such use.
European legal framework: GDPR, LOPDGDD and key obligations
The GDPR and Spanish data protection regulations impose a broad set of obligations on those who design, market, and operate wearables or their associated applications. Any company that determines the purposes and means of data processing will be considered data controllerregardless of whether the device connects via a mobile phone, home WiFi, or a cloud infrastructure.
A first set of obligations has to do with the user informationBefore the interested party starts using the app or device, the controller must explain clearly, accessibly and comprehensibly, at least: who the company is, how to contact it and, if there is one, its Data Protection Officer; what data is collected; for what purposes; what is the legal basis that legitimizes each processing; for how long the data will be kept; to which recipients it will be communicated and whether international transfers are foreseen.
It should also be detailed what rights the user has (access, rectification, erasure, restriction, objection, portability), as well as their right to withdraw consent at any time You can already file a complaint with the competent supervisory authority. If there will be automated decisions with legal or significant effects (for example, risk profiles that influence an insurance policy), the logic applied and the possible consequences of that processing must be explained.
The way this information is provided is crucial. European authorities recommend using understandable formats adapted to the deviceShort, layered texts, explanatory icons, pop-up screens at key moments, videos, or other visual resources are all effective, provided they don't obscure or impair the text's readability. It's generally good practice to offer an initial layer with essential information and allow users to access additional details through links or menus.
Furthermore, if the data is to be used for a purpose other than that for which it was collected (for example, going from recording physical activity to using that data for market research or marketing campaigns), it will be necessary inform the interested party about this new purpose and, in many cases, obtain new consentespecially when it comes to health or biometric data.
Legitimization of processing and limits of consent
In the ecosystem of apps and wearables, one of the most common legal bases is the execution of a contractThe logic is clear: to provide the promised service (monitoring activity, displaying notifications, measuring vital signs, etc.), it is essential to process certain data. For example, a sports tracking app really needs to record steps, distance, and heart rate to provide statistics to the user.
However, that contractual basis only legitimizes the processing of data that are strictly necessary for the provision of the serviceAny additional information (continuous geolocation when not essential, access to contacts, browsing histories, cross-marketing data, etc.) will require another legal basis, and in many cases it will be essential to obtain specific and separate consent.
Furthermore, consent cannot be an empty formality. It must be free, specific, informed and unambiguousThis excludes pre-ticked boxes, "bulk" consents that group multiple purposes without the possibility of granularization, or situations in which the user is forced to accept excessive processing in order to use a basic functionality of the device.
Authorities have emphasized that affirmative action for obtaining consent must be clear. It can include unusual gestures that are properly explained (for example, performing a specific movement with the mobile phone as a way of “accepting”), provided that the user understands without any doubt what that gesture implies. However, actions of common use such as quickly scrolling through lengthy terms and conditions are not considered valid to demonstrate that there is informed consent.
Another sensitive issue is the use of wearables by minors. Spanish regulations stipulate in 14 years is the minimum age to consent for oneself in information society servicesFor users under the age of 18, the consent of the parent or legal guardian will be required, and the responsible party must make reasonable efforts to verify that this consent is authentic, applying measures appropriate to the risk and the available technology.
Privacy by design and by default in wearables
The GDPR requires the incorporation of the data protection by design and by default in any solution that processes personal data, including mobile apps, wearable firmware, cloud platforms, and management dashboards. This involves assessing risks from the initial product design phases and implementing appropriate technical and organizational measures before, during, and after development.
In practice, privacy by design means, for example, Minimize the amount of data captured, limiting precision or granularity when not necessary (for example, storing routes at the zone level rather than the exact address if it doesn't provide real added value), processing information locally on the device instead of always sending it to the cloud, or applying pseudonymization techniques and strong encryption both in transit and at rest.
From a technical standpoint, manufacturers can protect apps using a two-pronged approach: on the one hand, source code obfuscation and use of cryptographic techniques to make it difficult for third parties to analyze or modify it; on the other hand, integration of runtime self-protection mechanisms (RASP) capable of detecting manipulations, compromised environments or attempts at reverse engineering while the application is running.
The default settings are equally important. The initial options should be discreet and respectful of privacyThis allows users to voluntarily activate more invasive features if they wish. This includes disabling social route sharing by default, hiding public rankings, limiting profile visibility, and restricting the collection of non-essential data until the user explicitly enables it.
When treatments involve a high risk to people's rights and freedoms, as often happens with systematic monitoring of large-scale health or biometric dataThe GDPR requires a Data Protection Impact Assessment (DPIA). This assessment must identify specific risks (re-identification, sensitive inferences, unauthorized access, uncontrolled secondary uses) and document mitigation measures and additional safeguards.
Technical security: Bluetooth, apps, backend and smart home
Wearables do not operate in isolation; they are part of a complex ecosystem that includes Device firmware, communication protocols, mobile applications, APIs, and cloud serversAny of these components can become an exploitable weakness if security hasn't been properly considered; therefore, tools such as Glasswire They are useful for monitoring and controlling traffic on home and corporate networks.
Bluetooth plays a key role in the connection between wearables and mobile phones, especially in its low-energy version (Bluetooth Low Energy, BLE). Over the years, several factors have been identified. vulnerabilities in the protocol that allow, under certain conditions, blocking devices, intercepting traffic, or manipulating dataespecially when the specific implementation does not follow good authentication and encryption practices.
The device's software itself may also contain programming errors or insecure configurations. Weak authentication, poor cryptographic key management, or a lack of input validation can lead to this. data leaks, device hijacking, code injection, or unauthorized access to stored dataEven the best conceptual design falters if it is not accompanied by code reviews, penetration testing, and regular security updates.
Mobile applications associated with wearables represent another common attack vector. Poorly developed apps can include flaws that expose personal data or open the door to phone compromiseIn addition, there is the risk that users will download fake or malicious versions that mimic official ones, or grant excessive permissions (camera, microphone, SMS, contacts) without assessing whether they are truly necessary for the functions they intend to use; therefore, it is advisable to strengthen protection and follow guidelines from privacy in messaging and communications.
On the server side, platforms that store and process information from wearables—often located in cloud infrastructure—are a very attractive target for cybercriminals. Databases full of health records, historical locations, and behavioral profiles They can be monetized in underground markets or used for blackmail, identity theft, or highly personalized social engineering campaigns.
When wearables are integrated with smart homes, the risk is amplified. It's not uncommon for a watch or bracelet to be used for control lights, thermostats, cameras, or even smart locksIf such a device is lost or stolen and does not have adequate anti-theft measures (PIN or biometric lock, remote erase, connection limits), a third party could potentially interact with the user's home environment.
Proactive responsibility, security gaps, and the roles of the actors
The principle of proactive responsibility requires data controllers to demonstrate, not just declare, their compliance with the GDPR. In the wearables sector, this translates into having clear policies, records of processing activities, adequate contracts with suppliers, and documented evidence of the security measures applied, as well as impact assessments carried out where appropriate.
Breach management is an essential component. Since many wearables process sensitive data and create profiles, an intrusion or leak can cause significant damage. Therefore, organizations must have incident response protocols, rapid notification procedures to the supervisory authority and, when the risk requires it, to the affected users themselves, explaining transparently what has happened and what measures have been taken.
When the volume or nature of the data justifies it, the company that owns the app or the wearable ecosystem must appoint a Data Protection Officer (DPD) and clearly communicate their contact details to users. The DPO is responsible for monitoring compliance, advising on impact assessments, participating in incident management, and acting as a point of contact with the authority and stakeholders.
In complex environments, it is essential to clearly define roles: who acts as the controller, joint controller, or data processor. A single wearable device can involve... hardware manufacturers, software developers, analytics platforms, cloud providers, and third parties that integrate additional functionalitiesWithout a precise definition of responsibilities, users are left unprotected and it becomes difficult to make claims in the event of breaches.
Finally, the reuse of data in contexts such as medical research, segmented marketing, or personalized insurance pricing requires constant review of the consistency between the legal bases invoked, the stated purposes and the reasonable expectations of the userThe line between legitimate innovation and misuse of personal information can be thin, especially when the economic incentives to exploit that data are very high.
In this scenario, users and organizations that incorporate wearables into their activities must adopt a more critical and conscious attitude: Analyze whether they really need the device, consider less invasive alternatives, and choose providers with a good security track record.Review the privacy settings in detail, train the staff who will use them, and ultimately integrate the legal and cybersecurity dimension from the beginning and not as a last-minute addition.
All these issues show that the biggest challenge for wearables lies not so much in technological sophistication as in legal frameworks and data governance: how to regulate continuous information flows, how to guarantee transparency in complex ecosystems, and how to ensure that, in an age of constant quantification, The dignity and autonomy of the person continue to prevail over the logic of data..
